Improving Web Application Security: Threats and - CGISecurity

Chapter 17: Securing Your Application Server 491PortsServiced components communicate using DCOM, which in turn communicates usingthe RPC transport.By default, DCOM dynamically allocates ports, which is undesirable from a securityand firewall configuration perspective. DCOM ports should be restricted to reducethe attack surface profile and to ensure that you do not need to open unnecessaryports on the internal firewall. Two options exist for restricting the ports used byDCOM:● Use port ranges.●Use static endpoint mapping.Port RangesFor incoming communication, you can configure RPC dynamic port allocation toselect ports within a restricted range above 1024. Then configure your firewall toconfine incoming external communication to only those ports and port 135, which isthe RPC endpoint mapper port. To control RPC dynamic port allocation1. Start the Component Services tool.2. Click to expand the Component Services and Computers nodes, right-clickMy Computer, and then click Properties.3. Click the Default Protocols tab, and then select Connection-oriented TCP/IPin the DCOM Protocols list box.4. Click Properties.5. In the Properties for COM Internet Services dialog box, click Add.6. In the Port range text box, add a port range, for example 5000–5020, and thenclick OK.7. Leave the Port range assignment and the Default dynamic port allocationoptions set to Internet range.8. Click OK twice to close the dialog boxes.9. Restart your computer so the changes can take effect.Static Endpoint MappingWindows 2000 (SP3 or QFE 18.1) or Windows Server 2003 allows you to configureEnterprise Services applications to use a static endpoint. If a firewall separates theclient from the server, you only need to open two ports in the firewall. Specifically,you must open port 135 for RPC and a port for your Enterprise Services application.