Security Configuration Manager in Windows 2008 R2

Security Configuration Manager is an attack surface reduction tool for Windows Server 2008 SP2.  It determines the minimum functionality required for a server’s role, and disables functionality that is not required.  SCW does the following:

 

·            Disables unneeded services

·            Blocks unused ports

·            Allows further address or security restrictions for ports that are left open

·            Prohibits unnecessary IIS web extensions, if applicable

·            Reduces protocol exposure to server message block (SMB), LanMan, and Lightweight Directory Access Protocol (LDAP)

 

NOTE: When using this procedure you must be aware that different options within ‘Security Configuration Manager’ will be required depending on the type of server you are building.  This procedure details the configuration for the OCS EDGE servers only.

 

·            To harden the server, the Security Configuration Wizard (SCW) needs to be run which allows you to create a security policy to be applied.

 

·            Logon to the OCS EDGE server with the local admin account and launch Security Configuration Wizard via Administration Tools.

 

 

·         Select Next (click OK on the Access denied prompt)

 

 

 

 

·         Select Create a new security policy and Next

 

 

 

 

·         Add the server name you are applying the Security policy to and click Next.

 

 

·         Next of the resulting screen.

 

·         Next again.

 

 

·         Ensure the following installed roles are selected and click Next.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

·         Ensure the following installed features are selected and click Next.

 

 

 

·         Ensure the following installed options are selected and click Next.

 

 

 

 

 

 

 

·         Ensure the following additional services are selected and click Next

 

 

 

 

 

 

 

 

 

·         Take the default option handling unspecified services and click Next.

 

 

·         Review the following services as per the screenshots.  (DNS client is now enabled so will not appear)

 

 

 

 

 

 

 

 

 

 

 

 

 

·         Select Skip this section and Next.

 

 

·         On Registry setting click Next.

 

 

·         Deselect - It has surplus processor capacity etc and click Next.

 

 

 

·         Select Local Accounts on the remote computers option in addition to Domain Accounts and click Next.

·         Take the default option on the next four screens and click Next four times.

 

 

 

 

 

 

 

·         Select Audit successful and unsuccessful activities and click Next.

 

 

 

·         Deselect the option to include the SCWAudit.inf security template and click Next.

 

·         Click Next to save the policy.

 

·         Create the policy name OCS_Edge_SCW and click Next.

 

·         Click apply now and Next.

 

·         Click Next once the policy has been applied

 

 

·         Click Finish.

 

intrusion software Installation IDS Sensor Server 7.0 SR4.3

1.1      Intrusion Detection Software (IDS)

 

Intrusion Detection Software (IDS) RealSecure Server Sensor provides automated, real-time intrusion monitoring, detection, and protection by analysing events, host logs, and inbound and outbound network activity on critical enterprise servers to block malicious activity. It communicates via an agent locally installed on an appliance. The agent talks back to a central repository in North America & is supported by the global AVZ Security Team.  This product should be installed on all systems within a geographical site/office of mytestlab that has a DMZ environment.

 

http://www.iss.net/products/RealSecure_ServerSensor/product_main_page.html

In most cases the firewall in the local site will need configuring to allow the sensors to communicate with the two repository servers in North America.

Ports

TCP/IP Ports 902 & 2998

• Inside of the source folder select the SETUP.EXE file to launch the application.

 

• On the “Welcome” screen click – NEXT.
• On the “License Agreement screen click – I ACCEPT.
• On the “Readme” screen click – NEXT.
• On the “Setup Types” screen click – CUSTOM
• 

 

• On the “Select Components” screen leave default with – “Server Sensor with Network Monitoring” option selected then click - NEXT.
•  

 

• On the “Enforce Audit and Blocking” screen leave both selections – UNCHECKED, and click – NEXT.

 

• 

 

• On the “Choose a Sensor Name” screen add the computer name followed by _snsr for example your server’s pc name is Server1 . In the space given add Server 12_snsr – then click NEXT.

 

• On the “Choose folder for the Server Sensor” screen select “BROWSE” to change the installation path for the installation. For Servers with a D:drive designated for a cd drive then choose the next available “physical” drive other than C unless there is no other “physical” drive. Then click – OK & NEXT.
• 

 

• For the “Choose Folder for ISSDaemon” screen follow the same rules as in the previous step #10.
•  

 

• On the “Select Authentication Mode” leave the checkbox “UNCHECKED” then click- NEXT.

 

 

• On the “Automatic Key Import” screen ensure the allow import is selected – NEXT.
• 

 

• On the “Select Public Key Administrators” screen type the first entree Server Name 1 then click – ADD. Then type the second entrée Server Name 2 and click- ADD. Then click – NEXT.
• 

 

• On the “Server Sensor Cryptographic Setup” screen there should be two entrees  Microsoft Enhanced Cryptographic Provider v.1.0/RSA_KEYX (1536 bit)/3DES/SHA-1 & Microsoft Enhanced Cryptographic Provider v.1.0/RSA_KEYX (1024 bit)/RC4 (128 bit)SHA-1. Be sure that the one with (1536 bit) is first in the list. If not highlight that option and click the “Move Up” button. Then (1024 bit) option will be second. Delete any other options if they exist. Then click – NEXT.
• 

 

• On the “Start copying files” screen click – NEXT.
• 

 

• untick the box for archiving realsecure sensor cryptographic private keys. NEXT
• 

 

• Click – FINISH on the last screen and you are done

 

• Stop & Disable the ISS Buffer Overflow service in Computer Manager

 

• 

 

• Reboot Server.

 

• Inform #ITSECURITY of the installation & confirm the agents are communicating.

 

Uninstalling IBM IDS

1     Uninstalling IBM IDS from DMZ Servers

 

On The Server

 

1. Prior to uninstalling the agent, you must first disable agent protection. To do this, open a command prompt and run the following:
   
   <drive>:\Program Files\[IBM] ISS\Server Protection\rapapp -ap 

Note: It may also reside in Program Files (X86) which is the case on most servers in our environment

Note: If the above command returns an error, contact IT security and request them for the access protection password and then running the following

<drive>:\Program Files\[IBM] ISS\Server Protection\rapapp –ap <password>

 

2. Once agent protection is disabled, run the following command from a command prompt to uninstall Host Protection for Windows agent:

 

<drive>:\Program Files\[IBM] ISS\Server Protection\AgentRemove.exe -full

 

            An uninstall log will be generated in C:\Windows\AgentRemove.log.

 

 

3. Open the registry and delete the registry keys listed below if they exist:

 

HKLM\Software\Agent 

HKLM\Software\ISS 

HKLM\System\CurrentControlSet\Services\blackICE 

HKLM\System\CurrentControlSet\Services\RapAPP 

HKLM\System\CurrentControlSet\Services\issfltr

HKLM\System\CurrentControlSet\Services\issnet 

HKLM\System\CurrentControlSet\Services\issnfh 

HKLM\System\CurrentControlSet\Services\W32Yelo

 

4. Open a command prompt and run the following commands to remove the services if they exist:

 

sc delete VPatch 

sc delete blackice 

sc delete rapapp 

sc delete ibmproventia

 

 

5. Delete the following directories and files if they exist:

 

\Program Files\ISS\proventia server 

\Windows\System32\blackdll.dll

\Windows\System32\drivers\blackcat.sys 

\Windows\System32\drivers\MakoNT.sys 

\Windows\System32\drivers\isskboep.sys 

\Windows\System32\drivers\issnetv.sys 

\Windows\System32\drivers\issnfhv.sys

 

6. Reboot the server.
   Finally, contact IT security to get the agent removed manually within SiteProtector.