Security Guidance ArcGIS Server 9.3 Windows Security Requirements

Transcription

1 Envirnmental Systems Research Institute, Inc., 380 New Yrk St., Redlands, CA USA TEL FAX Security Guidance ArcGIS Server 9.3 Windws Security Requirements Versin 1.0 Prepared by: ESRI Prfessinal Services Enterprise Implementatin Services Team Redlands, Califrnia June 30, 2009

2 Security Guidance: ArcGIS Server 9.3 Windws Security Requirements 1 OVERVIEW INSTALLATION GUIDANCE USERS AND GROUPS DCOM SETTINGS LOCAL POLICIES FILE PERMISSIONS POSTINSTALLATION WRAP-UP APPENDIXES WINDOWS LAN MANAGER (LM) REGISTRY SETTINGS DISA GOLD RECOMMENDATIONS

3 Security Guidance: ArcGIS Server 9.3 Windws Security Requirements 1 Overview This dcument prvides a list f security settings required fr ArcGIS Server implementatins. Mst custmers will nt need t refer t this dcument, as the default installatin steps help manage these settings autmatically. This dcument is primarily fr custmers wh need t manually set security settings in hardened envirnments. Currently, this guide is primarily fr ArcGIS Server 9.2 and 9.3 installatins n Windws Server There are fur primary areas f the system that require specific security settings fr a successful deplyment f ArcGIS Server: Users and grups DCOM settings Lcal plicies File permissins 2 Installatin Guidance The steps belw are typically perfrmed after ArcGIS Server dependent sftware requirements are in place and the initial ArcGIS Server installatin is dne, but befre the ArcGIS Server pstinstallatin is run. 2.1 Users and Grups Set up Active Directry Accunts Nte that Dmain User Accunts fr Services are utilized in this dcumentatin. Create new Dmain Users: ArcGISSOM ArcGISSOC ArcWebServices ArcGISManager Fr each user, ensure the fllwing: Passwrds meet cmplexity requirements. Enable "Passwrd Never Expires". Enable "User cannt change passwrd". Add Active Directry dmain accunts t Lcal Grups utilizing the Cmputer Management tl: Creating Lcal Grups agsadmin and agsusers 3

4 Security Guidance: ArcGIS Server 9.3 Windws Security Requirements ArcGIS Server Administratrs Adding these user Active Directry accunts as lcal Administratrs ArcGIS Server accunts Distributed COM Users grup, agsadmin grup Dmain\arcgismanager and Dmain\arcgiswebservices: Add t the Distributed COM Users grup, agsadmin, and agsusers grup Dmain\ArcGISSOM: Add t Distributed COM Users grup Dmain\ArcGISSOC: Add t Distributed COM Users grup 2.2 DCOM Settings Verify/Mdify DCOM settings as necessary: Run: dcmcnfg Cnsle Rt\Cmpnent Services\Cmputers\My Cmputer\ Right click My Cmputer > Prperties > COM Security Tab Verify Access Permissins: Edit Limits Annymus Lgn Allw lcal access and remte access. Distributed COM Users Allw lcal access and remte access. Everyne Allw lcal access and remte access. Edit Default Self Allw lcal access and remte access. System Allw lcal access and remte access. Verify Launch and Activatin Permissins: Edit Limits Administratrs Allw lcal/remte launch and lcal/remte activatin. agsadmin Allw lcal/remte launch and lcal/remte activatin. agsusers Allw lcal/remte launch and lcal/remte activatin. ArcGISSOC Allw lcal/remte launch and lcal/remte activatin. ArcGISSOM Allw lcal/remte launch and lcal/remte activatin. Distributed COM Users Allw lcal/remte launch and lcal/remte activatin. Everyne Allw lcal launch and lcal activatin. 4

