【 Weak current College 】 Web server maintenance and security maintenance skills 3---Power By 【 China power house network 】

First, convert the role itself as a potential attacker

Most of the time, we should just stand WEB maintenance perspective through the questions, you may find that the Web Server vulnerabilities. Instead, Let's now to be able to change the angle itself as a potential attacker, proceeding from their roles, think they may use those means, which the Web server's vulnerability to execute an attack, perhaps, we can discover Web servers possible security vulnerability to an earlier step, patch security vulnerabilities, prevent a Trojan or virus attack.

Access from outside the company's own Web server, after you perform the test, and then being simulated attack their site to see what results. This is the security of the WEB, it may be a good idea. If we can leave when the attacker, using scanning tool on the Web server to perform the scan and see whether it exists can be attacked. Some things in our daily may not loosed our attention, however, use of hacker tools commonly used to perform the scan, you will find that some may be their use of the service or vulnerability. If the server is installed, the operating system default install and start some do not have to service; or when the server is configured to start certain services, but subsequently closed without timely, which gave the wrongful attacker an attack. Up to see if the SNMP service, also known as the basic network maintenance agreement. This service in the system after installation, the default is turned on. However, this service can provide the attacker with Server system and detailed information, such as the Web server is using an operating system on the server, open the services and the corresponding ports and more valuable information. The attacker only understand the most basic information, to carry out attacks.

Let's security maintenance personnel, daily time may not be found to the question, however, to be able to use the hacker scan tools a scan, you can find questions. It is necessary to change the perspective, the roles from the attack, think they will adopt the kind of attack. So, we can prevent the "lost" the authorities are not correct, guarantee the security of the Web server.

Second, reasonable access maintenance

Sometimes, on a single server, not only run a Web server, and also run other actions such as FTP servers such as network service. On the same server, using a variety of network services, it may result in service between infection. In other words, the attacker simply attack a service, you can use the relevant skills, fell to another use. Because the attacker's need to break one of these services, you can use this service platform, from internal attacks on other services. But usually, from enterprise content to perform the attack, than outside the enterprise a convenient to perform the attack.

Maybe someone will say, that's not the same service using different server. In fact, for enterprises, can be wasteful. Because from the performance, now the server at the same time deployed WEB service and the FTP service, is totally feasible, performance will not be affected. To this end, the enterprise cost worry that a server will be taken. And now to our security maintenance workers out of a difficult question, two, or even two or more services at the same time deployed on one server, how to ensure their safety, the prevention of infection between each of them?

For example, now on the Web server that runs three services. A traditional WEB services such as; the second is the FTP service; third, OA (Office Automation) service because the service is WEB mode, the Internet or you can directly access the OA servers, so he deployed on this server. Because this server configuration or higher, therefore, run the service, without much difficulty, not affect performance. Now the question is, if the number to guarantee their security, FTP server, Web server and OA-Server security does not affect each other?

Now is Windows2003 Server, in order to achieve this security requirements, the server all hard disks are converted to NTFS partitions. Generally speaking, the NTFS partition is a FAT partition security to high. Use NTFS partition comes with features that reasonable allocation related to them. As for the three-server configuration is not the same maintenance account, but not the same account also had to be on a specific partition and directory access. So, even if a maintenance account disclosure, provided they have enough access to a service of storage space, and not be able to access other services. If the WEB service mount partition D, and the FTP service on the E partition. If FTP account is compromised, attackers use; however, because the FTP account does not have the partition D has the right to read and write, so it's not on the content on the Web server to perform any of the read and write operations. This ensures that its instant fell to the FTP server, or on the Web server have a negative impact.

Although Microsoft's expensive, but the operating system vulnerabilities and more, however, its success on an NTFS partition or not bad performance. On an NTFS partition, you can achieve a high degree of security maintenance, ensure that the relevant service in the security of your data. So the end took Microsoft's 2003 operating system as a server system, without using a Linux system.

3. script security maintenance

Based on past experience, in fact many Web server because the attacked paralysed, because bad script. In particular, the attackers use CGI programs in particular preferences or PHP scripts, use their script or program vulnerabilities, to perform the attack.

Generally, WEB use need to pass some necessaryParameters to be able to access. This parameter can be divided into two categories, one is a trusted parameters, another class is not trustworthy. If the enterprise might be self maintenance of Web servers, not managed. They put the server in the enterprise firewall, to increase Web server security. So generally, comes from enterprise firewall internal parameters are reliable, trustworthy; but in enterprises external parameters, are not trusted. However, it is not to say that the parameters are not trustworthy or that come from outside of the firewall are not Web server parameters. But that, in the Web server design, need to pay attention, the use of these parameters is not trusted, the need to perform the inspection, it cannot be justified; not to come from the internal parameter, no holds barred, embarkation points. This obviously will have on your Web server's security threats. As sometimes, attackers use TELNET to connect to port 80, you can pass to CGL script insecure parameter.

Therefore, in CGI programming or PHP script editing, let's see, must not be so easily accept strangers parameter, don't talk to strangers. In the accept parameter, you must first verify the provided arguments or parameters of its own justification. In the program or script, you can advance to participate in some judgement criteria. When the service period of the opinion that if the supplied parameter is not valid, timely notification of maintenance. This also helps us, as soon as possible that of the attacker, and take the appropriate method.

For script security, see the following questions:

1, in the script or programming, ought not to have any distrust parameters directly saved as session variables. According to the design principle of WEB use, session variable only trust variables. That is, the value in the session variable, WEB services are of the view that it is trustworthy, are thinking of using. The usual design idea is, first configure a temporary variable implementation of storage, and then write a test for the justification of processes or functions, to verify its legitimacy. Only authenticated, this value can be passed on to a session variable. According to the experience, if not experienced painful lessons of WEB maintenance workers may scoff. However, those who have had this lesson, you will especially focus on the legitimacy of the inspection process. After all, a sadderbut a rookie or need to, so much to hear who's recommendation does not suffer.

2. in the absence of adequate when necessary, do not use the script, try to make a basic Web page. In fact, the corporate site with private site has a large, Enterprise sites as long as naive, or require too many rendering. On the one hand, excessive rendering Web site will reduce the speed of the user's site visit; on the other hand, this will also reduce network security performance. Therefore, in the absence of sufficient necessary, do not share the script or program in the rendering of the fancy features of the site.

3, on the script or program implementation to perform continuous trace. In the last resort site has adopted a program or script, you need to regularly irregular on these scripts or programs to perform audits of operations, see its there is suspicion of illegal use.