Hack-Proofing Your Servers

Many reports of new tools for breaking into IIS servers have surfaced. How can I secure my IIS servers against intruders who use sophisticated tools to break into servers?

Your question doesn't have a one-size-fits-all answer. You can be certain that if you have an IIS server on the Internet, that server is being scanned, probed, and fingerprinted several times a day. Many best practices aren't optional anymore. The Internet isn't a safe place, and you have to prepare your servers as if they were under siege.

In addition to firewall technology, I insist on intrusion-detection systems. Intrusion-detection software looks for specific types of traffic, such as a Cult of the Dead Cow's Back Orifice or Symantec's pcAnywhere ping, a port scan, or an attempt to use a remote procedure call (RPC) to connect to the server. I have one Web server that gets about 10 to 20 probes daily; some of those probes come from users with clearly malicious intent who are looking for a Trojan horse host.

Cracker tools are like viruses in that they constantly mutate and become more resistant to known cures, or fixes. Thus, your intrusion-detection software needs to keep up with the mutating, more complex cracker tools. Your intrusion-detection software also needs to keep up with new cracker tools, such as Sir Dystic's new tool called SMBRelay. Server Message Block (SMB) is a high-level protocol used in Microsoft networks to communicate among computers, usually to transfer files or information about the file system. This tool captures password hashes between the client and the server, then (to oversimplify) uses port 139 on the server to intercept the authenticated connection. Here's the strategy for protecting yourself against an SMB attack, according to the SANS Windows Security Digest Vol. 4, No. 4 (reprinted here with permission):

Most of these recommendations are a good idea on any IIS server that's on a public network. See "IIS Security Resources" for some great resources about how to secure an IIS server.