Security

Ask something
Discussion Locked

Securing server from hackers

0 helpful
3 replies

by gerald

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi All,
I have a w2k server connecting to the internet etc via an ISDN NetGear router. I need to secure the server from outside attacks. Attacks on the server are currently being maid on a regular basis, but the password security seems to be holding up at the moment. What filters should I instal to the router to protect the server by only using the neccessary ports required. I am using w2k exchange for mail, some ftp outwards and inwards for file transfer and a dialin account for remote administration purposes.
Filter description would be appreciated.
Cheers
Gerald......

3 replies

by erikdr

Well, IF you want to stick to the router only you could filter for purely the needed protocols/ports. HTTP, FTP, SMTP and the remote admin (SSH or RDP)?

However generally I feel it is a bad idea to rely purely on router functions for a situation like this. For any server-like thing connecting to the Internet, firewall function is almost indispensable. The fwall does much more than port filtering, it will also check the stream of packets to see whether no one is trying to hack into HTTP, FTP etc. ('stateful inspection').
In the MS world, ISA Server is an option though I have reasons to rate it quite low in security and flexibility for bigger environments. In your situation, if it can co-exist on your w2k box, it might still be an option. If it would require an extra box then an appliciance firewall (Netgear, NetScout, xxx) would probably be cheaper.

Hope this helps,

- The Netherlands

by curacao_dejavu

Install ISA server firewal.
If you install the proxyclient on the clients, and set the appropiate rules, only the apps that you specify can access the internet. Also you can redirect the traffice for the ftp downloads that you specify and you can set your exchange server behind the firewall to (redirect the traffic to the exchange serve which will have only a internal ip, so the server box it self is not accessible via the internet.)

Leopold

This discussion is closed to new replies.