作者：shotgun Author: shotgun
目前，WIN2000 SERVER是比较流行的服务器操作系统之一，但是要想安全的配置微软的这个操作系统，却不是一件容易的事。 Currently, WIN2000 SERVER is the more popular server operating systems, however, to the security configuration of Microsoft's operating system, is not an easy task. 本文试图对win2000 SERVER的安全配置进行初步的探讨。 This article attempts to win2000 SERVER security configuration of a preliminary study.
一、 定制自己的WIN2000 SERVER； First, customize their WIN2000 SERVER;
1． 1.
版本的选择：WIN2000有各种语言的版本，对于我们来说，可以选择英文版或简体中文版，我强烈建议：在语言不成为障碍的情况下，请一定使用英文版。 Version selection: WIN2000 a variety of languages, for us, you can choose English or Simplified Chinese, I strongly recommend: The language does not become a barrier, be sure to use the English version. 要知道，微软的产品是以Bug & You know, Microsoft's product is Bug &
Patch而著称的，中文版的Bug远远多于英文版，而补丁一般还会迟至少半个月（也就是说一般微软公布了漏洞后你的机子还会有半个月处于无保护状况） Patch is known for, far more than the Chinese version English version of the Bug, and the patch will generally at least two weeks late (ie after the general Microsoft announced the vulnerability of your machine will have two weeks in unprotected status)
2． 2.
组件的定制：win2000在默认情况下会安装一些常用的组件，但是正是这个默认安装是极度危险的（米特尼科说过，他可以进入任何一台默认安装的服务器，我虽然不敢这么说，不过如果你的主机是WIN2000 Custom components: win2000 installed by default in some common components, but it is the default installation is extremely dangerous (Mitt Nico said, he can enter any one server is installed by default, although I do not dare say, but if your host is WIN2000
SERVER的默认安装，我可以告诉你，你死定了）你应该确切的知道你需要哪些服务，而且仅仅安装你确实需要的服务，根据安全原则，最少的服务+最小的权限=最大的安全。 SERVER's default installation, I can tell you, you're dead) You should know exactly what services you need, but you really only need to install the service, according to safety principles, at least the minimum service + permissions = maximum security. 典型的WEB服务器需要的最小组件选择是：只安装IIS的Com Files，IIS Snap-In，WWW Typical minimum WEB server component selection is required: only install IIS Com Files, IIS Snap-In, WWW
Server组件。 Server components. 如果你确实需要安装其他组件，请慎重，特别是：Indexing Service, If you really need to install additional components, careful, especially: Indexing Service,
FrontPage 2000 Server Extensions, Internet Service FrontPage 2000 Server Extensions, Internet Service
Manager (HTML)这几个危险服务。 Manager (HTML) these dangerous services.
3． 3. 管理应用程序的选择 Management application of choice
选择一个好的远程管理软件是非常重要的事，这不仅仅是安全方面的要求，也是应用方面的需要。 Choose a good remote management software is a very important thing, not only security requirements, but also the application needs. Win2000的Terminal Service是基于RDP（远程桌面协议）的远程控制软件，他的速度快，操作方便，比较适合用来进行常规操作。 The Win2000 Terminal Service is based on the RDP (Remote Desktop Protocol) remote control software, and his fast, easy to operate, more suitable for routine operation. 但是，Terminal Service也有其不足之处，由于它使用的是虚拟桌面，再加上微软编程的不严谨，当你使用Terminal Service进行安装软件或重起服务器等与真实桌面交互的操作时，往往会出现哭笑不得的现象，例如：使用Terminal Service重起微软的认证服务器（Compaq, IBM等）可能会直接关机。 However, Terminal Service also has its shortcomings, because it uses a virtual desktop, along with Microsoft's programming is not strict, when you use the Terminal Service or re-install the software from the desktop, servers, etc. to interact with the real operation, they tend to The phenomenon appears almost to tears, for example: using Terminal Service from Microsoft re-authentication server (Compaq, IBM, etc.) may be directly shut down. 所以，为了安全起见，我建议你再配备一个远程控制软件作为辅助，和Terminal Service互补，象PcAnyWhere就是一个不错的选择。 Therefore, for safety reasons, I suggest you re-equipped with a remote control software as a supplement and complement each other Terminal Service, as PcAnyWhere is a good choice.
