Server Security

Nov 22 2008   12:56PM GMT

How to configure DHCP Snooping in a Cisco Catalyst Switches.

Posted by: Yasir Irfan
Networking, DHCP, Switches, Cisco, Switching, Routing and Switching, CCNP, Cisco IOS, Cisco 2960, Cisco 2950, HSRP, Cisco 6500, Cisco Tips, Cisco 3560, Cisco Learning, Server Security, Cisco 3750-E, Cisco 3560-E, IOS commands, Cisco Systems, Cisco 6500 Series Catalyst Switch, Cisco 6503, Cisco Catalyst 6503-E Switch, Cisco Catalyst 6506-E Switch, Cisco Catalyst 6509-V-E Switch, Cisco Catalyst 6509-E Switch, Cisco Catalyst 6513 Switch, DHCP Snooping, Configuring DHCP Snooping, 802.1 Q, Trunk Ports

 So here we go, with the configuration of DHCP snooping on a Cisco Switch. This feature protects the network by allowing the Cisco Switches to accept DHCP response message only from the authorized servers connected to the trusted interfaces in a Cisco Switch.

All Switch to  Switch connections are configured as 802.1 1Q Trunk ports.

IP Address and HSRP Details for the Core Switches  From the above scenario we have two Cisco 6513 Series Switches as a Core/ Distribution with three VLANS one for management of Switches VLAN 50,VLAN 100 for all the servers and VLAN 101 for clients. Two Cisco 3560 Series Switches as Server Farm Switches and a Cisco 3560 Series Switch as an Access Switch.There are two DHCP servers with an IP address 10.0.1.100 and 10.0.1.101 connected with Server Farm Switches with HP NIC teaming. We configure DHCP Snooping based on above scenario. 

The first step to configure DHCP Snooping is to turn on DHCP snooping in all Cisco Switches using the “ip dhcp snooping” command. 

All Cisco Switches (config)#ip dhcp snooping  Second step is to configure the trusted interfaces, from the above scenario all trunk ports are configured as trusted ports as well as the interfaces G0/7,(ITKESF01 50.0.0.6),  G0/17,(ITKESF02 50.0.0.7),  G0/9 ITKESF01 50.0.0.6)  and G0/18 ITKESF02 50.0.0.7)  connected to DHCP servers with IP 10.0.1.100 and 10.0.1.101. Lets configure all trunk ports in ITKEBB01 

ITKEBB01(config)#interface range  gigabitEthernet 3/21 - 23

ITKEBB01 (config-if)#ip dhcp snooping trust 

Now let’s configure all trunk ports in ITKEBB02 

ITKEBB02(config)#interface range  gigabitEthernet 3/21 - 23 ITKEBB02 (config-if)#ip dhcp snooping trust 

ITKEBB02 (config)#interface gigabitEthernet 3/16

ITKEBB02 (config-if)#ip dhcp snooping trust 

Now let’s configure the trusted ports for the DHCP servers  

ITKESF01(config)#interface gigabitEthernet 0/7

ITKESF01 (config-if)#ip dhcp snooping trust 

ITKESF01(config)#interface gigabitEthernet 0/17 ITKESF01 (config-if)#ip dhcp snooping trust 

ITKESF02(config)#interface gigabitEthernet 0/9

ITKESF02 (config-if)#ip dhcp snooping trust 

ITKESF02(config)#interface gigabitEthernet 0/18 ITKESF02 (config-if)#ip dhcp snooping trust 

Now let’s configure the trunk ports  Access Switch ITKEAS01 

ITKEAS01(config)#interface range  gigabitEthernet 0/49 - 52

ITKEAS01 (config-if)#ip dhcp snooping trust 

Finally we are going to configure VLANS for DHCP snooping DHCP snooping will used on all the VLANs (VLAN 100 & 101)except management VLAN 50 . Also we will limit the requests rate received in the Access Switch (ITKEAS01)  ALL SWITCHES(config)# ip dhcp snooping VLAN 100,101 

ITKEAS01(config)#interface range  gigabitEthernet 0/1 - 48

ITKEAS01 (config-if)#ip dhcp snooping limit rate 20

Displaying the DHCP snooping  

For further reference please do check this article from Cisco about DHCP snooping.

