>My guess is that you can put IIS on a domain controler if and only if the
server is inside your private
>network and you are running some n-tier system and you have a tight budget.
So much for the Web server
>that is not exposed (inside your private network).
Technically, you could configure your firewall to allow all the necessary
ports between a DC/IIS Server
in your DMZ and your internal/green network.
http://www.microsoft.com/serviceproviders/columns/config_ipsec_P63623.as
p
Technically, lots of things are possible. IIS & DC, DMZ, internal network
bla bla bla ..
The question is, do the added security holes/dangers justify
the added functionality or cost savings. - My .02
Brandon
-----Ursprüngliche Nachricht-----
Von: calin oprea [mailto:calinoprea2004 (at) yahoo (dot) com [email concealed]]
Gesendet: Donnerstag, 20. Januar 2005 09:18
An: focus-ms (at) securityfocus (dot) com [email concealed]
Betreff: Re: IIS6 on W2k3 DCs
In-Reply-To: <20050113142952.5617.qmail (at) web52805.mail.yahoo (dot) com [email concealed]>
Although I am just a humble professional, I feel that simple things should
be kept simple. The very reason that IIS should not be kept on a DC machine
is provided by Microsoft itself: the Web Edition of their 2003 Server.
Aside from that, there's a lot to do with your design: I mean you can have a
DMZ; I mean c'mon, if someone manages to hack your public network, the
private one is still isolated. That is for the Web server that is exposed.
My guess is that you can put IIS on a domain controler if and only if the
server is inside your private network and you are running some n-tier system
and you have a tight budget. So much for the Web server that is not exposed
(inside your private network).
regards,
io
>
>The security guides published by many sources (NSA,
>MS, etc) stated that IIS4 and IIS5 do not belong on
>DCs. Common best practices would, in general, guide
>that an HTTP (IIS or otherwise) daemon doesn't belong
>on DC.
>
>By referring to numerous security guides written
>specifically for NT4 and W2k we were able to convince
>a customer of this. Now that IIS6 has come out, and
>the customer feels that IIS6 is much safer than IIS4
>and IIS5, they want to put it back on their DCs.
>
>I am looking for sources that document that this is a
>bad idea. When it comes to the NSA they don't have a
>guide for W2k3 but have instead pointed to Microsoft's
>"Windows Server 2003 Security Guide" and the use of
>the "High Security" settings and templates. The MS
>guide does (rather subtly) show that IIS should not be
>on a DC. They only show the HTTP service enabled on an
>IIS server, but I think this may not be direct enough
>for our client.
>
>Any help finding an explicit statement that IIS6 does
>not be belong on a DC would be greatly appreciated.
server is inside your private
>network and you are running some n-tier system and you have a tight budget.
So much for the Web server
>that is not exposed (inside your private network).
Technically, you could configure your firewall to allow all the necessary
ports between a DC/IIS Server
in your DMZ and your internal/green network.
http://www.microsoft.com/serviceproviders/columns/config_ipsec_P63623.as
p
Technically, lots of things are possible. IIS & DC, DMZ, internal network
bla bla bla ..
The question is, do the added security holes/dangers justify
the added functionality or cost savings. - My .02
Brandon
-----Ursprüngliche Nachricht-----
Von: calin oprea [mailto:calinoprea2004 (at) yahoo (dot) com [email concealed]]
Gesendet: Donnerstag, 20. Januar 2005 09:18
An: focus-ms (at) securityfocus (dot) com [email concealed]
Betreff: Re: IIS6 on W2k3 DCs
In-Reply-To: <20050113142952.5617.qmail (at) web52805.mail.yahoo (dot) com [email concealed]>
Although I am just a humble professional, I feel that simple things should
be kept simple. The very reason that IIS should not be kept on a DC machine
is provided by Microsoft itself: the Web Edition of their 2003 Server.
Aside from that, there's a lot to do with your design: I mean you can have a
DMZ; I mean c'mon, if someone manages to hack your public network, the
private one is still isolated. That is for the Web server that is exposed.
My guess is that you can put IIS on a domain controler if and only if the
server is inside your private network and you are running some n-tier system
and you have a tight budget. So much for the Web server that is not exposed
(inside your private network).
regards,
io
>
>The security guides published by many sources (NSA,
>MS, etc) stated that IIS4 and IIS5 do not belong on
>DCs. Common best practices would, in general, guide
>that an HTTP (IIS or otherwise) daemon doesn't belong
>on DC.
>
>By referring to numerous security guides written
>specifically for NT4 and W2k we were able to convince
>a customer of this. Now that IIS6 has come out, and
>the customer feels that IIS6 is much safer than IIS4
>and IIS5, they want to put it back on their DCs.
>
>I am looking for sources that document that this is a
>bad idea. When it comes to the NSA they don't have a
>guide for W2k3 but have instead pointed to Microsoft's
>"Windows Server 2003 Security Guide" and the use of
>the "High Security" settings and templates. The MS
>guide does (rather subtly) show that IIS should not be
>on a DC. They only show the HTTP service enabled on an
>IIS server, but I think this may not be direct enough
>for our client.
>
>Any help finding an explicit statement that IIS6 does
>not be belong on a DC would be greatly appreciated.
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
[ reply ]