Extending Security

Last month we talked about Windows Server 2003 Security Guide. Agreed that good on paper, the use of security configuration wizard (ANI) as its toolbox, your guide In order to ensure that your server.

But for all its effectiveness, scw only with Microsoft applications. If you have Symantec antivirus, the VERITAS NetBackup or any other non-Microsoft applications running on the server, MCU helper functions will not recognize and automatically safety. Therefore, this month, we want to DIY our own scw extended to deal with these applications.

If I had a hammer before we started building the new extension, let us talk about what a minute conducting behind-the-scenes when you run badly. First of all, if you have not, installation of Windows Server 2003 Service Pack 1 on a prototype machine. And check out contents of the% windir% securitymsscwkbs folder. In the folder, you will see many knowledge base files. XML expansion. These files contain Agencies told what data security, as well as what descriptive text Agencies filled with Guangxi When you start it.

You can view and edit them in any text editor. There are three types of knowledge base files: root kb define the basic information about a particular OS version should never be modified. Root for Windows 2003 kb named w2k3.xml. KBS expansion accept that security settings for a particular server role. As an example, kb for ISA Server is the so-called isa.xml. KBS localization accept the text, you can see on the screen GUI when you Agencies start. AP localization kb for Isa server named isaloc.xml. When you run badly ghosts, the three types of files merger, and for your prototype to file main.xml. This document contains what we can call the "problem", or more technically, the document contains all the options you may have the option to ensure that the machines and Agencies.

As you work through the MCU GUI interface, selecting the service, you would like to security and choice you want to disable, you eventually creating another XML- file that contains what we can call it "the answer" policy document, the so-called policy.xml what you used by the application of security policy, and other machines on your network.

[Click image to enlarge. ] Figure 1.

For three types of applications on the left yields the correct policy, named "policy.xml," This is applicable to network servers.

In last months column, we discussed how to use ANI fill out the " problems," how to use the "Windows Server 2003 Security Guide" give you the right answer. However, as discussed earlier in the correct answer Only when issues related to Microsoft products. If you The VERITAS NetBackup client installed on a server you want to secure? You out of luck - unless you create your own problems.

And jerry-building a simple example to illustrate how to do this, let us pretend that our servers The VERITAS NetBackup client installation. If I were to run a default installation MCU, the MCU support functions would be unable to find NetBackup installation in server. They suggest that I shut down unnecessary network ports and services, which might include the obviously necessary NetBackup customer service network running port 13782 / tcp.

If I use the microcontroller to ensure that my server, I will need to extend it so that the problem is NetBackup given to me in your. Otherwise, I may have to face a very secure server, it is unusable backups.to do this, you will find the typical default and localization accept KBS found in the% windir% securitymsscwkbs folder. Order a copy of which open it in a text editor, and rewrite it to include the necessary NetBackup services. This can be a very challenging task, as KBS accepted in the folder can be very long, very complicated.

Fortunately, we have created a simple example, you can use as a template.

This template is to simplistic, because there are more services and network ports VERITAS NetBackup necessary, but it will also do our Objective. We have discard all extra-curricular drill samples and the extension of its localization accept KBS compressed into a single document. We also stressed that in the Green sections you need to modify.

< / services> < / role> real automatically 13,782 < protocols> the TCP