Security Basics mailing list archives
RE: Patching internet facing MS systems
From: "Kevin Ortloff" <Kevin.Ortloff () j2global com>
Date: Thu, 27 Mar 2008 13:39:13 -0700
I agree with one of the other writers...... It is ALWAYS best practice to have any server that needs internet access to go through a proxy. External connection toward your IIS servers will not be effected, only server initiated connections will use the proxy. Even if the proxy is simple like Squid. This will keep all the "bad guys" from seeing the real server. For your IIS servers, if you want them patch them say monthly or whenever, use WSUS...this will also keep the "bad guys" away from your servers and you can patch with a little more confidence. You can set WSUS up to only push patches you approve ( after testing of course ) ... If you are concerned with security BTW..... Stop using remote desktop (unless you have properly configured the terminal services rdp-tcp general connection settings on the server. Maybe even add a cert) -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Dan Lynch Sent: Monday, March 10, 2008 3:45 PM To: security-basics () securityfocus com Subject: Patching internet facing MS systems Greetings group, I'm looking for current best practice recommendations regarding the maintenance and patching of internet-facing Windows servers. In my environment, these are hardened, stand-alone (i.e., non-domain member) servers, mainly running IIS, and in at least one case, MS SQL Server. They reside on a network segregated behind a firewall from the internet, and from our core network. At this time, no connections are allowed from them to the private network. All unnecessary services are disabled, including the Server Service. Currently, Remote Desktop is used for many maintenance tasks, but patching remains a problem. Applicable patches are copied to a USB memory stick, and an administrator at the server console manually installs. This sneaker-net solution is the source of much wailing and gnashing of teeth among our sysadmins. A number of options are available that run the gamut from turning on automatic updates and allowing them to make outbound HTTP connections to microsoft.com, to making them domain member servers and using SMS to push patches. How do _you_ do it? Dan Lynch, CISSP Information Technology Analyst County of Placer Auburn, CA This email, its contents and attachments contain information from j2 Global Communications, Inc. and/or its affiliates which may be privileged, confidential or otherwise protected from disclosure. The information is intended to be for the addressee(s) only. If you are not an addressee, any disclosure, copy, distribution, or use of the contents of this message is prohibited. If you have received this email in error please notify the sender by reply e-mail and delete the original message and any copies. j2 Global Communications. 6922 Hollywood Blvd., Hollywood, CA 90028.
Current thread:
- Patching internet facing MS systems Dan Lynch (Mar 11)
- Re: Patching internet facing MS systems Ansgar -59cobalt- Wiechers (Mar 11)
- Re: Patching internet facing MS systems Josh Haft (Mar 11)
- Re: Patching internet facing MS systems Kurt Buff (Mar 11)
- RE: Patching internet facing MS systems Dan Lynch (Mar 13)
- Re: Patching internet facing MS systems Ansgar -59cobalt- Wiechers (Mar 13)
- RE: Patching internet facing MS systems Dan Lynch (Mar 13)
- RE: Patching internet facing MS systems Dan Denton (Mar 13)
- Re: Patching internet facing MS systems Ansgar -59cobalt- Wiechers (Mar 13)
- Re: Patching internet facing MS systems Ansgar -59cobalt- Wiechers (Mar 13)
- Re: Patching internet facing MS systems Ansgar -59cobalt- Wiechers (Mar 13)
- <Possible follow-ups>
- RE: Patching internet facing MS systems Rob McShinsky (Mar 11)
- Re: Patching internet facing MS systems evilwon (Mar 11)
- Re: Patching internet facing MS systems nobledark (Mar 13)