Front cover - IBM Redbooks

many of these alerts may be irrelevant, it only takes one missed warning to
leave a system open to attack.
Linux system administrators should regularly visit to the Web site of the
distribution that they are using (for example, Caldera, Red Hat, SUSE,
Turbolinux) for advisories on vulnerabilities and relevant patches, as well as the
UNIX section of the SecurityFocus Web site
(http://www.securityfocus.com/unix), also for security advisories and tools
and techniques to combat vulnerabilities.
In summary, we’ve tried to present a fair and balanced overview of the potential
security issues in Linux and Windows. This is to show that there are security
vulnerabilities in both families of operating systems and that the
security-conscious system administrator should not be lulled into a sense of
comfort by using one operating system over the other.
In the next sections, we look at the specifics of hardening Windows and Linux,
and Solaris and AIX as well, since these are the operating systems on which
Domino runs and is supported.
Domino also runs on the zOS (OS/390®) and OS/400® Operating Systems
(which are for zSeries mainframes and iSeries minicomputers). However,
given the specialized knowledge required to administer those systems, they are
considered outside the scope of this redbook.
9.3 Hardening Windows (NT kernel-based) systems
In this section we look at the process of hardening Windows (Win32-based)
systems. These are the systems that include the NT family of Windows products,
namely:
► Windows NT 4.0
► Windows 2000 Server
► Windows XP Professional
We’ve included Windows XP Professional because Windows is used as a
desktop environment by a majority of users (with Linux slowly catching up and
getting more and more mindshare in that space) and thus, it was felt that a
hardening guide for workstations would be a good idea.
Although hardening a Windows server is a tedious process, it is relatively easy to
do, and should typically incur no additional software or hardware expense for the
organization. As mentioned earlier on in the chapter, the process is
straightforward: 1) Harden the base operating system; and, 2) Take similar
Chapter 9. Server hardening 365