5 Security Guidance: ArcGIS Server 9.3 Windws Security Requirements 2.3 Lcal Plicies Edit Default Verify/Mdify Lcal Security Permissins: Administratrs Allw lcal/remte launch and lcal/remte activatin. Interactive Allw lcal/remte launch and lcal/remte activatin. Netwrk Service Allw lcal/remte launch and lcal/remte activatin. System Allw lcal/remte launch and lcal/remte activatin. Start\Administrative Tls\Lcal Security Plicy Settings (Use the lcal and nt the grup plicy.) Security Settings\Lcal Plicies\ User Rights Assignment\ Access this cmputer frm the Netwrk: Administratrs, ASPNET, IUSR_<SERVERNAME>, IWAM_<SERVERNAME>, Users Allw lg n lcally: IUSR_<SERVERNAME>, Administratrs, Users Sanity check the "Deny" settings Lg n as batch jb: Dmain\ArcGISSOC, Dmain\ArcGISSOM, Dmain\ArcGISWebServices, Dmain\ArcGISManager Lg n as a service: ASPNET, Netwrk Service, Dmain\ArcGISSOM Security Optins\ Netwrk Security: Send LM and NTLM Use NTLMv2 sessin security if negtiated. Netwrk Security: Minimum Sessin Security fr NTLM SSP based clients Yu can enable "Require NTLMv2 sessin security" if necessary Yu can enable "Require 128-bit encryptin" if necessary Netwrk Security: Minimum Sessin Security fr NTLM SSP-based servers D nt enable "Require NTLMv2 sessin security". Yu can enable "Require 128-bit encryptin" if necessary. 2.4 File Permissins Check t make sure the SOM and SOC accunt have read/write access ver all required directries: c:\prgram files\arcgis\server c:\arcgisserver 5

6 Security Guidance: ArcGIS Server 9.3 Windws Security Requirements 3 Pstinstallatin Wrap-up Rebt the machine. Rerun the pstinstallatin prcess. When referencing the dmain accunts, make sure yu enter them as "Dmain\Accunt" in the pstinstallatin. Rebt the machine again, and yur installatin is cmplete. 4 Appendixes 4.1 Windws LAN Manager (LM) Registry Settings ArcCatalg and native Windws applicatins autmatically use the client machine s LM Authenticatin/Cmpatibility Level (stred in the Windws registry). The Java Manager uses the prperty ARCGIS_LM_COMPATIBILITY_LEVEL defined in the manager_cnfig.prperties file t crrespnd t this Windws registry value: Value Text Representatin Meaning 0 Send LM and NTLM respnses. Clients use LM and NTLM authenticatin and never use NTLMv2 sessin security; dmain cntrllers accept LM, NTLM, and NTLMv2 authenticatin. 1 Send LM and NTLM Use NTLMv2 sessin security if negtiated. Clients use LM and NTLM authenticatin and use NTLMv2 sessin security if the server supprts it; dmain cntrllers accept LM, NTLM, and NTLMv2 authenticatin. 2 Send NTLM respnse nly. Clients use NTLM authenticatin nly and use NTLMv2 sessin security if the server supprts it; dmain cntrllers accept LM, NTLM, and NTLMv2 authenticatin. 3 Send NTLMv2 respnse nly. Clients use NTLMv2 authenticatin nly and use NTLMv2 sessin security if the server supprts it; dmain cntrllers accept LM, NTLM, and NTLMv2 authenticatin. 4 Send NTLMv2 respnse nly\refuse LM. 5 Send NTLMv2 respnse nly\refuse LM and NTLM. Clients use NTLMv2 authenticatin nly and use NTLMv2 sessin security if the server supprts it; dmain cntrllers refuse LM (accepting nly NTLM and NTLMv2 authenticatin). Clients use NTLMv2 authenticatin nly and use NTLMv2 sessin security if the server supprts it; dmain cntrllers refuse LM and NTLM (accepting nly NTLMv2 authenticatin). 6

7 Security Guidance: ArcGIS Server 9.3 Windws Security Requirements ArcCatalg and ArcGIS Server Authenticatin Scenari ArcCatalg/Java Manager running n cmputer A (client) ArcGIS Server running n cmputer B (server) If the server LMAL is 0, 1, 2, 3, r 4, the client LMAL can be 0, 1, 2, 3, 4, r 5. The type f authenticatin used will depend n the client LMAL. If the client LMAL is 3, 4, r 5, then NTLMv2 authenticatin is always used, regardless f the server LMAL. If the LMAL f the server is 5 (highest level f security), nly NTLMv2 authenticatin is allwed. The client LMAL has t be at either 3, 4, r 5 t be able t cnnect successfully. 4.2 DISA Gld Recmmendatins (1) Install OS using a standard MS build. (2) Install and cnfigure ArcGIS Server. (3) Harden the system with a Gld Disk scan, nt using aut-remediatin. 7