Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 445Disable Null Sessions (Anonymous Logons)To prevent anonymous access, disable null sessions. These are unauthenticated oranonymous sessions established between two computers. Unless null sessions aredisabled, an attacker can connect to your server anonymously (without beingauthenticated).Once an attacker establishes a null session, he or she can perform a variety of attacks,including enumeration techniques used to collect system-related information fromthe target computer — information that can greatly assist subsequent attacks. Thetype of information that can be returned over a null session includes domain andtrust details, shares, user information (including groups and user rights), registrykeys, and more.Restrict Null sessions by setting RestrictAnonymous to 1 in the registry at thefollowing subkey:HKLM\System\CurrentControlSet\Control\LSA\RestrictAnonymous=1For more information, see Microsoft Knowledge Base article 246261, “How To: Usethe RestrictAnonymous Registry Value in Windows 2000.”Additional ConsiderationsThe following is a list of additional steps you can consider to further improvesecurity on your Web server:● Require approval for account delegation.Do not mark domain accounts in Active Directory as trusted for delegation unlessyou first obtain special approval to do so.● Do not use shared accounts.Do not create shared account for use by multiple individuals. Authorizedindividuals must have their own accounts. The activities of individuals can beaudited separately and group membership and privileges appropriately assigned.● Restrict the Local Administrators Group Membership.Try to limit administration accounts to two. This helps provide accountability.Also, passwords must not be shared, again to provide accountability.●Require the Administrator to log on interactively.If you perform local administration only, you can require your Administratoraccount to log on interactively by removing the Access this computer from thenetwork privilege.