22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

376 Lotus Security Handbook<br />

entered. Disable NetBIOS over TCP/IP by selecting “Disable NetBIOS<br />

over TCP/IP.”<br />

c. Select the Options tab to configure any TCP/IP filtering, as described<br />

previously in the Windows NT 4.0 section.<br />

► Use a nonexistent workgroup. There is no reason for a firewall or DMZ server<br />

to participate in domain or workgroup activities.<br />

► Disable the telnetd service. If telnet sessions must be allowed into the box,<br />

the telnet users should be restricted to authenticated users of the<br />

TelnetClients group. Create the TelnetClients group, then add to the group<br />

the users to whom telnet access should be granted. The telnetd service will<br />

automatically restrict Telnet access to TelnetClients group members.<br />

► Lock down your DNS Server. Zone transfers should be restricted to only<br />

authorized servers. The DNS Manager should be used to modify the zone<br />

properties. On the Notify tab, check the option “Only Allow Access From<br />

Secondaries Included on Notify List.” Be sure to protect primary zones as well<br />

as secondaries. Unfortunately, the built-in DNS servers that come with<br />

Windows NT and 2000 do not have controls to restrict query requests. If this<br />

feature is required, the ISC BIND (Internet Software Consortium Berkeley<br />

Internet Name Daemon) reference implementation that is used in most UNIX<br />

installations can be used. On the one hand, the integrated GUI administrative<br />

features will be lost, but in exchange, all the granularity and control available<br />

in the BIND implementation will be available. The source code and binary<br />

packages can be found at the ISC site at the following URL:<br />

http://www.isc.org/products/BIND/<br />

Installation don’ts<br />

Now, on to what should not be done.<br />

► Do not load Certificate Services; that should be an internal-only service<br />

because the CA (Certificate Authorities) private key should be kept secret,<br />

and you generally aren't offering Certificate enrollment to various Internet<br />

users. As a general rule, corporate Certificate Authorities are kept in a tightly<br />

controlled and secure environment on an isolated internal network.<br />

Furthermore, since Lotus Domino will likely be offering services over SSL, it<br />

will be up to that component – not the operating system – to offer this service,<br />

which is yet another reason for not loading Certificate Services.<br />

If system monitoring is needed, install SNMP from Management and<br />

Monitoring Tools, but change the read and write community strings<br />

accordingly.<br />

► Do not install into a domain or Active Directory structure. There is no<br />

conceivable need to have a firewall or DMZ server, external Domino server,<br />

or DNS server participate in a domain.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!