Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

The following tasks apply generally to most types of connections you
can create.

Enable or Disable a Connection

Network Connections Folder right-click
on connection Enable/Disable

Be sure to notify users before disabling a connection they are using.

Monitor a Connection

You can monitor the status of

your
connections a couple of ways:

Network Connections Folder
Right-click on an active connection Status

Right-click on connection icon in system tray (if present)
Status

The General tab displays basic connection statistics. Some
connections like VPN also have a Details tab that shows information
like the IP address of the remote server, the authentication and
encryption methods used, and so on.

You can also monitor the general status of all the connections on
your machine by:

Network Connections Folder View Details

Share a Connection

See

Advanced

under

Configure a Dial-up Connection later in this
section.

Repair a Connection

If a connection stops

working
properly, you can try repairing it by:

Network Connections Folder right-click on connection Repair

This may fix simple issues like an expired DHCP lease or missing DNS
server IP address. After repairing a connection, check it like this:

Network Connections Folder right-click on connection Status Support Details

If it still doesn't work, open its properties and
check its configuration settings.

Configure Remote Access Preferences

For outbound dial-up

connections to remote access
servers, you can configure your client location information,
autodial, and callback settings as follows:

Network Connections Folder Advanced Remote Access Preferences specify your information OK twice

Enabling autodialing starts an outgoing connection on demand when
it's required to access the Internet or a remote
access server. Callback lets a remote access server call back a
remote client attempting to connect, either to avoid having the
client pay the charges or to verify the identity of the client by its
phone number. You can also enable connection logging here for
troubleshooting purposes.

Callback can be enabled on the client, but it must also be required by the server in order for it to be used. The default setting causes a dialog box to be displayed on the client during the initial connection attempt, requesting that the user specify the phone number that the server should use to call the client back. Alternatively, you can require that the server always call the client back at a specified number to confirm the identity of the client by its location. The callback settings configured on the remote access server override any callback settings you configure for the outbound dial-up connection on your client computer. The server can require callback, deny callback, or allow the client to set the callback procedure.To reconfigure location information or add additional locations, use Phone and Modem Options in Control Panel.

Enable Operator-Assisted Dialing

This feature is toggled on


or off using:

Network Connections Folder Operator-Assisted Dialing

With this feature on, you can double-click on a connection, pick up
the telephone, and manually dial the number or ask the operator to do
it. Once the number has been dialed, click Dial, wait for the modem
to take control of the line (the modem has gone silent at this
point), and hang up.

Bridge Connections

You can easily bridge two

or more
LAN or high-speed Internet connections. Suppose your server has two
NICs connected to different network segments. By bridging these
connections, computers on each segment can communicate with each
other. To bridge connections:

Network Connections Folder hold down Ctrl and select connections right-click Bridge

Configure Binding Order for Connections

If you have several connections

of one type (such as remote
access), you can rearrange the order in which they are accessed by
network services and which network services they can use. Do this as
follows:

Network Connections Folder Advanced Advanced Settings move connections or bindings up or down

Dial-up Connections

The following tasks are for

outbound
dial-up connections to private networks and the Internet.

Create a Dial-up Connection to the Internet

New Connection
Wizard Connect to the Internet Connect using a dial-up modem specify ISP name and phone number specify who can use the connection (only you or anybody) specify credentials enable/disable Internet Connection Firewall (ICF)

If you allow the connection to be used by anybody, you can select the
"Use this account name and password when anyone
connects to the Internet using this connection"
option to use the specified credentials for all users.

Create a Dial-up Connection to a Remote Access Server

New Connection
Wizard Connect to the network at my workplace Dial-up connection specify company name and phone number specify who can use the connection (only you or anybody)

An administrator on the remote network must grant remote access
permissions for your user account before you can dial up and connect.

Dial a Dial-up Connection

Once a connection has


been created, you can dial it by:

Network Connections Folder double-click on connection Dial

Note that the administrator on a remote private network must first
grant dial-in permission to a user before the user can connect to a
remote access server. See

Incoming Connections
later in this section for more information.

Disconnect a Dial-up Connection

To disconnect an established


connection, you can do one of two
things:

Double-click on connection Disconnect

Right-click on connection icon in system tray (if shown)
Disconnect

Configure a Dial-up Connection

When you use

the New Connection Wizard to
create an outbound dial-up connection, you specify only minimal
configuration information for the connection. If you need to further
configure the connection, open its properties sheet by:

Right-click on connection Properties

The configuration options are the same whether you are configuring a
dial-up connection to a private network or to the Internet. The
following are some of the more important settings on the five tabs of
this properties sheet. Note that some remote access terminology is
used in this discussionfor an explanation of PPP, BAP, PAP,
CHAP, and similar terms, see

Routing and Remote
Access later in this chapter. Now I'll
describe what each tabbed page of options does.

