#110035 - 2003-12-11 01:50 AM
Re: IIS installed
|
Kdyer
KiX Supporter
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
Services you will be looking for are:
IISADMIN
W3SVC
MSFTPSVC
SMTPSVC
If memory serves, the last three require IISADMIN to be running..
Take for example a batch script I use to maintain a web server (yes, I know it is not KiXtart).
Code:
::net stop openwebscope
net stop msftpsvc
net stop w3svc
::net stop smtpsvc
net stop iisadmin /y
cd %temp%
del *.* /s/q
for /f "Tokens=*" %%i in ('Dir /B %temp%') do rd /s /q "%%i"
cd %windir%
del *.tmp /s/q
net start iisadmin
net start w3svc
net start msftpsvc
::net start smtpsvc
::net start openwebscope
pause
HTH,
Kent
|
|
Top
|
|
|
|
|
#110037 - 2003-12-11 02:41 PM
Re: IIS installed
|
Kdyer
KiX Supporter
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
Well.. This should pretty simple then.. From your Firewall, you should be able to block port 443 or 80 (81 for ePolicy Orchestrator) and only allow from specific machines..
Have you seen this app? I saw this over at http://pricelessware.org
It is very cool when trying to diagnose packets across the Internet..
http://www.ethereal.com/
Otherwise, you may have to get into your hub/switch and watch packets.. So let's see if we can wrap this up in a nutshell.. You want to only allow one or two systems to be webservers and log any others and then turn off the ones you don't want. This is probably being driven by a security audit.
Why not log the services started from each machine? Then the rest becomes pretty simple..
Kent
|
|
Top
|
|
|
|
#110038 - 2003-12-11 03:02 PM
Re: IIS installed
|
New Mexico Mark
Hey THIS is FUN
Registered: 2002-01-03
Posts: 223
Loc: Columbia, SC
|
LOL... easier said than done to open up our DMZ's at all, even to specific systems. Of course, the good news is that we weren't really worried during all the recent outbreaks of viruses and worms. Our critical systems are pretty well sealed off, even from loyal administrators' workstations.
Actually, some of this is being drivin by the need to quickly identify the current configuration of all our servers to help evaluate how/when we want to deploy patches or other security fixes. For instance, MS03-001 is critical for domain controllers, but minor for other servers UNLESS they are running the locator service for whatever reason. It would have been great to do a quick query and be able to identify all servers running the locator service. Even if it was only domain controllers (as it should be), upper managment really likes to get positive confirmation.
We are also starting into a major upgrade project to W2K3. "At a glance" reports showing which servers are good candidates now and which need hardware upgrades or replacement make projects like this much easier.
Of course, unlike workstations, we can't rely on logon scripts (over half of our servers are not domain members anyway -- the DMZ and multiple independent business units thing again)
If I ever get my code cleaned up enough to where I wouldn't be embarrassed (much of the development was done under extremely tight timelines), I'll post the scripts. The process isn't perfect, but it is leaps and bounds ahead of the manual ways we collected and managed server information before.
Thanks,
NMM
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
0 registered
and 874 anonymous users online.
|
|
|
But I think when you call and say: "Hi, this is New Mexico Mark. I'm calling about R2D2's salary" he will call some kind of psychiatric thing for you. 
