Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Authorization Using Security Options and Registry Settings

In addition to user rights and object permissions, other types of controls also affect authorization. Many registry entries can restrict the access that a user or application has to a specific network connection, software, resource, or process. Some registry entries are easy to edit because they are represented in the Security Options section of Group Policy. Others can be found in the Administrative Templates section of Group Policy. In addition, Authorization Manager, Software Restriction Policies, and IPSec Policies can all be used to control user activity and resource access on the network. Administrative Templates, Software Restriction Policies, and Authorization Manager are discussed in Chapter 4.

Security Options can impact authentication and authorization. When set in local group policy, they impact the local computer. They can also be set in a group policy that is applied to many computers. The following Security Options should be considered when building an authorization model.

Accounts: Limit Local Use of Blank Passwords to Console Logon

When this option is enabled, as it is by default, and a user account has a blank password, the user will be able to log on only from the console. Attempts to access the computer over the network using the account with a blank password will fail. This option has no impact on domain accounts.

Devices: Allow Undock Without Having to Logon Only

When enabled, as it is by default, if a server is running on a portable computer docked in a docking station, the server can be removed from the docking station without logging on.

Devices: Allowed to Format and Eject Removable Media

This setting specifies who can format or eject removable drives. Choices are administrators, power users, or administrators and interactive users or not defined. By default, the local Administrators group is selected.

Devices: Prevent Users from Installing Printer Drivers

If enabled, as it is by default, users cannot install printer drivers. Printer drivers run in the kernel and are therefore able to do more harm. A malicious individual might provide malicious code in the form of a free printer driver and persuade users to download and install his malware by advertising it as making printers work better. If users are able to install rinter drivers, then they might install such malware without knowing they are doing so. Alternatively, an unsupported printer driver that is buggy might be installed and cause problems. Leaving this setting at the default may prevent users from downloading and installing potentially harmful drivers and prevents users from installing and sharing a network printer. By default, administrators, power users, and server operators can install printer drivers. This setting has no impact on them.

Device: Restrict CD-ROM to Locally Logged On User Only: Disabled

If enabled, this setting prevents network access to the server's CD-ROM drive while a user is logged on locally to the server. This setting might prevent access to installation CD-ROMs over the network, thus preserving license compliance, preventing users from obtaining access to software they should not have, and protecting them from access to potentially harmful code on CD-ROMs loaded on the server. The setting is disabled by default. If enabled, however, it may interfere with installer programs that do not run in the context of the current user but in their own user context.

Device: Restrict Floppy Use to Locally Logged On User Only: Disabled

If enabled, this setting prevents network access to the server's floppy drive if there is a locally logged on user. This setting is disabled by default.

Device: Unsigned Driver Installation Behavior: Warn But Allow Installation

When a driver is installed, this setting determines one of three actions: Warn but allow installation (the default), Silently succeed, or Do not allow installation. Drivers may be submitted to the Windows Hardware Quality Lab for testing and approval. Once approved, Microsoft signs the driver. An unsigned driver will cause the action selected here. If a driver is not approved, that does not mean it is bad, just that it hasn't been tested. When an attempt is made to install a driver, the system looks for a signature. If the signature is good, then even if the security option is set to Do not allow installation, the driver installation will succeed. If no signature is present, then this setting must be set at the Warn designation or the Silently succeed setting, or else it will not be installed. By setting this option to the warning, a pop-up will query for approval to install the driver. The hope is that the warning will alert the user that an unapproved driver is about to be installed. Perhaps if problems occur after the installation, the connection with the unapproved driver will lead to a problem resolution. Unfortunately, not every "good" driver is approved, so best practices dictate to set this option to Warn. In a high-security installation, set the option to Do not allow installation. If an unsigned driver must be used, an authorized administrator can temporarily change the setting to allow the driver to be installed, and then switch the setting back to Do not allow installation.

Network Access: Named Pipes That Can Be Accessed Anonymously

Named pipes are communication processes. Security can be established for named pipes, but some applications create named pipes that do not need authentication. If the server needs access to these types of named pipes, add their name to this Security Option. Several default pipes are listed, and you may want to remove those names if access to those pipes is not necessary.

Network Access: Remotely Accessible Registry Paths

This option allows you to list registry paths that may be accessed remotely, while denying access to all others. This is important. If an attacker can remotely access the registry, much damage can be done. Restricting access limits the risk. Several paths are listed.

Network Access: Remotely Accessible Registry Paths and Subpaths

Additional paths are listed. The system will inspect the WinReg key to determine access permissions for these paths.

Network Access: Shares That Can Be Accessed Anonymously

Anonymous access to shares makes the computer more vulnerable to attack. The shares that you create should have access controlled via share permissions, as defined in Chapter 5. However, blocking anonymous access to all shares may prevent some applications from running. Use this option to list shares that must allow anonymous access.

Allow Systems to Be Shut Down Without Having to Log On:

If this option is enabled, anyone can shut down the server from the logon screen. Servers should only be shut down for maintenance, and you should account for all system shutdowns. The system records the user account and the entered reason for the shutdown in the system log when a logged on user shuts down the system. Requiring a user to log on to shut down a server also ensures that a server is not inadvertently shut down, removing its services from the network. Best practices require that, for a system to be shut down, you must log on and have the authority to shut the system down. In Window Server 2003, this also means that, by default, you are required to enter a reason for the shutdown. This security option would allow you to modify this behavior and present the option in the GINA to shut the system downno logon required. (The computer can, of ourse, be shut down by pulling its plug or other wise interrupting electrical service. However, this will be recorded as an unexpected shutdown. )

System Objects: Strengthen Default Permissions of Internal Systems Objects (e.g. Symbolic Links):

When enabled, as it is by default, this option increases security on internal system objects. Internal systems objects are those used by the operating system to manage critical operations. Using this setting increases security on those objects but may prevent legacy applications from working.