General

Click the Alternates button on the General tab if you want to assign
multiple phone numbers to a connection. You can then have the
connection try each number in order until it succeeds in establishing
a connection. You can also configure it so that successful numbers
are moved to the top of the list for future connection attempts.

Select the checkbox to make the connection icon visible in the system
tray, as this simplifies the process of monitoring and terminating
the connection. The connection icon blinks when data is being
transferred, and you can double-click on it to display the status of
the connection or right-click on it to terminate the connection.

If you have more than one modem installed, you have additional
options on this tab that let you do the following actions.

• Specify which modem or modems will be used for this connection.

• Specify the order in which they are used to establish a connection.
  (If the first modem fails, then the next one in the list is used.)

• Specify whether they will all call the same numbers.

Options

The Options tab is where you specify redial attempts and whether the
connection should automatically terminate after being idle for a
period of time. You can also specify that the connection should
automatically redial if it is droppedthis is useful for file
transfers using FTP since WS2003 can resume a file transfer without
needing to start all over.

If you have more than one modem installed and have enabled at least
two of them for this connection on the General tab, you have the
additional option of Multiple Devices on the Options tab. This new
option can be specified as:

Dial all devices (the default selection)

Use this to configure a PPP Multilink dial-up connection. (The remote
access server you are dialing must also support PPP Multilink.)

Dial only the first available device

Use this if you want to use multiple modems to provide fault
tolerance for your connection.

Dial devices only as needed

Use this to configure a BAP connection for dynamic multilinking. (The
remote access server you are dialing must also support BAP.) After
you make this selection, click Configure to specify the conditions
under which lines are added or dropped to your connection.

Multilink dial-up connections usually don't work if callback is configured on the remote access server. This is because only one callback number can be stored on the server to call the client back, with the result that only the first line in a multilink connection is used. The exception is 2B+D ISDN connections in which both ISDN B channels can have the same number for callback.

Security

The Typical option on the Security tab gives you a series of
preconfigured settings for authentication protocols and data
encryption schemes. In any case, the remote access client and server
will negotiate the highest degree of security for authentication and
data integrity that they are both configured to support. The three
settings here are (in order of increasing security):

Allow unsecured password (the default setting)

Allows any authentication protocol including PAP but
doesn't encrypt data

Require secured password

Doesn't allow PAP but can encrypt data

Use smart card

Allows only smart-card authentication and can encrypt data

If you want more granular control over which authentication protocols
and data encryption schemes the dial-up client supports, select
Advanced (custom settings) Settings. For more information
on these various schemes and protocols, see

Routing and
Remote Access later in this chapter.

Since the default setting allows unsecured passwords to be transmitted over the connection, you may want to change this to provide greater security, especially when connecting to the Internet.

Also on this tab are options for opening an interactive
terminal window and running a script during the connection
establishment process. These options are usually needed only for
legacy SLIP connections.

Networking

On the Networking tab you can specify that the ISP's
modem bank or company's remote access server you are
dialing into is either PPP or SLIP (it's almost
always PPP nowadays). If it is PPP, click Settings to configure
advanced PPP features, such as software compression, if they are
supported by the server you are calling.

Usually, a dial-up connection to the Internet dynamically obtains a
client IP address using DHCP, and this is configured by default for
Internet Protocol (TCP/IP). If you need to specify a static IP
address for your machine for this connection, you can do so here.
Table 4-4 shows which networking components are
enabled for Internet versus remote access dial-up connections.

Advanced

Formerly labeled "Sharing" in W2K
Server, the Advanced tab is used to set up Internet Connection
Firewall and configuring Internet Connection Sharing:

Internet Connection Firewall (ICF)

Integrated into WS2003 connections is an enhanced firewall feature
that you can use to block dangerous traffic from your server. This
firewall has been significantly improved over that in W2K Server. To
configure ICF:

Advanced tab select Internet Connection Firewall
Settings

Services

This tab essentially lets you configure which inbound ports to open
on your connection to allow Internet users to access services on your
network. For example, if you select Web Server (HTTP), it opens port
80 for inbound traffic. By default, all inbound network traffic is
blocked.

Secure Logging

This tab lets you log inbound packets that are either passed through
or blocked by your firewall (or both). If you use ICF, you should
review your firewall logs regularly.

ICMP

This tab lets you control which kinds of inbound ICMP packets are
allowed through your firewall. ICMP packets are often used to probe
networks, and a flood of them may be used in a denial-of-service
(DoS) attack to prevent legitimate users from accessing services on
your network. By default, all inbound ICMP traffic is blocked.