二、 正确安装WIN2000 SERVER Second, properly installed WIN2000 SERVER
1． 1. 分区和逻辑盘的分配，有一些朋友为了省事，将硬盘仅仅分为一个逻辑盘，所有的软件都装在C驱上，这是很不好的，建议最少建立两个分区，一个系统分区，一个应用程序分区，这是因为，微软的IIS经常会有泄漏源码/溢出的漏洞，如果把系统和IIS放在同一个驱动器会导致系统文件的泄漏甚至入侵者远程获取 ADMIN。 Logical partition and distribution of some friends in order to save trouble, will only be divided into a logical drive, all the software installed on the C drive, which is very good, recommended the establishment of at least two partitions, one system partition, an application partition, this is because Microsoft's IIS there is often a source code leak / overflow vulnerability, if the system and the IIS on the same drive will result in leakage of system files and even the intruder remote access to ADMIN. 推荐的安全配置是建立三个逻辑驱动器，第一个大于2G，用来装系统和重要的日志文件，第二个放IIS，第三个放FTP，这样无论IIS或FTP出了安全漏洞都不会直接影响到系统目录和系统文件。 The recommended security configuration is set up three logical drives, the first is greater than 2G, and important to install the system log file, the second put IIS, the third release FTP, it's either IIS or FTP is not a security vulnerability will directly affect the system directories and system files. 要知道，IIS和FTP是对外服务的，比较容易出问题。 You know, IIS and FTP is the external services, and more error-prone. 而把IIS和FTP分开主要是为了防止入侵者上传程序并从IIS中运行。 The separation of the main IIS and FTP upload program is to prevent intruders from running under IIS. （这个可能会导致程序开发人员和编辑的苦恼，管他呢，反正你是管理员J） (This may lead to program development and editing of distress, who cares, anyway, you are the administrator J)
2． 2. 安装顺序的选择：不要觉得：顺序有什么重要？ Order of installation options: Do not think: What is the order important? 只要安装好了，怎么装都可以的。 Just installed, and how you can install the. 错！ Wrong! win2000在安装中有几个顺序是一定要注意的： win2000 is installed in the order of a few must be noted:
首先，何时接入网络：Win2000在安装时有一个漏洞，在你输入Administrator密码后，系统就建立了ADMIN$的共享，但是并没有用你刚刚输入的密码来保护它，这种情况一直持续到你再次启动后，在此期间，任何人都可以通过ADMIN$进入你的机器；同时，只要安装一完成，各种服务就会自动运行，而这时的服务器是满身漏洞，非常容易进入的，因此，在完全安装并配置好win2000 SERVER之前，一定不要把主机接入网络。 First, when the access network: Win2000 has a bug in the installation, you enter the Administrator password, the system is established ADMIN $ share, but did not use the password you just entered to protect it, and this situation continued to start again after you, in the meantime, anyone can ADMIN $ access your machine; the same time, as long as the installation is complete, services will automatically run, and when the server is covered with loopholes, very easy access to and, therefore, completely installed and configured win2000 SERVER, be sure not to host the network.
其次，补丁的安装：补丁的安装应该在所有应用程序安装完之后，因为补丁程序往往要替换/修改某些系统文件，如果先安装补丁再安装应用程序有可能导致补丁不能起到应有的效果，例如：IIS的HotFix就要求每次更改IIS的配置都需要安装（变不变态？） Second, the patch installation: the installation of the patch should be installed after all the applications, because patches often have to replace / modify certain system files, if you install the patch before installing the application may cause the patch can not play the desired effect For example: IIS's HotFix requires both every time you change the configuration of IIS need to install (no abnormal change?)
三、 安全配置WIN2000 SERVER Third, the security configuration WIN2000 SERVER
即使正确的安装了WIN2000 SERVER，系统还是有很多的漏洞，还需要进一步进行细致地配置。 Even if correctly installed WIN2000 SERVER, there are still many loopholes in the system, but also the need for further detailed configuration.
1． 1. 端口：端口是计算机和外部网络相连的逻辑接口，也是计算机的第一道屏障，端口配置正确与否直接影响到主机的安全，一般来说，仅打开你需要使用的端口会比较安全，配置的方法是在网卡属性-TCP/IP-高级-选项-TCP/IP筛选中启用TCP/IP筛选，不过对于win2000的端口过滤来说，有一个不好的特性：只能规定开哪些端口，不能规定关闭哪些端口，这样对于需要开大量端口的用户就比较痛苦。 Port: port is connected to the computer and the external network logical interface, the first barrier is a computer port configuration is correct or not directly affect the safety of the host, in general, only open the ports you need to be more security, configuration of the method in the NIC properties -TCP/IP- Advanced - options -TCP/IP screening enable TCP / IP filtering, port filtering, but for win2000, there is a bad feature: only provides open which ports, not provided which closed the port, so that the user needs to open a large number of ports is more painful.
