Microsoft Baseline Security Analyzer

Transcription

1 The (MBSA) checks computers running Microsoft Windows Server 2008 R2 for common security misconfigurations. The following are the scanning options selected for Cisco Unified ICM Real-Time Distributor running one or more web applications (for example, Internet Script Editor or Agent-Reskilling). Windows operating system (OS) checks IIS checks SQL checks Security update checks Password checks The report in this chapter shows example results of running the MBSA tool against a Cisco Unified ICM server that runs most Microsoft Server Applications that the tool supports. Security Update Scan s, page 1 Windows Scan s, page 2 Internet Information Services (IIS) Scan s, page 4 SQL Server Scan s, page 5 Desktop Application Scan s, page 6 Security Update Scan s The following table provides an example of security update scan results: Table 1: Security Update Scan s Windows Security Updates 1

2 Windows Scan s IIS Security Updates SQL Server/MSDE Security Updates MDAC Security Updates MSXML Security Updates Office Security Updates Instance (default): No critical security updates are No Microsoft Office products are installed. Windows Scan s The following table shows Windows scan results: Table 2: Vulnerabilities Automatic Updates Administrators Automatic Updates are managed through Group Policy on this computer. More than 2 Administrators were found on this computer. Note You can ignore this event because the Cisco Unified ICM application requires the addition of certain groups to the Local Administrators group, which triggers this event. Review the Details and remove any known unnecessary accounts. 2

3 Windows Scan s Password Expiration Windows Firewall Local Account Password Test File System Autologon Guest Account Restrict Anonymous Some user accounts (1 of 7) have nonexpiring passwords. Note When the server is properly configured to require expiring passwords, this warning typically finds the Guest account to have a nonexpiring password even though the account is disabled. This warning can be ignored. Windows Firewall is enabled and has exceptions configured. Windows Firewall is enabled on all network connections. Some user accounts (1 of 7) have blank or simple passwords, or could not be analyzed. All hard drives (1) are using the NTFS file system. Autologon is not configured on this computer. The Guest account is disabled on this computer. Computer is properly restricting anonymous access. The following table provides more scan information: Table 3: More System Information Auditing Services Shares Logon Success and Logon Failure auditing are both enabled. Some potentially unnecessary services are installed. 2 shares are present on your computer. 3

4 Internet Information Services (IIS) Scan s Windows Version Computer is running Windows Server 2008 R2 or greater. Internet Information Services (IIS) Scan s The following table shows IIS scan results: Table 4: Vulnerabilities IIS Lockdown Tool Sample Applications IISAdmin Virtual Directory Parent Paths The IIS Lockdown tool was developed for IIS 4.0, 5.0, and 5.1, and is not needed for new Windows Server 2008 R2 installations running higher versions of IIS. IIS sample applications are not installed. IISADMPWD virtual directory is not present. Parent paths are not enabled. MSADC and Scripts Virtual Directories The MSADC and Scripts virtual directories are not present. Table 5: Other System Information Domain Controller Test IIS Logging Enabled IIS is not running on a domain controller. All web and FTP sites are using the default logging options. 4

5 SQL Server Scan s SQL Server Scan s The following table shows SQL Server scan results: Instance (default) Table 6: Vulnerabilities Sysadmin role members Sysadmins Service Accounts Exposed SQL Server/MSDE Password Domain Controller Test SQL Server/MSDE Security Mode Registry Permissions CmdExec role Folder Permissions BUILTIN\Administrators group is part of sysadmin role. Note This is acceptable because the Cisco Unified ICM application adds certain groups to the local Administrators account on the server which require dbo access to the database. No more than 2 members of sysadmin role are present. SQL Server, SQL Server Agent, MSDE and/or MSDE Agent service accounts are not members of the local Administrators group and do not run as LocalSystem. The sa password and SQL service account password are not exposed in text files. SQL Server and/or MSDE is not running on a domain controller. SQL Server and/or MSDE authentication mode is set to Windows Only. The Everyone group does not have more than Read access to the SQL Server and/or MSDE registry keys. CmdExec is restricted to sysadmin only. Permissions on the SQL Server and/or MSDE installation folders are set properly. 5

6 Desktop Application Scan s Guest Account SQL Server/MSDE Account Password Test The Guest account is not enabled in any of the databases. The check was skipped because SQL Server and/or MSDE is operating in Windows Only authentication mode. Desktop Application Scan s The following table shows desktop application scan results: Table 7: Vulnerabilities IE Zones IE Enhanced Security Configuration for Administrators IE Enhanced Security Configuration for Non-Administrators Macro Security Internet Explorer zones have secure settings for all users. The use of Internet Explorer is restricted for administrators on this server. The use of Internet Explorer is restricted for nonadministrators on this server. No Microsoft Office products are installed. 6