Planning for Print Server Security

Planning for print server security is vital in order to protect your organization’s resources. As with any production server, you need to protect the physical print server and safeguard access to data stored on the server. Consequently, your security plan must address three areas:

• Physical location
• Group Policy settings
• Printer permissions
  

Ensuring the Physical Security of Each Print Server

Locate your print servers in a physically secure location that only designated individuals can access. Allowing unauthorized access to your print servers risks harm to the system. In addition, consider to what extent you also need to restrict physical access to network hardware. The details of implementing these security measures depend on your physical facilities as well as your organization’s structure and policies.

Securing the Print Environment

Windows Server 2003 adds new Group Policy settings that affect how clients connect to print servers on the network. Two of these policy settings are particularly useful for security.

Allow print spooler to accept client connections This Group Policy setting, which is configured on the server, determines how clients access the print server over the network. If an individual with administrative credentials creates shared printers for use by managed clients, the spooler automatically allows connections upon creation of the first shared printer. If a virtual spooler resource is created on a clustered server, the spooler likewise automatically allows connections. If no shared printers or virtual spooler resources already exist, you might need to enable this policy setting by using the Computer Management snap-in from a remote computer. To administer print services on a server running Windows Server 2003, log on to the server locally, or log on remotely through a Remote Desktop session.

Point and Print restrictions This Group Policy setting, which is configured on client computers, determines the print servers to which the client can connect. To provide a higher level of security for managed workstations, this policy setting controls a client computer’s ability to connect to and install a printer driver from specified print servers. By default, managed clients can use Point and Print only with servers that are within their forest. An administrator can use this policy to add additional servers to the list of trusted print servers. Alternatively, administrators can disable this policy to enable managed clients to connect to any accessible print server and install a printer driver from it.

Using Printer Permissions to Control Access to Shared Printers

Even if the physical server is in a secure room, the print server might still be accessible through remote administration tools. Therefore, you need to implement methods for restricting access to remote administration of print servers. You can restrict access to a print server by setting printer permissions.

Source: /technet.microsoft.com/en-us/library/cc780641.aspx

Security Improvements for Windows Server 2008

While fundamentally changing the design of the operating system, the Windows Server 2008 team has also included several features designed to eliminate security breaches and malware infestations, as well as capabilities meant to protect corporate data from leakage and interception. Let's take a look at some of the improvements.

Operating System File Protection

A new feature currently known as operating system file protection ensures the integrity of the boot process for your servers. Windows Server 2008 creates a validation key based on the kernel file in use, a specific hardware abstraction layer (HAL) for your system, and drivers that start at boot time. If, at any subsequent boot after this key is created, these files change, the operating system will know and halt the boot process so you can repair the problem.

Operating system file protection also extends to each binary image that resides on the disk drive. OS file protection in this mode consists of a filesystem filter driver that reads every page that is loaded into memory, checking its hashes, and validating any image that attempts to load itself into a protected process (processes that are often the most sensitive to elevation attacks). These hashes are stored in a specific system catalog, or in an X.509 certificate embedded within a secure file on the drive. If any of these tests result in failure, OS file protection will halt the process to keep your machine secure. This is active protection against problematic malware.

BitLocker

The need for drive encryption has been a popular topic in a lot of security channels lately, and in both Windows Vista and Windows Server 2008 Microsoft has risen to the call by developing a feature called BitLocker. BitLocker is designed especially for scenarios where a thief may gain physical access to a hard drive. Without encryption, the hacker could simply boot another operating system or run a hacking tool and access files, completely bypassing the NTFS filesystem permissions. The Encrypting File System in Windows 2000 Server and Windows Server 2003 went a step farther, actually scrambling bits on the drive, but the keys to decrypt the files weren't as protected as they should have been. With BitLocker, the keys are stored within either a Trusted Platform Module (TPM) chip on board your system, or a USB flash drive that you insert upon boot up.