2． 2. IIS：IIS是微软的组件中漏洞最多的一个，平均两三个月就要出一个漏洞，而微软的IIS默认安装又实在不敢恭维，所以IIS的配置是我们的重点，现在大家跟着我一起来： IIS: IIS is Microsoft's highest vulnerability in a component, the average two or three months out of a hole would, while Microsoft's IIS is installed by default and is not flattered, so the configuration of IIS is our focus, we now follow me together:
首先，把C盘那个什么Inetpub目录彻底删掉，在D盘建一个Inetpub（要是你不放心用默认目录名也可以改一个名字，但是自己要记得）在IIS管理器中将主目录指向D:\Inetpub； First of all, that what the C drive Inetpub directory completely deleted in the D drive to build a Inetpub (if you do not trust the default directory name with a name can be changed, but they have to remember) in the IIS Manager to point the home directory will be D: \ Inetpub;
其次，那个IIS安装时默认的什么scripts等虚拟目录一概删除（罪恶之源呀，忘了http://www.target.com/scripts/.. %c1%1c../winnt/system32/cmd.exe了？我们虽然已经把Inetpub从系统盘挪出来了，但是还是小心为上），如果你需要什么权限的目录可以自己慢慢建，需要什么权限开什么。 Secondly, that the default installation of IIS scripts such as what to delete a virtual directory Yigai (source of evil ah, forget http://www.target.com/scripts/ ..% c1% 1c../winnt/system32/cmd. exe it? although we have to move out Inetpub from the system tray, but caution is still on), what if you need to access the directory can slowly build their own, what permissions to open any. （特别注意写权限和执行程序的权限，没有绝对的必要千万不要给） (Special attention to write and execute permissions for the program, there is no absolute need to do not to)
第三，应用程序配置：在IIS管理器中删除必须之外的任何无用映射，必须指的是ASP, ASA和其他你确实需要用到的文件类型，例如你用到stml等（使用server side include），实际上90%的主机有了上面两个映射就够了，其余的映射几乎每个都有一个凄惨的故事：htw, htr, idq, ida……想知道这些故事？ Third, the application configuration: In the IIS Manager to delete any unwanted outside the map must be referring to the ASP, ASA, and you really need to use other file types, for example, you use stml, etc. (using server side include), in fact 90% of the host with the above two maps enough, the rest of the map almost every story has a sad: htw, htr, idq, ida ... ... want to know these stories? 去查以前的漏洞列表吧。 Vulnerability to check the list before it. 什么？ What? 找不到在哪里删？ Can not find where to delete? 在IIS管理器中右击主机->属性->WWW服务编辑->主目录配置->应用程序映射，然后就开始一个个删吧（里面没有全选的，嘿嘿）。 In IIS Manager, right-click the host -> Properties -> WWW Services Edit -> Home Directory Configuration -> application mapping, and then it started to delete one by one (which does not select all, hehe). 接着在刚刚那个窗口的应用程序调试书签内将脚本错误消息改为发送文本（除非你想ASP出错的时候用户知道你的程序/网络/数据库结构）错误文本写什么？ Then in that window, the application just bookmark the script debugging error message to send text (unless you want ASP error when users know that your application / network / database structure) error text to write? 随便你喜欢，自己看着办。 Whatever you like, own choice. 点击确定退出时别忘了让虚拟站点继承你设定的属性。 Click OK to exit the virtual site, do not forget to inherit the properties you set.
为了对付日益增多的cgi漏洞扫描器，还有一个小技巧可以参考，在IIS中将HTTP404 Object Not Found出错页面通过URL重定向到一个定制HTM文件，可以让目前绝大多数CGI漏洞扫描器失灵。 In order to deal with the growing number of cgi vulnerability scanners, there is a little trick you can reference in IIS HTTP404 Object Not Found error page URL to redirect to a custom HTM file, allowing the vast majority of CGI vulnerability scanner failure. 其实原因很简单，大多数CGI扫描器在编写时为了方便，都是通过查看返回页面的HTTP代码来判断漏洞是否存在的，例如，著名的IDQ漏洞一般都是通过取 1.idq来检验，如果返回HTTP200，就认为是有这个漏洞，反之如果返回HTTP404就认为没有，如果你通过URL将HTTP404出错信息重定向到HTTP404.htm文件，那么所有的扫描无论存不存在漏洞都会返回HTTP200，90%的CGI扫描器会认为你什么漏洞都有，结果反而掩盖了你真正的漏洞，让入侵者茫然无处下手（武侠小说中常说全身漏洞反而无懈可击，难道说的就是这个境界？）不过从个人角度来说，我还是认为扎扎实实做好安全设置比这样的小技巧重要的多。 It is actually quite simple, most CGI scanners in order to facilitate the time of writing, see back page through the HTTP code to determine whether vulnerabilities exist, for example, are generally known by IDQ take 1.idq vulnerability to test, if Back HTTP200, believes there is a loophole, and vice versa if the back HTTP404 see no, if you will HTTP404 error message via the URL redirected to HTTP404.htm file, then scan all the loopholes will either not exist back HTTP200, 90% of What CGI vulnerability scanner will think you have a result, it obscures your real vulnerability, so that an intruder at a loss no place to start (martial arts often say loopholes but perfect body, we say is this realm?) but from a personal perspective said, I still think that a solid job security settings so that the tips than the more important.