Internet Connection Sharing (ICS)

ICS lets your computer act as a gateway to the Internet so that other
computers on your network can access the remote private network or
the Internet by dialing up the connection to this server. Using the
second checkbox, you can also specify that the connection be dialed
automatically when another computer on your network tries to use it,
a feature sometimes called on-demand dialing.

ICS is a great feature for the small office/home office (SOHO) environment, but it can cause problems in the enterprise. This is because when you enable this feature, WS2003 automatically reconfigures the TCP/IP settings on the computer to use Automatic Private IP Addressing (APIPA) to assign IP addresses based on a special reserved network ID of 192.168.0.0. As a result, you should not enable ICS on servers in networks that use DNS or DHCP or that have static IP addresses assigned to machines using a different network ID; otherwise, other computers on your network will be unable to communicate with your server. If you want to use ICS for your SOHO, first configure WS2003 computers on your LAN to obtain an IP address automatically using APIPA and then install and configure ICS. See TCP/IP later in this chapter for more information on how to use APIPA.

Direct Computer Connections

Direct computer connections
are used mainly for file transfers
between two computers over a null-modem (file-transfer) cable when no
networking adapters are installed. However, you can share a direct
computer connection, which gives you a way of connecting two networks
together using a null-modem cable.

Create a Direct Computer Connection

To create a direct computer

connection,
you first need to configure either a COM port to use a serial RS-232C
null-modem cable or a parallel port to use an ECP parallel
file-transfer cable:

Control Panel Phone and Modem Options Modems Add select Don't detect my modem select either cable option select Port

Then decide which role your machine will assume:

Host machine

The computer that listens for and responds to direct computer
connection attempts from a Guest machine:

New Connection Wizard Set up an advanced connection
Connect directly to another computer select
Host choose port (LPT or COM) select users
allowed to connect

Guest machine

The computer that attempts to initiate a direct computer connection
with a Host machine:

New Connection Wizard Set up an advanced connection
Connect directly to another computer select
Guest choose port (LPT or COM) specify who can
use the connection (only you or anybody)

Note that when you create a Host connection, the RRAS service starts
and the connection is displayed in the

Network
Connections folder as an Incoming Connection. However,
when you create a Guest connection, it's displayed
as a Direct Connection.

Establish a Direct Computer Connection

Make sure the null-modem

cable
is attached, then go to the Guest computer and do this:

Network Connections Folder double-click on connection Connect

Configure a Direct Computer Connection

Configuring Guest machines


is similar to configuring dial-up
connections, and the same five tabs are present on the properties
sheet. There are a few differences, though:

• The General tab lets you choose only which device (COM or LPT port)
  is used for the connection.

• Advanced security settings are used instead of Typical ones used by
  dial-up connections, and these should generally not be changed.

• All default networking services are enabled for this connection.

The properties sheet for Host machines has only three tabs:

General

Here, you can configure the Host to listen for Guests on multiple
portsfor example, COM and LPT. You can even use multilink to
combine multiple connections from a single Guest machine, though
you'd have to create multiple Guest connections on
the Guest machine to do this.

Users

Here, you specify which users are allowed to establish direct
computer connections with the Host machine. The information displayed
depends on whether your machine belongs to a workgroup or domain.

Networking

Like Guest machines, all default networking services are enabled for
this connection.

Incoming Connections

We'll focus here on creating

incoming connections on a standalone
server in a workgroup scenario. In a domain environment,
you're more likely to use the Routing and Remote
Access Service (RRAS) to create a full-fledged remote access server
for your remote clients.

Create an Incoming Connection

New Connection Wizard Set up
an advanced connection Accept incoming connections select devices to listen on enable/disable VPN select users allowed to connect Properties allow callback if desired configure networking components for this connection

Note that the devices you can select depend on
what's installed on your machine and may include COM
and LPT ports (for direct cable connections), modems, ISDN adapters,
and so on.

By enabling a VPN for your connection, you allow remote users to
connect to your computer over the Internetprovided, of course,
that your machine has a public IP address so packets can be routed to
it from the Internet. This option is disabled by default for security
reasons. If you enable it, Windows automatically configures ICF, but
you should check the firewall configuration to make sure
it's configured the way you want it.

The main networking component to configure for the connection is
TCP/IP. By opening the properties of this component you can:

• Have clients use their own IP addresses or assign them using DHCP
  (the default) or from a pool of addresses

• Allow (the default) or deny clients access to other computers on your
  network

Allow/Deny Dial-in Permission to a User

When creating an incoming


connection using the procedure
described earlier, you specified the user accounts allowed to
connect. By doing so, the remote access permissions for these
accounts were set to Allow Access on the Dial-in tab of the
properties sheet for each account. If you later want to allow
additional users to use the incoming connection or decide to deny
access to a user you previously granted it to, do the following:

Computer Management System Tools Local Users and Groups Users right-click on user account Properties Dial-in allow or deny access

You can also change the callback option for the user here.