BitLocker is certainly complete: when enabled, the feature encrypts the entire Windows volume including both user data and system files, the hibernation file, the page file, and temporary files. The boot process itself is also protected by BitLocker—the feature creates a hash based on the properties of individual boot files, so if one is modified and replaced by, for example, a Trojan file, BitLocker will catch the problem and prevent the boot. It's definitely a step up from the limitations of EFS, and a significant improvement to system security over unencrypted drives.

Device Installation Control

Another security problem plaguing businesses everywhere is the proliferation of the USB thumb drive. No matter how securely you set your permissions on your file servers, no matter how finely tuned your document destruction capabilities are, and no matter what sort of internal controls you have on "eyes-only" documentation, a user can simply pop a thumb drive into any open USB port and copy data over, completely bypassing your physical security. These drives often contain very sensitive information that ideally should never leave the corporate campus, but they're just as often found on keychains that are lost, inside computer bags left unattended in an airport lounge, or in some equally dangerous location. The problem is significant enough that some business have taken to disabling USB ports by pouring hot glue into the actual ports. Effective, certainly, but also messy.

In Windows Server 2008, an administrator will have the ability to block all new device installs, including USB thumb drives, external hard drives, and other new devices. You can simply deploy a machine and allow no new devices to be installed. You'll also be able to set exceptions based on device class or device ID—for example, to allow keyboards and mice to be added, but nothing else. Or, you can allow specific device IDs, in case you've approved a certain brand of product to be installed, but no others. This is all configurable via Group Policy, and these policies are set at the computer level.

Windows Firewall with Advanced Security

The Windows Firewall version included with Windows Server 2003 Service Pack 1 was exactly the same as that included in Windows XP Service Pack 2. Microsoft bundled that firewall with Service Pack 1 as a stopgap measure—deploy this firewall now, Microsoft said, so you will be protected, and we will work to improve the firewall in the next version of Windows.

The new Windows Firewall with Advanced Security combines firewall and IPsec management into one convenient MMC snap-in. The firewall engine itself has been rearchitected to reduce coordination overhead between filtering and IPsec. More rules functionality has been enabled, and you can specify explicit security requirements such as authentication and encryption very easily. Settings can be configured on a per-AD computer or user group basis. Outbound filtering has been enabled; there was nothing but internal filtering in the previous version of Windows Firewall. And finally, profile support has been improved as well—on a per-computer basis, there is now a profile for when a machine is connected to a domain, a profile for a private network connection, and a profile for a public network connection, such as a wireless hotspot. Policies can be imported and exported easily, making management of multiple computers' firewall configuration consistent and simple.

Network Access Protection

Viruses and malware are often stopped by software defenses before they can run within a user's session, but the ultimate protection would be if they never even got access to the network. In Windows Server 2008, Microsoft has created a platform whereby computers are examined against a baseline set by the administrator, and if a machine doesn't stack up in any way against that baseline, that system can be prevented from accessing the network—quarantined, as it were, from the healthy systems until the user is able to fix his broken machine. This functionality is called Network Access Protection.

NAP can be broken down into three key components:

Health policy validation
Health policy compliance
Limited access

Source:computingtech.blogspot.com/2008/05/windows-server-2008-security.html

Understanding the Roles of Server 2003 Security Policies

Windows domains rely on policy-based security mechanisms, but Windows security policy deployment can be confusing to the uninitiated. What's the difference between the local security policy, domain security policy and domain controller security policies? When and how do you use each? How do you use site GPOs and OU GPOs for best security, and how do they all interact together? What security policy tools are included with the operating system and how is each used? This article will provide an overview of the roles of Server 2003 security policies and how to use them to secure your systems and network.

Policy-based Security: What does it Mean?

A security policy can be defined as a set of rules and practices that govern how an organization manages and protects its assets (which can include facilities, equipment, infrastructure or information). IT security focuses on the protection of:

• Computer systems/software
• Network connectivity
• Sensitive or confidential information

Policy-based security, then, begins by defining the organization’s philosophy and priorities in regard to protection of the above. This is the management definition of “security policy.” Application of the rules and practices outlined in the policy statement is then accomplished via the technical definition of “security policy.”