Jul 8 2008   8:20AM GMT

Sample I.T. Security Policy - Remote Access Security

Posted by: Yasir Irfan
Networking, Network Security, Security, Servers, Microsoft Windows, Cisco, Policies, Network Documentation Policy, Network Policies, Server Security, Remote Access Secuirty

Finally we are almost proceeding towards the completion of the Sample I.T Security policy, we have just two more topics to cover. Coming days I will try to complete that, here we are with Remote Access Security

 

REMOTE ACCESS SECURITY 

“IS” CONSIDERED THE FOLLOWING:

1. RAS server provides the most secure method for remote access to the network if it is reburied.

2. Never allow client computers on the network to answer remote access connections.

3. Organize all remote access servers in a centrally controlled location.

4. Servers have no need to originate dial-out connections (Except when using telephone lines as low cost WAN connections, but these connections should be relatively permanent).

5. To simplify security administration, allow only one method of remote access into the network.

6. Remote access control procedures must provide adequate safeguards through robust identification, authentication and encryption techniques.

7. Carefully consider the wisdom of providing cellular telephones and modems for use with laptop computers. This technology isn’t usually justified considering the relatively modest increase in productivity compared to the cost and the security risk of a lost laptop.

8. Consider using only the NetBEUI protocol for remote access to limit the extent of intrusions on the network.

9. Control the distribution of remote access software on the network. Never allow client computers to run remote control software. If remote control software is necessary, run the software from centrally controlled computers or thin-client servers.

10. Disable dial-in networking, except in the cases of trusted individuals or to special computers,because dial-in networking can bypass regular network security.

11. Encourage an easy-to-use (but secure, of course) method for users to indicate when they need remote access, for how long, and to which phone number. Base the dial-in permissions on these requests. Always verify the request verbally with the user to ensure that it’s not a spoof.

12. Gather contact information for the telephone companies as soon as possible so that it is on hand if dial -up hacking attempts are discovered.

13. If possible, use external modems to answer RAS connections. They can be powered off when no RAS activity is anticipated, and they allow manual disconnection if necessary.

14. If remote access is required only occasionally, set the Remote Access Server service to start manually, then use the services control panel to start the service when needed and stop it when it is no longer in use.

15. Revoke dial-in permissions for users during periods when they are not necessary, and invoke them when the user is away from the office or working from home for a period.

16. Thin client and remote control software can be more secure than remote access software in certain circumstances. For instance, an entire database could be copied down using remote access software, but that same data would be extremely difficult to extract using remote control software configured to disallow file transfers.

17. Tightly control user-based remote access permissions. Allow only those users who have an immediate need to log in remotely.

18. Use alarming software to detect numerous attempts at password guessing over dial-up networks. Use the standard performance monitor to detect this activity, or purchase third party alarming software.

19. Use callback security. Without callback security, tracing RAS based intrusion attempts is very difficult.

20. Use external modems that have on/off switches for those machines that have remote access software installed. Only turn on a modem when a user calls in and requests a remote control connection.

21. Use hard-coded callback security for all remote users that don’t normally travel, to prevent their account from being exploited from unknown locations.

22. Use Microsoft encryption when possible.

23. Use the Point-to-Point Tunneling Protocol for all Internet connections allowed into the network, or some third-party software that performs the encrypted tunnel function in concert with the firewall.

 

 

Jul 1 2008   7:25AM GMT

Sample I.T Securty Policy - Server Security

Posted by: Yasir Irfan
Networking, Servers, Microsoft Windows, Switches, Routers, Network Documentation Policy, Network Policies, Server Security

Now we are proceeding towards the Server Security Policy, which was quite tiresome to draft.