最后，为了保险起见，你可以使用IIS的备份功能，将刚刚的设定全部备份下来，这样就可以随时恢复IIS的安全配置。 Finally, to be safe, you can use the IIS backup, full backup will just set down, so you can always restore the IIS security configuration. 还有，如果你怕IIS负荷过高导致服务器满负荷死机，也可以在性能中打开CPU限制，例如将IIS的最大CPU使用率限制在70%。 Also, if you are afraid of IIS server load is too high lead to crashes at full capacity, can also be opened in the performance of CPU-bound, such as IIS, the maximum CPU usage limit of 70%.
3． 3. 账号安全： Account security:
Win2000的账号安全是另一个重点，首先，Win2000的默认安装允许任何用户通过空用户得到系统所有账号/共享列表，这个本来是为了方便局域网用户共享文件的，但是一个远程用户也可以得到你的用户列表并使用暴力法破解用户密码。 Win2000 account security is another priority, first of all, Win2000 the default installation allows any user to get the system through the air all the user accounts / share list, this was originally for the convenience of LAN users to share files, but a remote user can also get your users Act list and the use of violence to crack user passwords. 很多朋友都知道可以通过更改注册表Local_Machine\System\CurrentControlSet\Control\LSA-RestrictAnonymous Many of my friends know that you can change the registry Local_Machine \ System \ CurrentControlSet \ Control \ LSA-RestrictAnonymous
= =
1来禁止139空连接，实际上win2000的本地安全策略（如果是域服务器就是在域服务器安全和域安全策略中）就有这样的选项RestrictAnonymous（匿名连接的额外限制），这个选项有三个值： 1 139 to prohibit air connection, in fact, the local security policy win2000 (if it is the domain server is the domain server security and domain security policy) has such an option RestrictAnonymous (Additional restrictions for anonymous connections), this option has three value:
0：None. Rely on default permissions（无，取决于默认的权限） 0: None. Rely on default permissions (no, depending on the default permissions)
1：Do not allow enumeration of SAM accounts and 1: Do not allow enumeration of SAM accounts and
shares（不允许枚举SAM帐号和共享） shares (do not allow enumeration of SAM accounts and shares)
2：No access without explicit anonymous 2: No access without explicit anonymous
permissions（没有显式匿名权限就不允许访问） permissions (without explicit anonymous permissions allow access)
0这个值是系统默认的，什么限制都没有，远程用户可以知道你机器上所有的账号、组信息、共享目录、网络传输列表(NetServerTransportEnum等等，对服务器来说这样的设置非常危险。 0 This value is the default, what are the limitations are not, the remote user can know all the accounts on your machine, group information, shared directory, network transmission list (NetServerTransportEnum so, the server is set up so very dangerous.
1这个值是只允许非NULL用户存取SAM账号信息和共享信息。 1 This value is non-NULL only allowed users to access the SAM account information and share information.
2这个值是在win2000中才支持的，需要注意的是，如果你一旦使用了这个值，你的共享估计就全部完蛋了，所以我推荐你还是设为1比较好。 2 This value is only supported in win2000, to note that if you use this value if your share is estimated on all finished, so I recommend that you set to 1 or better.
好了，入侵者现在没有办法拿到我们的用户列表，我们的账户安全了……慢着，至少还有一个账户是可以跑密码的，这就是系统内建的administrator，怎么办？ Well, now there is no way to get the intruder to our users list, account security of our ... ... Hold on, at least one account password can be run, which is built into the system administrator, how do? 我改改改，在计算机管理->用户账号中右击administrator然后改名，改成什么随便你，只要能记得就行了。 I changed change to change, in Computer Management -> right-click the administrator user account and then changed its name, just change what you, as long as I remember on the line.
不对不对，我都已经改了用户名了，怎么还是有人跑我管理员的密码？ No no, I have changed the user name, and how people still run my administrator password? 幸好我的密码够长，但是这也不是办法呀？ Fortunately, my password is long enough, but this is not the answer you? 嗯，那肯定是在本地或者Terminal Ah, that was certainly in local or Terminal
Service的登录界面看到的，好吧，我们再来把HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\winlogon项中的Don't Service of the login screen to see, well, let the HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ CurrentVersion \ winlogon entry in the Don't
Display Last User Name串数据改成1，这样系统不会自动显示上次的登录用户名。 Display Last User Name string data into one, so the system does not automatically display the last login user name.
