IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.43 Secure configuration of TCP/IP network
services under Windows NT
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
TCP/IP
When installing the TCP/IP protocol, properties can be set with the control
panel option "Network". Given that the computer concerned has more than one
network card and/or remote access via RAS is installed (Remote Access
Server, see S 5.41 Secure configuration of remote access under Windows NT),
attention must be paid here, that routing between these cards, i.e. between the
remote access interface and the network card, can be switched on via the
"Enable IP-Forwarding" option under the register card "Routing". As a rule,
this option should not be activated on computers which have a connection to
an external network such as the Internet, since this will allow external
computers transparent access to the local network.
In version 4.0 filtering of data traffic via TCP/IP can be achieved to a certain
extent. This can be done by choosing the "Advanced" option under the register
card "IP address" and selecting the "Enable Security" option in the opened
window. By choosing the "Configure" option the permitted or, as the case may
be, locked TCP and UDP ports and IP protocols for single network cards can
be selected. The values to be entered here should be selected according to the
necessary function and the given security requirements. A security concept for
the use of Internet services should exist for computers with external
connections. Considerations to be taken here should be similar to those taken
when installing a firewall (see Baseline Protection module 7.3 Firewall, in
particular S 2.76 Selection and Implementation of suitable filter rules).
FTP (File Transfer Protocol)
An FTP server will be set up during installation of TCP/IP under version 3.51;
in version 4.0 the FTP server can be installed as part of the installation of
Peer-Web-services. If the FTP server service is executed on a Windows NT
system, other IT systems can create a connection with this Windows NT
system as clients via the FTP service programme and thus transfer files. Users
who create a connection with the FTP server are authenticated under Windows
NT via their user account and are granted access dependent upon their user
profile. For this reason, it is necessary to install the FTP server on a NTFS
partition so that files and directories made accessible by FTP can be protected.
Following installation the FTP server must be configured before it can be
operated. The configuration settings can lead to one of the following
situations:
- No anonymous FTP connections are permitted. In this case, each user must
enter a username and password valid under Windows NT.
- Anonymous users as well as users under Windows NT can make a
connection. In this case a user can choose between an anonymous port and
a connection via username and password under Windows NT.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000