In this context, a security policy is a template used to select and configure the various security mechanisms supported by the operating system or application. Modern Windows operating systems support many different types of security policies, which are configured through the Group Policy interface.

Server 2003 Security Policies

Security policies that can be configured through the Server 2003 GUI and command line tools include:

• Account policy: allows you to define password requirements (length, complexity, maximum age, history), lockout parameters (number of permitted logon attempts, duration of lockout) and Kerberos key policies (how long the keys are valid).
• Audit policy: allows you to set up security auditing and define which events will be logged (for example, failed/successful logon attempts, access to specific resources, etc.).
• Cryptographic policy: allows you to control the algorithms used by TLS/SSL.
• Domain policy: allows you to add and remove computers and create trusts between domains.
• Firewall policy: allows you to set standard policies for Windows Firewall for all the computers within a domain or OU.
• IPsec policy: allows you to configure the use of Internet Protocol Security (IPsec) to encrypt data in transit over the network.
• EFS policy: allows you to define whether EFS can be used to encrypt files and folders on NTFS partitions.
• Disk quota policy: allows you to enable/disable and define defaults for disk quotas, and specify what happens when a quota limit is reached.
• PKI policy: allows you to define support for PKI policies regarding auto-enrollment for digital certificates issued by the Windows Server 2003 certification authority.
• Smart card usage policy: allows you to require smart cards to be used for Windows logon to provide multi-factor authentication.

Group Policy Objects

Security settings can be applied through Group Policy Objects (GPOs) at various levels of the Active Directory hierarchy. A GPO is essentially a collection of policy settings that affect users and computers, and which is associated with an Active Directory container object (site, domain, OU) or local computer. One GPO can be linked to multiple containers or multiple GPOs can be linked to a single container. Group policies are inherited by child objects and are applied from highest to lowest. Group policies are processed in the following order:

• Local GPO (applies to the local computer only). This is accessed via the Local Security Policy interface described above.
• Site GPO (applies to all users and computers in all domains in the site). These are accessed and edited through the Group Policy tab on the Properties sheet of a site, which you access by right clicking the site in the Active Directory Sites and Services administrative tool.
• Domain GPO (applies to all users and computers in the domain). These are accessed via the Active Directory Users and Computers tool or the Group Policy Management console as described above.
• OU GPO (applies to all users and computers in the OU, and in any OUs nested within the OU). These are accessed through the Group Policy tab on the Properties sheet of the OU, which you access by right clicking the OU in the Active Directory Users and Computers MMC.
  

As you can see, Group policy applies to all the users and computers in the container to which the GPO is linked. It does not affect security groups, but you can filter Group Policy according to security groups by setting a group’s permissions on the GPO.

Group Policy information for all but local policies is stored in Group Policy containers and in the Group Policy template. The Group Policy container is an area in the Active Directory. The Group Policy templates are folders located in the \Policies folder within the SysVol folder on the domain controllers. Each template folder contains a file named Gpt.ini in its root, which stores information about the GPO. The domain in which each GPO (except those for local policies) is stored is the storage domain. A GPO can be linked to domains other than the one in which it’s stored.

Via:windowsecurity.com

How to check Your Web Server Security

Sometimes actions performed by the attacker on the server may affect its functionality. So its always advisable to check server’s security to avoid attack on the server. Always check the resources of server which might be affected.

You can check the CPU usage by firing top command and look for the application or scripts that consume your CPU

For strange processes you can check with ps -awux command.

Check /tmp directory and /var/tmp directory for scripts and binaries copied there.

The attacker might use the server to host IRC bot like psybnc or eggdrop which connects to port 6667 when a server is compromised . You can if any of your applications connect to that port with sockstat:

#sockstat | grep 6667

If there’s not much traffic on your server you could use netstat command to see if suspect connections are made.

#netstat -a

Install and run regularly an rootkit finder application (for e.g /usr/ports/security/rkhunter).

Source:blog.eukhost.com/