将服务器注册表HKEY_LOCAL_ MACHINE\SOFTWARE\Microsoft\ The server registry HKEY_LOCAL_ MACHINE \ SOFTWARE \ Microsoft \
WindowsNT\CurrentVersion\Winlogon项中的Don't Display Last WindowsNT \ CurrentVersion \ Winlogon key in the Don't Display Last
User Name串数据修改为1，隐藏上次登陆控制台的用户名。 User Name string data was revised to 1 to hide the last login console user name. （哇，世界清静了） (Wow, world quiet)
5． 5. 安全日志：我遇到过这样的情况，一台主机被别人入侵了，系统管理员请我去追查凶手，我登录进去一看：安全日志是空的，倒，请记住：Win2000的默认安装是不开任何安全审核的！ Security Log: I encountered such a situation, a host intrusion by others, the system administrator asked me to track down the murderer, I logged into a look: The Security log is empty, down, remember: Win2000 the default installation do not open any security audit! 那么请你到本地安全策略->审核策略中打开相应的审核，推荐的审核是： So please you to the local security policy -> Audit Policy to open the corresponding audit, the audit is recommended:
账户管理成功失败 Account management success or failure
登录事件成功失败 Failed logon events Success
对象访问失败 Object access failure
策略更改成功失败 Change the success or failure strategies
特权使用失败 Privilege to use the failure
系统事件成功失败 System events of success or failure
目录服务访问失败 Directory Service Access Failure
账户登录事件成功失败 Account logon events success or failure
审核项目少的缺点是万一你想看发现没有记录那就一点都没辙；审核项目太多不仅会占用系统资源而且会导致你根本没空去看，这样就失去了审核的意义。 The disadvantage is a small audit project in case you want to see that there is no record of it at all Mozhe; audit project will not only take up too many system resources and cause you did not go empty, thus losing the meaning of the audit.
与之相关的是： Is associated with:
在账户策略->密码策略中设定： In the account policies -> Password policy settings:
密码复杂性要求启用 Enable password complexity requirements
密码长度最小值6位 Minimum password length 6
强制密码历史5次 Enforce password history 5
最长存留期30天 Maximum age of 30 days
在账户策略->账户锁定策略中设定： Strategy in the account -> Account Lockout Policy settings:
账户锁定3次错误登录 3 times the error log account lockout
锁定时间20分钟 Lockout time 20 minutes
复位锁定计数20分钟 Reset lockout count 20 minutes
同样，Terminal Service的安全日志默认也是不开的，我们可以在Terminal Service Configration（远程服务配置）-权限-高级中配置安全审核，一般来说只要记录登录、注销事件就可以了。 Similarly, Terminal Service security log is not open by default, we can Terminal Service Configration (remote service configuration) - Permissions - Advanced to configure security auditing, in general, as long as the record of logon, logoff events on it.
7.目录和文件权限： 7 directory and file permissions:
为了控制好服务器上用户的权限，同时也为了预防以后可能的入侵和溢出，我们还必须非常小心地设置目录和文件的访问权限，NT的访问权限分为：读取、写入、读取及执行、修改、列目录、完全控制。 In order to control the user's permissions on the server, but also to prevent a possible invasion and subsequent overflow, we must be very careful to set the directory and file access permissions, NT access rights are divided into: read, write, read and perform, modify, list directories, full control. 在默认的情况下，大多数的文件夹对所有用户（Everyone这个组）是完全敞开的（Full Control），你需要根据应用的需要进行权限重设。 In case of default, most folders for all users (Everyone in this group) is completely open (Full Control), you need to apply the necessary permissions reset.
在进行权限控制时，请记住以下几个原则： When making access control, keep in mind the following principles:
1>限是累计的：如果一个用户同时属于两个组，那么他就有了这两个组所允许的所有权限； 1> limit is cumulative: if a user belongs to two groups, then he is allowed by these two groups of all authority;
2>拒绝的权限要比允许的权限高（拒绝策略会先执行）如果一个用户属于一个被拒绝访问某个资源的组，那么不管其他的权限设置给他开放了多少权限，他也一定不能访问这个资源。 2> denied permission to access higher than allowed (deny policy will be executed) if a user belongs to a denied access to a resource group, then regardless of other settings to give him permission to open a number of privileges, he must not visit this resource. 所以请非常小心地使用拒绝，任何一个不当的拒绝都有可能造成系统无法正常运行； So please be very careful to use denial, the denial of any improper may have resulted in the system not work properly;
3>文件权限比文件夹权限高（这个不用解释了吧？） 3> file permissions folder permissions than the high (this goes without explanation, right?)