6‐SERVER SECURITY
“IS” CONSIDERED THE FOLLOWING:
1. Limit the number of protocols in use throughout the network to the extent possible.
2. Use connection-monitoring software like the performance monitor to alert the network administrator to potential intrusion attempts.
3. Antivirus software must be chosen from a proven leading supplier
4. Remove the keyboard and monitor from servers if possible. They can be reattached when administration is necessary. Certain mouse devices will not reset properly when reattached; they should be left attached.
5. Add trust relationships between domains only when several users need access.
6. Create groups based on natural associations in the Dept. Assign file permissions by groups. Make user accounts members of the groups that need access to certain files.
7. Don’t allow unrestricted file sharing. Use files sharing with user-based authentication or, at the very least, passwords.
8. Limit the rights of Guest and Anonymous accounts.
9. Never enable the Guest account.
10. Try to arrange data so that as few user accounts as possible are required for users to access it.
11. Do not make Internet Information Server user accounts members of the Users or Domain Users groups. A void making these accounts members of groups that would grant these users additional rights or access permissions.
12. Do not make script virtual directories readable, do not make other virtual directories executable.
13. Create a group for Internet users for lIS; apply permissions to that group account.
14. Do not allow users to place scripts in their own WWW service virtual directories.
15. Use the logging facilities of lIS to watch for a high proportion of unauthorized, forbidden, and not found access attempts.
16. Do not allow NetBIOS connections to be made over the Internet.
17. Replace the default Everyone, Full Control permission with a Domain Users, Change permission on all drives except the system and boot volumes.
18. On each Window 2003 server inside the network, establish filters to pass only those protocols that are explicitly served. This prevents software from working in unexpected ways.
19. To make administration easier and leave less possibility for error, use several shares on one workstation rather than scattering them among several workstations, if possible.
20. Use the No Access permission only then necessary to override other permitted access.
21. Grant permissions for a share to a specific group or set of users, rather than using the everyone group and attempting to restrict users at the subdirectory level.
22. Use NTFS volumes for file sharing whenever possible, and use file-level security rather than share-level security when possible.
23. Keep sensitive information out of the shopper table because that information is accessible to a web browser.
24. Use both a secure port (HTTPS) and Secure Socket Layer encryption, and use strong NTFS permissions restrictions on WWW service virtual directories.
25. Require all possible network connections to services outside the network security to go through a proxy server.
26. Configure the DNS server to exchange information with only computers within the network security and with the DNS server “up” the network tree from them.
27. Remove all instances of the Everyone, Full Control permission. Do not set a default permission to replace it so that all subdirectories from the root do not by default inherit permissions. Add permissions only where specifically required.
28. Access to operating systems is to be restricted to those persons who are authorized to perform systems administration/management functions. Even then such access must be operated under dual control requiring the specific approval of senior management.
29. Staff with access to the $ prompt or command line, could succeed in executing system command,which could damage and corrupt your system and data.
30. Operating System commands could be used to disable or circumvent access control and audit log facilities, etc System access must be monitored regularly to prevent attempts at unauthorized access and to confirm that access control standards are effective.
31. Apply intrusion detection sensor for each server you want to protect.
32. Make sure the audit or accounting functions are turned on.
33. Keep try to find the last patches found for both the Operating systems and applications installed on that servers .That will help for closed O.S and Application holes.
34. Have servers in a physically secure location to prevent unauthorized access.
35. On a regular basis, run programs (for example, Crack, Tiger, COPS and Satan) to check for system weaknesses.
36. Make timely system backups.
37. Keep one copy of backup tapes in a secure facility offsite.
38. Use a virus-checker program.
39. Modify registry in windows severs for maximum security issues according to Microsoft security check list.

Yasir
Personel Website:www.yasirirfan.com