Improving Web Application Security: Threats and - CGISecurity

Chapter 22: Deployment Review 673Files and DirectoriesThe following review questions enable you to verify that you have used NTFSpermissions appropriately on your database server.● Have you configured permissions on the SQL Server install directories?Review the permissions on the SQL Server installation directories and make surethat the permissions grant limited access. For detailed permissions, see “Step 5.Files and Directories” in Chapter 18, “Securing Your Database Server.”●●Have you removed Everyone permissions for SQL Server files?Review the permissions on the SQL Server file location (by default, \ProgramFiles\Microsoft SQL Server\MSSQL) and check that the Everyone group has beenremoved from the directory ACL. At the same time, make sure that full control hasbeen granted to only the SQL Service account, the Administrators group, and thelocal system account.Have you secured setup log files?If you have installed SQL Server 2000 Service Pack 1 or 2, the system administratoror service account password may be left in the SQL installation directory. Makesure that you have used the Killpwd.exe utility to remove instances of passwordsfrom the log files.For information about obtaining and using this utility, see Microsoft KnowledgeBase article 263968, “FIX: Service Pack Installation May Save Standard SecurityPassword in File.”SharesReview the following questions to ensure that your server is not unnecessarilyexposed by the presence of file shares:● What shares are available on your server?To review shares and associated permissions, run the Computer ManagementMMC snap-in and select Shares beneath Shared Folders. Check that all the sharesare required. Remove any unnecessary shares.● Can the Everyone group access shares?Check that the Everyone group is not granted access to your shares unlessintended, and that specific permissions are configured instead.● Have you removed the administration shares?If you do not allow remote administration of your server, then check that theadministration shares, for example, C$ and IPC$, have been removed.Note Some applications may require administrative shares. Examples include MicrosoftSystems Management Server (SMS) and Microsoft Operations Manager (MOM). For moreinformation, see Microsoft Knowledge Base article 318751, “How To: Remove AdministrativeShares in Windows 2000 or Windows NT4.”