4>利用用户组来进行权限控制是一个成熟的系统管理员必须具有的优良习惯之一； 4> use the user group for access control is a mature system administrator must have a good habit;
5>仅给用户真正需要的权限，权限的最小化原则是安全的重要保障； 5> only really need access to the user, the principle of least privilege is an important guarantee of safety;
8.预防DoS： 8 Prevention DoS:
在注册表HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters中更改以下值可以帮助你防御一定强度的DoS攻击 In the registry HKLM \ SYSTEM \ CurrentControlSet \ Services \ Tcpip \ Parameters, change the following values can help your defense a certain intensity of DoS attacks
SynAttackProtect REG_DWORD 2 SynAttackProtect REG_DWORD 2
EnablePMTUDiscovery REG_DWORD 0 EnablePMTUDiscovery REG_DWORD 0
NoNameReleaseOnDemand REG_DWORD 1 NoNameReleaseOnDemand REG_DWORD 1
EnableDeadGWDetect REG_DWORD 0 EnableDeadGWDetect REG_DWORD 0
KeepAliveTime REG_DWORD 300,000 KeepAliveTime REG_DWORD 300,000
PerformRouterDiscovery REG_DWORD 0 PerformRouterDiscovery REG_DWORD 0
EnableICMPRedirects REG_DWORD 0 EnableICMPRedirects REG_DWORD 0
ICMP 攻击：ICMP的风暴攻击和碎片攻击也是NT主机比较头疼的攻击方法，其实应付的方法也很简单，win2000自带一个Routing & Remote Access工具，这个工具初具路由器的雏形（微软真是的，什么都要做？听说最近又要做防火墙了）在这个工具中，我们可以轻易的定义输入输出包过滤器，例如，设定输入ICMP代码255丢弃就表示丢弃所有的外来ICMP报文（让你炸？我丢、丢、丢） ICMP attack: ICMP storm attack and debris attack is a troublesome NT host attack methods, in fact, very simple method to deal with, win2000 own a Routing & Remote Access tool, which router begun to take shape (Microsoft really, what have to do? I heard recently to do a firewall) in this tool, we can easily define the input and output packet filters, for example, set the input ICMP code 255 says discard discard all inbound ICMP packets (so you fried? I lost, lost, lost)
四、 需要注意的一些事： Fourth, some of the things to note:
实际上，安全和应用在很多时候是矛盾的，因此，你需要在其中找到平衡点，毕竟服务器是给用户用而不是做OPEN HACK的，如果安全原则妨碍了系统应用，那么这个安全原则也不是一个好的原则。 In fact, security and application in many cases contradictory, and therefore, you need to find a balance in which, after all, the server is to give users do not use OPEN HACK, if the application of safety principles prevent the system, then this principle is not safe A good principle.
网络安全是一项系统工程，它不仅有空间的跨度，还有时间的跨度。 Network security is a systematic project, which spans not only space, there is still time span. 很多朋友（包括部分系统管理员）认为进行了安全配置的主机就是安全的，其实这其中有个误区：我们只能说一台主机在一定的情况一定的时间上是安全的，随着网络结构的变化、新的漏洞的发现，管理员/用户的操作，主机的安全状况是随时随地变化着的，只有让安全意识和安全制度贯穿整个过程才能做到真正的安全。 Many of my friends (including part of the system administrator) that the security configuration for a host that is safe, in fact, of which there is a misunderstanding: we can only say that a host in a certain situation a certain period of time is safe, as the network structure changes, new vulnerabilities are discovered, the administrator / user operation, the host of the security situation is changing at any time, and only allow the security awareness and security system throughout the entire process in order to achieve real security.
提高IIS 5.0网站伺服器的执行效率的八种方法 IIS 5.0 Web server to improve the efficiency of the eight methods
以下是提高IIS 5.0网站伺服器的执行效率的八种方法： The following IIS 5.0 is to improve the efficiency of the web server eight methods:
1. 启用HTTP的持续作用可以改善15~20%的执行效率。 1 to enable the continued role of HTTP can be improved 15 to 20% efficiency.
2. 不启用记录可以改善5~8%的执行效率。 (2) does not enable logging can be improved 5 to 8% efficiency.
3. 使用[独立] 的处理程序会损失20%的执行效率。 3 Use the [independent] of the process will lose 20% efficiency.
4. 增加快取记忆体的保存档案数量，可提高Active Server Pages之效能。 4 increase the cache memory to save the file number, can improve the performance of Active Server Pages.
5. 勿使用CGI程式。 5 Do not use the CGI program.
6. 增加IIS 5.0电脑CPU数量。 6 increase in the number of IIS 5.0 computer CPU.
7. 勿启用ASP侦错功能。 7 Do not enable ASP debugging functionality.
8. 静态网页采用HTTP 压缩，大约可以减少20%的传输量。 8 static pages using HTTP compression, approximately 20% reduction in throughput.
简单介绍如下。 Briefly as follows.
1、启用HTTP的持续作用 1, to enable the continued role of the HTTP
启用HTTP的持续作用（Keep-Alive）时，IIS与浏览器的连线不会断线，可以改善执行效率，直到浏览器关闭时连线才会断线。 HTTP enabled the continued role of (Keep-Alive) when, IIS and the browser will not break the connection, you can improve the efficiency, until the browser closes the connection will be disconnected when the. 因为维持「Keep-Alive」状态时，於每次用户端请求时都不须重新建立一个新的连接，所以将改善伺服器的效率。 Because the maintenance of "Keep-Alive" state, in each time the client requests do not have to re-establish a new connection, it will improve the efficiency of the server.
