Improving Web Application Security: Threats and - CGISecurity

Chapter 17: Securing Your Application Server 483By default, DCOM uses RPC dynamic port allocation, which randomly selects portnumbers above 1024. In addition, port 135 is used by the RPC endpoint mappingservice.Restrict the ports required to support DCOM on the internal firewall in two ways:●●Define port ranges.This allows you to control the ports dynamically allocated by RPC. For moreinformation about dynamic port restrictions, see Microsoft Knowledge Base article300083, “How To: Restrict TCP/IP Ports on Windows 2000 and Windows XP.”Use static endpoint mapping.Microsoft Windows 2000 SP3 (or QFE 18.1 and later) or Windows Server 2003allows you to configure Enterprise Services applications to use a static endpoint.Static endpoint mapping means that you only need to open two ports in thefirewall: port 135 for RPC and a nominated port for your Enterprise Servicesapplication.For more information about static endpoint mapping, see Microsoft KnowledgeBase article 312960, “Cannot Set Fixed Endpoint for a COM+ Application.”Web ServicesIf you cannot open ports on the internal firewall, then you can introduce a Webservicesfaçade layer in front of the serviced components on the application server.This means that you only need to open port 80 for HTTP traffic (specifically, SOAPmessages) to flow in both directions.This approach does not allow you to flow transaction context from client to server,although in many cases where your deployment architecture includes a middle-tierapplication server, it is appropriate to initiate transactions in the remote servicedcomponent on the application server.For information about physical deployment requirements for service agents andservice interfaces, such as the Web-services façade layer, see “Physical Deploymentand Operational Requirements” in the Reference section of MSDN article,“Application Architecture for .NET: Designing Applications and Services,” athttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/distapp.asp.DTC RequirementsIf your application uses COM+ distributed transactions and these are used acrossremote servers separated by an internal firewall, then the firewall must open thenecessary ports to support DTC traffic. The DTC uses RPC dynamic port allocation.In addition to port 135 for RPC, DTC communication requires at least one additionalport.