Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 443Disable the Guest AccountThe Guest account is used when an anonymous connection is made to the computer.To restrict anonymous connections to the computer, keep this account disabled. Theguest account is disabled by default on Windows 2000. To check whether or not it isenabled, display the Users folder in the Computer Management tool. The Guestaccount should be displayed with a cross icon. If it is not disabled, display itsProperties dialog box and select Account is disabled.Rename the Administrator AccountThe default local Administrator account is a target for malicious use because of itselevated privileges on the computer. To improve security, rename the defaultAdministrator account and assign it a strong password.If you intend to perform local administration, configure the account to deny networklogon rights and require the administrator to log on interactively. By doing so, youprevent users (well intentioned or otherwise) from using the Administrator accountto log on to the server from a remote location. If a policy of local administration is tooinflexible, implement a secure remote administration solution. For more information,see “Remote Administration” later in this chapter.Disable the IUSR AccountDisable the default anonymous Internet user account, IUSR_MACHINE. This iscreated during IIS installation. MACHINE is the NetBIOS name of your server at IISinstallation time.Create a Custom Anonymous Web AccountIf your applications support anonymous access (for example, because they use acustom authentication mechanism such as Forms authentication), create a customleast privileged anonymous account. If you run IISLockdown, add your custom userto the Web Anonymous Users group that is created. IISLockdown denies access tosystem utilities and the ability to write to Web content directories for the WebAnonymous Users group.If your Web server hosts multiple Web applications, you may want to use multipleanonymous accounts, one per application, so that you can secure and audit theoperations of each application independently.For more information about hosting multiple Web applications see Chapter 20,“Hosting Multiple Web Applications.”