此功能为HTTP 1.1预设的功能，HTTP 1.0加上Keep-Alive This function is the default HTTP 1.1 functionality, HTTP 1.0 Keep-Alive with
header也可以提供HTTP的持续作用功能。 HTTP header can also provide the continuing role of function.
2、启用HTTP的持续作用可以改善15~20%的执行效率。 2, enable the continued role of HTTP can be improved 15 to 20% efficiency.
如何启用HTTP的持续作用呢？ How to enable HTTP sustained effect? 步骤如下： As follows:
在[Internet服务管理员] 中，选取整个IIS电脑、或Web站台，於[内容] 之[主目录] In the [Internet Services Manager], select the IIS computer or Web site, in the [content] [Home]
页，勾选[HTTP的持续作用] 选项。 Page, check the [HTTP continuing role of the] option.
3、不启用记录 3, no logging is enabled
不启用记录可以改善5~8%的执行效率。 Do not enable logging can improve the 5 to 8% efficiency.
如何设定不启用记录呢？ How to set the record does not enable it? 步骤如下： As follows:
在[Internet服务管理员] 中，选取整个IIS电脑、或Web站台，於[内容] 之[主目录]页，不勾选[启用记录] 选项。 In the [Internet Services Manager], select the IIS computer or Web site, in the [content] [Home Directory] page, do not check the [Enable logging] option.
设定非独立的处理程序 Set of non-independent process
使用[独立] 的处理程序会损失20%的执行效率，此处所谓「独立」系指将[主目录]、[虚拟目录] Use the [independent] of the process will lose 20% efficiency, where the so-called "independent" means the [home directory], [virtual directory]
页之应用程式保护选项设定为[高（独立的）] 时。 Page of the Application Protection option is set to [High (independent)] time. 因此[应用程式保护] 设定为[低(IIS处理程序)] So [Application Protection] is set to [Low (IIS process)]
时执行效率较高，设定画面如下： To perform efficient, set the screen as follows:
如何设定非「独立」的处理程序呢？ How to set non-"independent" processing procedures? 步骤如下： As follows:
在[Internet服务管理员] 中，选取整个IIS电脑、Web站台、或应用程式的起始目录。 In the [Internet Services Manager], select the IIS computer, Web site, or the application's home directory. 於[内容] 之 To [content]
[主目录]、[虚拟目录] 页，设定应用程式保护选项为[低(IIS处理程序)] 。 [Home], [Virtual Directory] page, set the application protection options for the [low (IIS process)].
4、调整快取（Cache）记忆体 4, adjusting the cache (Cache) Memory
IIS 5.0将静态的网页资料暂存於快取（Cache）记忆体当中；IIS IIS 5.0 will be a static web page is temporarily stored in cache (Cache) memory of them; IIS
4.0则将静态的网页资料暂存於档案当中。 4.0 will be a static web page is temporarily stored in file them. 调整快取（Cache）记忆体的保存档案数量可以改善执行效率。 Adjust the cache (Cache) memory to save the file number can improve the efficiency.
ASP指令档案执行过後，会在暂存於快取（Cache）记忆体中以提高执行效能。 After the ASP command file execution, will be temporarily stored in the cache (Cache) memory to improve performance. 增加快取记忆体的保存档案数量，可提高Active Server Pages之效能。 Increase the cache memory to save the file number, can improve the performance of Active Server Pages.
可以设定所有在整个IIS电脑、「独立」Web站台、或「独立」应用程式上执行之应用程式的快取记忆体档案数量。 You can set all the IIS computer, "independent" Web site, or "independent" application applications running on the cache memory files.
如何设定快取（Cache）功能呢？ How to set cache (Cache) function? 步骤如下： As follows:
在[Internet服务管理员] In the [Internet Service Manager]
中，选取整个IIS电脑、「独立」Web站台、或「独立」应用程式的起始目录。 , Select the IIS computer, "independent" Web site, or "independent" application's home directory. 於[内容]之[主目录]、[虚拟目录] 页，按下[设定] 按钮时，即可由[处理程序选项] 页设定[指令档快取记忆体] 。 To [content] [home directory], [Virtual Directory] page, click [Settings] button, to the [processing options] page set [script cache].
如何设定快取（Cache）记忆体档案数量呢？ How to set cache (Cache) memory files do? 步骤如下： As follows:
在[Internet服务管理员] 中，选取整个IIS电脑、或Web站台的起始目录。 In the [Internet Services Manager], select the IIS computer or Web site's home directory. 於[内容]之[伺服器扩充程式] 页，按下[设定] 按钮。 To [content] [Server Extensions] page, click [Settings] button.
即可设定快取（Cache）记忆体档案数量。 You can set the cache (Cache) memory files.
5、勿使用CGI程式 5, do not use the CGI program
使用CGI程式时，因为处理程序（Process）须不断地产生与摧毁，造成执行效率不佳。 Use the CGI program, because the handler (Process) should continue to produce and destroyed, resulting in poor efficiency in the implementation.
