Front cover - IBM Redbooks

368 Lotus Security Handbook
– Network DDE DSDM: This manages Dynamic Data Exchange (DDE)
network shares, through the shared database of DDE connections.
– TCP/IP NetBIOS Helper: This is NetBIOS over TCP/IP, which provides
name-to-IP address mapping.
Although convenient for remote server administration, it is best to not add
additional services, including remote management services such as telnetd
and FTP. Neither provides encryption, so accounts, passwords, and other
information can be gleaned via the network. If these services must be
enabled, system administrators should take other precautions, such as
allowing access only through the firewall from the internal network and
applying IP security filters on the servers running the services.
► Enable IP security filters on the DMZ servers. Firewalls have their own IP
filtering, and do not need or require native Windows NT IP filters. Choose
Control Panel → Network → Protocols → TCP/IP Protocol →
Properties → Advanced. Check “Enable Security” and then select
Configure. Add the inbound ports that need to be accepted.
► Remove the right for users to allow access to the server from the network;
force console access only.
► Assign individual admin accounts if there is a need for multiple admin
accounts. This helps the auditing process.
► Rename the Administrator account to another name.
► Create a dummy Administrator account with no privileges. As intruders try to
compromise this account, they will be logged in the audit logs.
► Reduce the number of groups that have access to the server to only those
necessary for operation and administration of the server. It should be possible
to reduce the groups down to Administrators and Power Users.
► Enable more secure system policies. User Manager should be used to modify
the Account, User Rights, and Audit system policies, namely:
– Account policies control user password and lockout settings. Passwords
should expire according to the time frame set by corporate policy.
Minimum password length should be at least eight characters, while 24
previous passwords should be remembered. Account lockout should
occur after three bad logon attempts. The counter can be reset after 30
minutes.
– All User Rights should have the Everyone group removed. Remove all
groups and users from Access This Computer From the Network, and limit
the users and groups that can Log on Locally. Make sure to pay special
attention to Manage Auditing and Security Log.
► Turn on auditing of success and failure of at least these events: Logon and
Logoff; Security Policy Changes; and Restart, Shutdown, and System.