IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.42 Secure configuration of TCP/IP network
administration under Windows NT
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
When integrating Windows NT systems into a computer network, correct
configuration of the installed network services is particularly important. Notes
are given in the following paragraphs regarding the most widely-used
services; these notes, however, do not replace a detailed examination of
security requirements and the necessity for exact knowledge of the system
documentation.
DHCP (Dynamic Host Configuration Protocol)
To reduce the effort involved in administration of IP address information, IP
addresses, and the data belonging to them, can be dynamically configured
under DHCP.
A Windows NT computer becomes a DHCP client if it has been configured
for automatic DHCP-configuration when installing TCP/IP. After starting a
DHCP client a connection to a DHCP server will be established in order to
obtain the necessary TCP/IP configuration data. This configuration data
contains at least one IP address, a subnetwork mask and the current validity
length of the address.
Installation of a DHCP server is part of the installation of Microsoft TCP/IP
and can only be carried out by a member of the "Administrators" group.
Note: To avoid a possible conflict, it must be ensured that other DHCP servers
do not already exist in the network before installing a new DHCP server.
Automatic configuration of a new DHCP server cannot be carried out under
DHCP as a computer cannot simultaneously act as a DHCP client and a
DHCP server.
Note: »All entries in the registry concerning the DHCP server can be found
under the path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
DHCPserver\Parameters.«
With the service programme DHCP-Manager the following fundamental tasks
can be performed:
- Creating one or more DHCP areas, so that DHCP services are available.
- Defining the properties of an area including length of usage time and IP
address pools which should be allocated by servers to possible DHCP
clients.
- Determining standard values for options like Standard-Gateway, DNS
server or WINS server, which should be allocated together with an IP
address and the addition of personal options.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000