User manual MACROMEDIA BREEZE-SECURITY

[. . . ] THIS WARRANTY PROVIDES YOU WITH SPECIFIC LEGAL RIGHTS. THERE MAY BE OTHER RIGHTS THAT YOU MAY HAVE WHICH VARY FROM STATE TO STATE. This manual may not be copied, photocopied, reproduced, translated, or converted to any electronic or machine-readable form in whole or in part without prior written approval of Macromedia, Inc. First Edition: January 2004 Macromedia, Inc. [. . . ] The built-in web server is shipped with a very restrictive configuration which prohibits other web-based services from running on the same machine. Also, because of its architecture, Breeze is not susceptible to exploits that have plagued other web servers such as buffer overruns, etc. This makes Breeze a very secure environment in which to host content. Database Server Security Whether or not you are hosting your database on the same server as Breeze, you must make sure that your database is secure. Computers hosting a database should be in a physically secure location. Databases should be installed in the secure zone of your corporate intranet and never directly connected to the Internet. Back up all data regularly and store copies in a secure off-site location. The Microsoft security web site contains information that applies to both securing SQL Server 2000 and the Breeze built-in database: www. microsoft. com/sql/techinfo/administration/ 2000/security/ The following link provides a good starting point to making sure that your database is secure: www. microsoft. com/sql/techinfo/administration/2000/security/securingsqlserver. asp Note that Macromedia Breeze does not support Windows Authentication Mode. In addition, if you are running the Breeze built-in database, you should note that the Breeze built-in database uses `breeze' as the password by default. It is highly recommended that you change this password. To change the password, type the following at the command line: osql -E -Q "sp_password @new='{new_password}', @loginame='sa'" where {new_password} is a strong password. Solutions for a Secure Infrastructure Most Breeze configurations will fall into one of two configurations: · A single server configuration · A multiple server configuration. This section discusses both setups and they provide examples on how to secure these environments. Security Levels 7 Single Server Configuration The easiest solution for a dedicated, single-server Breeze system is to block all ports on the Breeze box except 80, 1935 (and 443 for SSL-enabled servers). If the Windows server is carefully updated by your IT department with the latest Microsoft security patches, a software firewall can easily be configured to enable application security. An external hardware firewall appliance can provide an extra layer of protection and also provides additional protection against operating system flaws. Example: Securing a Single Server Configuration Assume that you are setting up Breeze Live and Breeze Presentation on a single server. In addition, the database is also to be installed on this server. You want users to be able to access Breeze on the Internet. Securing Breeze on a single server consists of the following steps: 1 Install a firewall 2 3 4 5 Since you are allowing users to access Breeze on the Internet, this means that your Breeze server is open to an attack by hackers. By using a firewall, you can block access to your servers and control what communications occur between the Internet and your servers. Configure your firewall After installing your firewall, you want to configure your firewall as follows: Inbound ports (from the internet): 80, 443, 1935 Outbound ports (to the mail server): 25 Since the database is located on the same server as Breeze, you do not need to open up port 1433 on the firewall. Install Breeze For information on installing Breeze, see the Breeze Installation Guide. Verify that Breeze is working After installing Breeze, you should verify that Breeze is working properly both from the Internet and from your local network. See the Breeze Installation Guide for more information. Test your firewall Now that you have your firewall installed and configured, you should verify that your firewall is working correctly. [. . . ] For example, firewalls are easily tested using a port scanner for validation. Ongoing security checks help guard against user error that can lead to misconfiguration over time. Firewall Your Servers 10 Security and Macromedia Breeze Recommended Security Resources and References The following are sources of information and software which may aid the process of securing your Breeze server(s). · Network Security SANS Institute (www. sans. org) The SANS Institute (System Administration, Networking, and Security) is a cooperative research and education organization comprised of system administrators, security professionals, and network administrators. They have great network security courses, as well as certification in network security. SQL Server Security Microsoft Security Site (www. microsoft. com/sql/techinfo/administration/2000/security/) Microsoft site that provides information and resources on securing SQL Server 2000. [. . . ]