Windows Server のセキュリティ概要

Size: px

Start display at page:

Download "Windows Server のセキュリティ概要"

まいかますはら
5 years ago
Views:

1 Windows Server

2 ( ) (Confidentiality) (Integrity) (Permission) (Availability) (Authorization)

3 (Defense-in in-depth) VPN IPSec LAN OS ACL

7 CD CD CD / CD/DVD Microsoft Update ( ( ) Remote Install Server (RIS) CD

8 Windows Server 2003 SP1 Windows Firewall Microsoft Update Windows Server 2003 Internet Connection Firewall Windows 2000 Server Firewall TCP/IP ( ) TCP: (80/443)

9 / IPSec Windows Server 2003 SP1 Windows Server 2003

10 Network Boot Protocol RIS Disable PXE (BootP( BootP/DHCP) PXE CD/DVD-ROM CD-ROM CD-ROM BIOS

12 Windows Server 2003 SP1 (roll) IIS XML GPO

13 Firewall ( ): :

14 = Cryptographic Services DNS Client Event Log IPSEC Policy Agent (IPSec( Service) Netlogon Plug and Play Protected Storage Remote Procedure Call (RPC) Security Accounts Manager System Event Notification Windows Management Instrumentation Windows Time Workstation DMZ

15 Automatic Updates Computer Browser Cryptographic Services DHCP Client DNS Client Event Log IPSEC Policy Agent (IPSec( Service) Netlogon NTLM Security Support Provider Plug and Play Protected Storage Remote Procedure Call (RPC) Remote Registry Service Security Accounts Manager Server System Event Notification TCP/IP NetBIOS Helper Service Terminal Services Windows Installer Windows Management Instrumentation Windows Time Workstation

16 GPO wmic service list GPO

17 () F/W F/W ( ) LAN LAN

18 IPSec IPSec IPSec IPSec PC

19 IPSec Terminal Service Active Directory ()

21 Administrator Administrator [] :

22 ( ) ( ) [ ] - [Windows ] - [ ] : : 24 : : 42 : : 2 : : 12 : :

23 () DoS [ ] - [Windows ] - [ ] : : 10 : : 30 : : 15

24 Kerberos Windows 2000 NYLMv2 Challenge Response NTLM nonce NTLM (NT Hash) LM Hash Hash Hash Challenge Response LM (LanMan( LanMan) ) Hash

25 LMCompatibilityLevel : : LAN Manager HKLM System System CurrentControlSet control LSA LMCompatibilityLevelLMCompatibilityLevel : , LM, NTLM, 1 LM, NTLM, Session security 2 NTLM, Session security 3 NTLMv2, Session security 4 NTLMv2, Session security 5 (( ) NTLMv2, Session security LM, NTLM, NTLMv2 LM, NTLM, NTLMv2 LM, NTLM, NTLMv2 LM, NTLM, NTLMv2 NTLM, NTLMv2 NTLMv2 GPO: [NTLMv2 LM NTLM ] : LAN Manager : LM

26 NTFS ()

27 NTFS ( ) : :

28 NTFS () Everyone Authenticated Users

29 NTFS NTFS NTFS : : share_ro, : share_rw

30 TCP/IP: DoS HKLM SYSTEM SYSTEM CurrentControlSet Services Tcpip Parameters SynAttackProtect EnablePMTUDiscovery 1 SYN Attack 0 SYN Attack KeepAliveTime 300,000 SYN Attack ( ) TcpMaxConnectResponseRetransmissions TcpMaxDataRetransmissions TCPMaxPortsExhausted EnableICMPRedirect EnableDeadGWDetect DisableIPSourceRouting 2 - PerformRouterDiscovery 0-0 ICMP Attack TcpMaxHalfOpen 500 SYN Attack Windows 2000 TcpMaxHalfOpenRetried 400 SYN Attack Windows 2000 NoNameReleaseOnDemand 1 - HKEY_LOCAL_MACHINE System System CurrentControlSet Services AFD Parameters DynamicBacklogGrowthDelta 10 EnableDynamicBacklog 1 MinimumDynamicBacklog 20 MaximumDynamicBacklog 20,000 2 SYN Attack 2 SYN Attack 5 SYN Attack 0 SNMP Attack

31 SafeDllSearchMode DLL (Safe DLL Search Mode) Enable: Disable: HKLM SYSTEM SYSTEM CurrentControlSet Control Session Manager SafeDllSearchMode 1

32 AntiVirus Exchange Server [XADM] Exchange Exchange Server IIS PRB: Antivirus software causes FileSystemObject calls to hang IIS IIS 6.0: Antivirus Scanning of IIS Compression Directory May Result in 0-0 Byte File PRB: Exceptions Occur When You Run ASP.NET Applications and Inoculan Antivirus Software Index Server Backup and Recovery Guidelines for Index Server Catalog File Replication FRS Encounters "ERROR_SHARING_VIOLATION" Errors When It Tries to Replicate Data That Is Still in Use

34 : : Exploit : : : 1 1

35 TechNet Security Center (( ) mspx RSS MSN Alert (( ) Windows/MSN Messenger

37 xxxxxx.exe /passive /promptrestart/ qchain UpdateExeVolatile 1 0, Reg Query "HKLM SOFTWARE SOFTWARE Microsoft Updates UpdateExUpdateEx evolatile" " /v Flags (NLB)

38 Windows Software Update Service (WSUS) () () TechNet (Auto Update) Microsoft Update

40 : :

42 16,384 KB 4 GB 81,920 KB 4 GB 16,384 KB 4 GB

43 () ( etc...) ID

44 ID DoS

45 ID

46 Microsoft Operation Manager (MOM) [] Log Parser [[ ] (SQL) Log RDBMS Syslog

47 = / Mirror Secondly Tasklist /svc Tasklist /v Tasklist /M reg export HKLM c: hklm.txt Virtual PC Link disk Virtual

48 Appendix TechNet japan/technet/security/ Windows Server mspx Windows Server Windows Server Windows Server mspx -Windows Server 2003 Windows XP Windows khg/01intro.mspx Windows 2000 Server secure/default.mspx

49 Appendix: Tools Microsoft Baseline Security Analyzer (MBSA) spx Log Parser ser/default.m spx Professor Windows Log Parser /pw0505.mspx Tales from the Script - /sg0105.mspx TechNet assessment.mspx Microsoft Operations Manager

50 Appendix: Knowledge Base Windows 2000 TCP/IP NTLM 2 Microsoft Windows

82801pdf.pqxp

82801pdf.pqxp PC Contents Chapter 1 PC / Chapter 2/ 1 2 SMS WAN BITS Chapter 3 SMS 2003 SMS SMS SMS 2003 2 6 8 9 9 10 11 12 13 14 16 17 17 18 19 19 20 20 21 22 24 24 25 25 26 26 27 28 PC PC PC PC PC IT 1 1 PC PC PC

Windows Server の セキュリティ概要

Windows Server のセキュリティ概要