Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 455Securing RDSIf your applications require RDS, secure it. To secure RDS1. Delete the samples at the following location:\Progam Files\Common Files\System\Msadc\Samples2. Remove the following registry key:HKLM\System\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch\VbBusObj.VbBusObjCls3. Disable Anonymous access for the MSADC virtual directory in IIS.4. Create a HandlerRequired registry key in the following location:HKLM\Software\Microsoft\DataFactory\HandlerInfo\5. Create a new DWORD value, and set it to 1 (1 indicates safe mode, while 0indicates unsafe mode.Note You can use the registry script file Handsafe.reg to change the registry key. The script file islocated in the msadc directory: \Program Files\Common Files\System\msadcFor more information about securing RDS, see the following:●●MS99-025 Microsoft Security Program: Unauthorized Access to IIS Servers throughODBC Data Access with RDS at http://www.microsoft.com/technet/security/bulletin/ms99-025.asp.MS98-004 Microsoft Security Program: Microsoft Security Bulletin: UnauthorizedODBC Data Access with RDS and IIS at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS98-004.asp.● Microsoft Knowledge Base article 184375, “PRB: Security Implications of RDS 1.5,IIS 3.0 or 4.0, and ODBC.”Set Web PermissionsWeb permissions are configured through the IIS snap-in and are maintained in the IISmetabase. They are not NTFS permissions.Use the following Web permissions:● Read Permissions. Restrict Read permissions on include directories.● Write and Execute Permissions. Restrict Write and Execute permissions on virtualdirectories that allow anonymous access.