Build a Bastion Host

This server will help keep even the best intruders at bay

Do you think that your Windows NT server is safe? Before you answer, if you're the administrator of an NT server that connects to the Internet, consider the following:

To provide the highest level of security for your NT network, you can build a bastion host. A bastion host is typically an Internet-connected server that has no devices (e.g., filtering routers) to protect against Internet attacks. Instead, the bastion host's defense is a stripped down, highly secure OS.

You can configure a bastion host for a variety of server roles on the Internet. For example, you can use the bastion host as an FTP, Microsoft IIS, SMTP, POP3, Network News Transfer Protocol (NNTP), or firewall server. First, let's look at three good practices to keep in mind as you're building a bastion host; then, we'll discuss how to configure an NT server as a bastion host.

Good Practices
When building a bastion host, you should follow three good practices. First, you should build it in stages so that you're applying the security measures in layers. That way, if problems occur later, you can peel back and check each layer until you find the root of the problem. Second, you should install only programs that are absolutely necessary to achieve the desired functionality. This practice is often referred to as the minimalist approach. Finally, you should document every action you perform on the bastion host. I keep a separate notebook for each bastion host for the entire life of that server. If more than one administrator manages a Web site, keep the notebook in a central location. That way, the notebook becomes a communications tool.

In the notebook, document events and measurements, including hardware and software installations, upgrades, and removals; services running; server reboots; and server statistics (e.g., memory, disk-space utilization). By keeping track of how the server usually behaves, you'll be better able to tell when it's behaving abnormally. Unusual behavior can be a symptom of defacement or another problem.

Keeping these three good practices in mind, let's build a bastion host. Building a host is a six-stage process:

Install NT and the Application
The first step to building a bastion host is to install NT 4.0 on the server. You're likely experienced in installing NT, so I won't detail that process here. When you install the OS, though, make sure that you

The next step is to install the latest service pack. When you install NT 4.0 from a CD-ROM, the CD-ROM typically includes Service Pack 1 (SP1). To avoid any hardware and software problems, I always install the latest service pack and update all my drivers with OEM drivers that I know are solid and stable.

Now you can install your application (e.g., IIS, firewall software). Install updates and hotfixes that the application might need. In following the minimalist approach, you probably won't need to install Microsoft Internet Explorer (IE). However, if you need to install IE, don't install the Shell Update Release (SUR) add-on component (aka Active Desktop). This component isn't necessary and consumes a lot of memory.

With the OS and the application installed, you can tweak your bastion host. Specifically, you need to remove unnecessary network services, disable unnecessary local services, and change the network configuration.

Remove Unnecessary Network Services
NT doesn't require any network services to be running. However, your application might require a particular network service. For example, FireWall-1 doesn't need any network services, but IIS requires the RPC Configuration service. Thus, you need to check your application's documentation. After determining whether your application needs any network services, open the Control Panel Network applet and select the Services tab, as Figure 1 shows. Remove the network services you don't need.

Running the server with only the application's necessary network services will cause your system to complain. For example, you'll receive the Network Configuration error message Windows NT Networking is not installed. Do you want to install it now? You can simply click No when you receive this error message. Running the server with only the application's necessary network services will also cause several problems. You'll find that the User Manager for Domains doesn't work. You can fix this problem by replacing the User Manager for Domains with NT Workstation's User Manager. You might also have problems installing software because some installation packages make special calls to the OS that require information from network services. If such a problem occurs, you can reinstall the network services, install the new software, then remove the network services. The last problem you'll run into is that you won't be able to configure certain parts of the OS through the GUI. I describe how to work around this problem in the "Change the Network Configuration" section.

Disable Unnecessary Local Services
Instead of listing the many services that you need to disable, let's just mention the few services you need to leave enabled: the Event Log, NT LM Security Support Provider, and Protected Storage services. You also need to leave enabled any local services that your application might need. For example, for IIS, you need to leave the remote procedure call (RPC) service enabled in addition to the three services just mentioned. After determining whether your application needs any local services, open the Control Panel Services applet and disable the unnecessary services.

If you open Task Manager when only the Event Log, NT LM Security Support Provider, Protected Storage, and RPC services are running, you'll see only these processes: csrss.exe, explorer.exe, loadwc.exe, lsass.exe, nddeagnt.exe, pstores.exe, rpcss.exe, services.exe, smss .exe, and winlogon .exe. Under this configuration, NT is a lean operation, consuming only about 18MB of memory.

Change the Network Configuration
You change the network configuration through the GUI and the registry. The changes you make through the GUI are fairly simple. Just follow these steps:

The network-configuration changes that you make through the registry are a bit trickier than the changes you make through the GUI. When you work with the registry, you need to be extremely careful. Incorrectly editing the registry can permanently corrupt your system. Here are the steps to change the necessary registry settings:

Run Setup.cmd
Now that you've installed NT and the application, removed the unnecessary network services, disabled unnecessary local services, and changed the network configuration, you're ready to use setup.cmd. Setup.cmd, which I wrote for use on NT 4.0 servers, performs the following tasks:

Before you run setup.cmd, you need to make several preparations. First, you need to download and install the Security Configuration Manager snap-in. You can download this snap-in from http://www.microsoft.com/ntserver/ nts/downloads/recommended/scm/default.asp. If you're unfamiliar with installing and using this tool, see the Microsoft article "Downloading and Using the Security Configuration Manager Tool" (http://support.microsoft.com/support/kb/articles/q245/2/16.asp).

Next, you need to download bastion-host.inf and setup.cmd from the Code Library on the Security Administrator Web site (http://www.secadministrator.com). Make sure that bastionhost.inf and setup.cmd are in the same location as the Security Configuration Manager snap-in's executable (secedit.exe) and DLLs (esent.dll and scedll.dll). All these files will easily fit on a disk if you prefer to execute them from a removable medium.

After you have all the files in place, you need to review and customize the bastionhost.inf and setup.cmd files. Bastionhost.inf contains configuration settings, such as settings for system access parameters, the RestrictAnonymous parameter, Security logs, and privilege rights. Review the settings to make sure they fit your needs, and make any necessary changes. At a minimum, you need to rename the Administrator account and guest account in the system access section, which Listing 1, page 15, shows. Callout A in Listing 1 highlights the lines you need to change.

In addition to reviewing bastionhost.inf, you need to review setup.cmd to make sure that the script isn't deleting any file or component that your application might need. For example, if you're running a 16-bit application, you need to keep the VDM on your bastion host. To keep the script from deleting specific files or components, you can simply add the Rem command at the beginning of each applicable line. For example, Listing 2, page 15, shows how you can stop the script from deleting the VDM. You must reapply setup.cmd every time you add a hotfix or install a service pack.

Test the Application
Now that you've built the bastion host, you need to test your application. If the application fails, you have two options: Peel back the security layers by troubleshooting each stage in reverse order or start over and test your application after each stage. After you have the application working, you need to test your application and update your configuration regularly.

A Smart Countermeasure
Building a bastion host is a crucial step in preparing a server for functioning on the Internet. Because NT is a favorite target of intruders, having an NT server with a highly secure OS is a smart countermeasure.