Configure an Incoming Connection

Right-click on connection Properties

These settings discussed previously under

Direct Computer
Connection in reference to Host machines.

Internet (Broadband) Connections

In addition to dial-up Internet connections (discussed under

Dial-up Connections earlier in this section),
you can create two types of broadband Internet connections: always-on
(LAN) or on-demand (PPPoE) connections.

Create an Always-on Broadband Internet Connection

First, make sure your DSL router is

configured properly, is turned on, and
your network cables are attached. Then do this:

New Connection Wizard Connect to the Internet Connect using a broadband connection that is always on

That was easy!

Create an On-Demand Broadband Internet Connection

New Connection Wizard Connect

to the Internet Connect using a broadband connection that requires a username and password specify ISP name specify who can use the connection (only you or anybody) specify credentials enable/disable ICF

Configure an On-Demand Broadband Internet Connection

The configuration options here are identical to those for dial-up
Internet connections, except all references to modems and phone
numbers are removed.

Local Area Connections

Local area connections (typically, Ethernet connections)
can't be created manually using the New Connection
Wizard. Instead, they're created automatically
during Setup or when Windows detects a new network adapter. By
selecting them in the

Network Connections
folder, they can be configured, disabled, enabled, and monitored like
other connections, but they can't be deleted unless
you remove the network card associated with the connection.

Configure Local Area Connections

To configure networking


components and protocols for local
area connections, do this:

Control Panel Network Connections select a local area connection Properties General

For information about configuring TCP/IP settings for local area
connections, see

TCP/IP later in this chapter.
To configure firewall settings on your connection, do this:

Control Panel Network Connections select a local area connection Properties Advanced Protect my computer Settings

For wireless LAN (WLAN) connections, you can also configure
authentication by:

Control Panel Network Connections select a local area connection Properties Authentication

Virtual Private Network Connection

These are outbound connections that securely tunnel over the Internet
to a remote VPN server, such as a WS2003 machine with RRAS
configured.

Create a New VPN Connection

First, make sure you have

an
Internet connection configured on your machine, either dial-up,
on-demand broadband, or always-on, as described previously. Also,
make sure the VPN server on the remote network is ready and listening
so you can test your connection after you create it. Now proceed as
follows if you have a dedicated Internet connection:

New Connection Wizard Connect to the network at my workplace Virtual Private Network connection specify company name specify IP address or DNS name of remote VPN server specify who can use the connection (only you or anybody)

If you have a dial-up or on-demand Internet connection, do this
instead:

New Connection Wizard Connect to the network at my workplace Virtual Private Network connection specify company name select a dial-up connection specify IP address or DNS name of remote VPN server specify who can use the connection (only you or anybody)

Instead of selecting a dial-up connection to automatically dial when
you try to establish your VPN connection, you can choose

not to automatically dial a connection. In this
case, you have to manually establish your Internet connection before
you open your VPN connection.

Configure a VPN Connection

The settings for configuring a VPN


connection are the same as those
for a dial-up connection to a private network (discussed previously),
except for the following differences:

General

Instead of modem settings, you specify the IP address of the remote
VPN server on this tab. If you have multiple dial-up or on-demand
Internet connections available, you can also specify which one to try
first when establishing your VPN connection.

Security

While the default security setting for dial-up connections to private
networks is Allow Unsecured Password, the default setting for VPN
connections is Require Secured Password with Require Data Encryption
also enabled. These settings are necessary because the VPN connection
travels over the Internet, which as everyone knows, is a dangerous
place (just like the Wild West was in its heyday).

If you enable the option Automatically Use My Windows Name and
Password, the credentials of the user currently logged on to your
machine are sent to the remote VPN server for authentication.

Networking

File and Print Sharing is enabled for VPN connections (it
wasn't for dial-up connections).

Monitor a VPN Connection

Network Connections Folder Right-click on an active VPN connection Status

The General tab shows bytes sent

and
received since the connection was initiated, as well as other network
traffic information. The Details tab shows useful information about
the type of server, IP address of server and client, type of
authentication protocol used, and so on. Here's an
example of what you might see on the Details tab if you were
connected to another WS2003 machine configured as a VPN server:

Server type: PPP
Transports: TCP/IP
Authentication: MS CHAP V2
Encryption: MPPE 56
Compression: MPPC
PPP multilink framing: On
Server IP address: 172.16.11.128
Client IP address: 172.16.11.130