User manual TANDBERG TELEPRESENCE MANAGEMENT SUITE SECURE SERVER CONFIGURATION GUIDE 13.0

[. . . ] Cisco TelePresence Management Suite Secure Server Hardening Windows Server 2003 for Cisco TMS 13. 0 Product Configuration Guide D13148. 08 December 2010 Document revision history Contents References and related documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Pre-install considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Installing baseline configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Open Windows Start > Control Panel > Administrative Tools > Internet Information Services (IIS) Manager 4. Under the name of the local server, expand the Application Pools folder. Right- click TMSNet20AppPool and select Properties. In Application Pool identity select Configurable 8. Browse or enter the tmsserviceuser for User Name and the password of this user. Right-Click the Server in the IIS Manager, go to All Tasks and select Restart IIS to restart the IIS Server Open Windows Start > Control Panel > Administrative Tools > Services Locate the services whose names start with `TMS'. For each of these service do the following: 1. Double-click the service to open the properties window. Select the Log On tab and select This Account. Enter the account details for the tmsserviceuser account Click OK. Right-click the service Select Restart to have the changes take effect. 1. Note: These steps must be repeated after any future Cisco TMS installations or upgrades as the installer will default these services back to the default settings. Remove unnecessary user accounts To remove unnecessary user accounts go to Windows Start > Control Panel > Administrative Tools > Computer Management> System Tools > Local Users and Groups. Disable all accounts except Your renamed Administrator account IWAM_<machinename> ASPNET Sqlserviceuser Your administrator account IUSR_<machine-name> tmsserviceuser At the very least the `Guest' account (disabled by default) should not be active. Under the General tab check the checkbox Account is disabled. Cisco TMS Secure Server Configuration Guide 13. 0 Page 13 of 34 Securing Windows Server 2003 tasks Remove unnecessary windows components To reduce the attack surface of the Cisco TMS server, ensure that Windows Components that are not required by Cisco TMS are not installed. Go to Windows Start > Control Panel >Add or Remove Programs > Add/Remove Windows Components. The following table lists the Windows Components. An N in the Include column indicates that the component should be unchecked in the Windows Components Wizard. To display subcomponents, highlight the Windows Component and click the Details button. Table 2 Windows components Component Accessories and Utilities Application Server Application Server Console ASP. NET Enable network COM+ access Enable network DTC access Internet Information Services Message Queuing Certificate Services E-mail Services Fax Services Indexing Services Internet Explorer Enhanced Security Configuration For administrator groups For all other user groups Management and Monitoring Tools Connection Manager Administration Kit Connection Point Services Network Monitor Tools Simple Network Management Protocol WMI SNMP Provider WMI Windows Installer Provider Networking Services Other Network and File Services Remote Installation Services Remote Storage Security Configuration Wizard Terminal Server Terminal Services Licensing UDDI Services Update Root Certificates Subcomponent Include N N Y Y N Y (see second table for details) N N N N N Y Y N N N Y N N N N N N Y N N N Y Cisco TMS Secure Server Configuration Guide 13. 0 Page 14 of 34 Securing Windows Server 2003 tasks Component Windows Media Services Table 3 IIS components Component Background Intelligent Transfer Service (BITS) Server Extensions Common Files File Transfer Protocol (FTP) Service FrontPage 2002 Server Extensions Internet Information Services Manager Internet Printing NNTP Service SMTP World Wide Web Services Subcomponent Include N Subcomponent Include N Y N N Y N N N Active Server Pages Internet Data Connector Remote Administration (HTML) Remote Desktop Web Connection Serve Side Includes WebDAV Publishing World Wide Web Service Y N N N N N Y Disable unnecessary windows services To reduce the attack surface of the Cisco TMS server, all Windows Services that are not required by Cisco TMS should in general be disabled. Go to Windows Start > Control Panel > Administrative Tools >Services. Disable the services in the following list. Under the General tab, click Properties and select Disabled for Startup type. The status should then be displayed as Disabled under the Status column in the list of Windows services. [. . . ] Note: Disabling this service will cause a Cisco TMS Ticket to be opened and remain open as Cisco TMS sees the service is not running. Cisco TMS Secure Server Configuration Guide 13. 0 Page 32 of 34 Post installation and upgrades Post installation and upgrades Cisco TMS upgrades Due to the Cisco TMS application and its components being removed and reinstalled during upgrades, it is necessary to repeat some of the hardening procedures. Below is a reference to those sections that must be reapplied. Assign file ACLs for Cisco TMS directories Configure Cisco TMS Services to use Service Account Set proper authentication methods Delete unused application mappings Optional - Configure Cisco TMS to use HTTPS Optional - Remove XAPDLL Optional - Remove Polycom Endpoint support Continued monitoring It is important that the server's logs be continually audited to monitor for undesired behavior or attempts to break into the server. The Windows Event Viewer can be used to monitor the security audits enabled, and the IIS logs can be used for additional information regarding access to the website. [. . . ]