Front cover - IBM Redbooks

preparation of the necessary updates on a customized CD or tape before
installation.
Once the OS is installed with current updates, it is important to keep the system
up to date. There are update services offered by the major OS manufacturers
(such as the Red Hat up2date tool and Microsoft’s Windows Update Tool). These
tools must be used carefully, and you should understand what a specific patch
acquired with the tool will do to the system before you install it.
Lock down the services
The operating system is only a small part of an IT system. Additional services
that are bolted on can provide additional functionality right out of the box, but on
the other hand, they can cause some security headaches. For example, one of
the most well-known services for the Windows Server OS is Internet Information
Server (IIS), which has been the source of a great number of well-publicized
exploits.
Just like the OS, all services and third-party programs on the computer should be
checked to ensure that they are the most current versions and that they are safe
to use. Oddly enough, not all System Administrators understand this principle
and make efforts to remove unwanted services; some don’t even know which
services their systems are running.
While we deal with specific tools and techniques in this chapter, a quick and easy
way to close some vulnerabilities is to check which communication ports are
listening for incoming data. This is done using the following command at the
command prompt:
netstat -an
As well, tools such as Nessus, Nmap, and Stealth can quickly provide a
snapshot of the IT system and what potentially vulnerable services are running in
the background.
Define a proper baseline
Once the IT system is patched and locked down, an important step that should
be taken before opening it to the world is to establish a proper baseline for the IT
system.
This is mostly to ensure that complete documentation of the changes that were
carried out on the IT system exists. Any changes made to this baseline can be
verified and appropriate security measures taken. This also sets up a standard in
terms of IT system configuration in the organization and any corrections that
have to be applied can be done quickly and uniformly, avoiding the concept of a
“weakest link.” (That is, a system that differs significantly in its base configuration
Chapter 9. Server hardening 355