一般而言，执行效率比较如下： In general, the efficiency is as follows:
静态网页（Static）：100 Static pages (Static): 100
ISAPI：50 ISAPI: 50
ASP：10 ASP: 10
CGI：1 CGI: 1
换句话说，ASP比CGI可能快10倍，因此勿使用CGI程式可以改善IIS的执行效率。 In other words, ASP may be 10 times faster than the CGI, so do not use IIS CGI program can improve the efficiency of the implementation.
以弹性（Flexibility）而言：ASP > CGI > ISAPI > 静态网页（Static）。 The flexibility (Flexibility) is concerned: ASP> CGI> ISAPI> static page (Static).
以安全（Security）而言：ASP（独立） = ISAPI（独立）= CGI > ASP（非独立） = To security (Security) in terms of: ASP (independent) = ISAPI (independent) = CGI> ASP (non-independent) =
ISAPI（非独立）= 静态网页（Static）。 ISAPI (non-independent) = static pages (Static).
6、增加IIS 5.0电脑CPU数量 6, increasing the number of IIS 5.0 computer CPU
根据微软的测试报告，增加IIS 4.0电脑CPU数量，执行效率并不会改善多少；但是增加IIS 5.0电脑CPU数量，执行效率会几乎成正比地提供，换句话说，两颗CPU的IIS 5.0电脑执行效率几乎是一颗CPU电脑的两倍，四颗CPU的IIS 5.0电脑执行效率几乎是一颗CPU电脑的四倍。 According to Microsoft's test report, to increase the number of IIS 4.0 computer CPU, the efficiency will not improve much; but increase the number of IIS 5.0 computer CPU, the efficiency will be almost directly proportional to offer, in other words, two CPU's IIS 5.0 computer to perform efficiency is almost twice the one-CPU computer, four CPU's IIS 5.0 computer to perform a CPU efficiency is almost four times the computer.
IIS 5.0将静态的网页资料暂存於快取（Cache）记忆体当中；IIS IIS 5.0 will be a static web page is temporarily stored in cache (Cache) memory of them; IIS
4.0则将静态的网页资料暂存於档案当中。 4.0 will be a static web page is temporarily stored in file them. 调整快取（Cache）记忆体的保存档案数量可以改善执行效率。 Adjust the cache (Cache) memory to save the file number can improve the efficiency.
7、启用ASP侦错功能 7, enable ASP debugging functionality
勿启用ASP侦错功能可以改善执行效率。 Do not enable ASP debugging functionality can improve the efficiency.
如何勿启用ASP侦错功能呢？ How not to enable ASP debugging functions? 步骤如下： As follows:
於 [Internet服务管理员] 中，选取Web站台、或应用程式的起始目录，按右键选择[内容]，按[主目录]、[虚拟目录] 或[目录] 页，按下[设定] 按钮，选择[应用程式侦错] 页，不勾选[启用ASP伺服器端指令侦错]、[启用ASP用户端指令侦错] 选项。 In the [Internet Services Manager], select the Web site, or the application's home directory, right click select [Properties], press [home directory], [virtual directory] or [directory] page, click [Settings] button, select [Application Debugging] page, do not check the [Enable ASP server-side script debugging], [Enable ASP client-side script debugging] option.
8、静态网页采用HTTP 压缩 8, static pages using HTTP compression
静态网页采用HTTP 压缩，大约可以减少20%的传输量。 Static pages using HTTP compression, approximately 20% reduction in throughput.
HTTP压缩功能启用或关闭，系针对整台IIS伺服器来设定。 HTTP compression is turned on or off, the Department for the entire IIS server to configure.
用户端使用IE 5.0浏览器连线到已经启用HTTP压缩IIS 5.0之Web伺服器，才有HTTP压缩功能。 Clients use the IE 5.0 browser to connect to IIS 5.0 HTTP Compression is enabled the Web server, HTTP compression only.
如何启用HTTP压缩功能呢？ How to enable HTTP compression function? 步骤如下： As follows:
若要启用HTTP压缩功能，方法为在[Internet服务管理员] 中，选取电脑之[内容]，於[主要内容] To enable HTTP compression method in [Internet Services Manager], select the computer's [content] in [main content]
之下选取[WWW服务]。 Selected under [WWW service]. 然後按一下[编辑] 按钮，於[服务] 页上，选取[压缩静态档案] 可以压缩静态档案，不选取[压缩应用程式档案] 。 Then click [Edit] button on the [Services] page, select the [compress static files] can compress static files, do not select [compress application files].
动态产生的内容档案（压缩应用程式档案）也可以压缩，但是须耗费额外CPU处理时间，若% Processor Dynamically generated content files (compressed application files) can also be compressed, but the extra CPU time is spent, if the% Processor
Time已经百分之八十或更多时，建议不要压缩。 Time has eighty percent or more, it is recommended not to compress.
Tidak ada komentar:
Posting Komentar