Server lock down

A newly installed Windows XP machine is pre-configured to listen on several ports with standard services such as RPC and SMB. A Windows 2003 server may be configured to run many more such as IIS and DNS.

An unpatched Windows machine is highly vulnerable to attacks due to the numerous vulnerabilities that have been discovered in these services.

There are three approaches to securing Windows machines.

1. Install the latest Microsoft service packs and patches
   
2. Install a personal firewall
3. Lock down the machine

Of these the third approach is the most important to get the best out of KFSensor and is the focus of this section of the guide.

Service Packs and Patches

Most Microsoft patches are designed to fix problems in services that should be disabled on a KFSensor machine and therefore are a not priority to install. However certain patches fix vulnerabilities in low level components such as the TCP stack and it is advisable to ensure that these patches are applied.

The latest versions of Windows contains a feature called "Windows Update" that can be configured to automatically download and update Windows with new patches.

It is strongly recommended that Windows automatic updates are disabled and Windows Update is configured to manual checking only.

There are several reasons for this.

1. Difficult to believe but true, is the fact the Automatic Windows Update causes the Windows machine to listen on ports that may be vulnerable to attack
2. Automatic patching may change the configuration of the machine and enable services that have been disabled.
3. Automatic patching may disturb or invalidate forensic examination of the KFSensor machine

Personal Firewall

Personal firewalls work best when they are used to block access to vulnerable or poorly configured services.

Provided the system has been patched and locked down it is not essential to run a personal firewall on a KFSensor machine.

If you do run a personal firewall then there are a number of changes to the default configuration that should be made to ensure, that KFSensor can work properly.

The goal should be to allow external access to all ports opened by KFSensor and to allow ICMP traffic.

Windows Firewall

The following assumes that you are using the Windows Firewall in XP SP2 in its default configuration.
Other firewalls need similar changes to their configuration.

1. Go the Control Panel and select Windows FireWall
2. In the General tab, of the Windows Firewall dialog, select 'On (recommended)'
3. In the Exceptions tab; uncheck all check boxes in the Programs and Services list box. N.B. Remote Assistance may be the only one checked and should definitely be unchecked.
4. Press the 'Add Program...' button. You will now need to select the 'Browse' button as the KFSensor server will not be listed.
5. Select C:\Program Files\KeyFocus\KFSensor\bin\kfsnserv.exe and then press open and OK. kfsnserv.exe should now be listed and ticked in Programs and services.
6. In the Advanced tab; select the Security Logging Settings... button. Tick the two Log check boxes and press OK.
7. Select the 'ICMP Settings...' button. It is advised that all the check boxes in the ICMP Settings dialog be checked.
Enabling all of these options will help an attacker to both find the KFSensor machine on the network and give the impression that the machine does not have a firewall enabled.
If not all these settings can be enabled then the most important of these is the echo request setting and that should always be enabled.
8. Press 'OK' twice and the Firewall should be configured to allow KFSensor to work.

Lock down

Locking down a machine involves reconfiguring or disabling services from running, based on the simple and effective principle that if something is turned off it cannot cause trouble.

One of the main tasks of KFSensor is to replace these services with simulated versions that do not suffer vulnerabilities and enable attacks to be detected. If the original services are running then KFSensor will not be able to replace them in this way.

From within KFSensor it is possible to see the system services that are still running. In the ports view, a port will be displayed in blue. This indicates that KFSensor failed to bind to that port.

For a machine dedicated to the use of KFSensor it is advised that all services that listen to ports should be disabled. This will enable KFSensor to be most effective, but may mean that other methods of accessing the machine need to be employed. For example if Windows networking is disabled then an FTP client could be used on the KFSensor machine instead to transfer files to a remote machine.

Finding open ports

There are different ways of finding which ports are open on a machine.
It is recommended that both the KFSensor server and monitor be shut down, before performing these actions to prevent too much information being shown.

From a DOS prompt use the netstat system command. Type:
netstat -ano
This will list the open ports along with the PID of the process that owns them.

More advanced and easier to use utilities are TCPView and fport.
These are available free at http://www.sysinternals.com

Closing services

Closing open ports is usually a case of shutting down and disabling the service that has opened port, but some ports require more work.

To disable a service go to the Windows Control Panel, select 'Administrative Tools', then 'Services'.
Select a service and double-click on it.
Select the 'Stop' button and then change the 'Start up type' to 'Disabled'.

The following details some of the most common services and how disable them.

KF Sensor On-Line Manual Contents