Export (0) Print
Expand All

Plan security for an external secure collaboration environment (Office SharePoint Server)

Office 2007

Updated: April 23, 2009

Applies To: Office SharePoint Server 2007

 

Topic Last Modified: 2009-04-17

In this article:

Security guidance for an external secure environment is targeted to hosting content in an extranet for the purpose of collaborating on content with contributors who do not have general access to your corporate network. This environment allows external partners to participate in a workflow or to collaborate on content together with employees of your organization.

There are several unique recommendations for an external secure collaboration environment. Some of these recommendations might not be practical for all solutions.

External secure collaboration requires Internet-facing servers. You can limit the exposure to traffic from the Internet by protecting back-end servers:

  • Protecting database servers   At a minimum, place a firewall between front-end Web servers and servers that host databases. Some environments dictate that database servers be hosted in an internal network instead of directly in an extranet environment.

  • Protect application servers   At a minimum, protect application servers by requiring Internet Protocol security (IPsec) to secure communication between server farm computers. You can additionally place application servers behind the firewall used to protect database servers. Or, you can introduce an additional firewall between front-end Web servers and application servers.

  • Protect the index role   The index component communicates through a front-end Web server to crawl content in sites. To protect this communication channel, consider configuring a dedicated front-end Web server for use by one or more index servers. This isolates crawling communication to a front-end Web server that is not accessible to users. Additionally, configure Internet Information Services (IIS) to restrict SiteData.asmx (the crawler SOAP service) to allow only the index server (or other crawlers) to access it. Providing a front-end Web server dedicated to content crawling also improves performance by reducing the load on the main front-end Web servers, thereby improving the user experience.

Secure collaboration in an extranet environment relies on secure communication between client computers and the server farm environment. Where appropriate, use Secure Sockets Layer (SSL) to secure communication between client computers and servers. To increase security, consider the following:

  • Require certificates on client computers. SSL can be implemented without requiring client certificates. You can increase the security of external collaboration by requiring certificates on all client computers.

  • Use IPsec. If client computers support IPsec, you can configure IPsec rules to achieve a greater level or granularity of security compared with SSL.

Because external users have access to the network zone, it is important to secure the Central Administration site to block external access and secure internal access:

  • Ensure that the Central Administration site is not hosted on a front-end Web server.

  • Block external access to the Central Administration site. This can be achieved by placing a firewall between front-end Web servers and the server that hosts the Central Administration site.

  • Configure the Central Administration site by using SSL. This ensures that communication from the internal network to the Central Administration site is secured.

Shared Services Provider (SSP) administration sites (one site per SSP) are installed on front-end Web servers. Each SSP administration site is created in a dedicated Web application. The recommendations for securing these sites include:

  • Configure all SSP administration sites by using SSL. This ensures that communication from the internal network to these sites is secured.

  • Configure a policy for the Web application to deny access to all external users.

Use this design checklist together with the checklists in Overview: Plan server farm security (Office SharePoint Server).

Topology

[ ]

Protect back-end servers by placing at least one firewall between front-end Web servers and the application and database servers.

[ ]

Plan a dedicated front-end Web server for crawling content. Do not include this front-end Web server in the end-user front-end Web rotation.

Logical architecture

[ ]

Block access to the Central Administration site and configure SSL for this site.

[ ]

Secure SSP administration sites by configuring these sites with SSL, by hosting these sites in a dedicated Web application, and by configuring a policy to deny external access to these sites.

The following table describes additional hardening recommendations for an external secure collaboration environment.

 

Component Recommendation

Ports

Block external access to the port for the Central Administration site.

IIS

Restrict SiteData.asmx (the crawler SOAP service) to allow only the index server (or other crawlers) to access it.

The following table describes additional recommendations for securing Microsoft Office SharePoint Server 2007 features. These recommendations are appropriate for an external secure collaboration environment.

 

Feature or area Recommendation

Authentication

Use SSL for authenticated users. This does not apply to the anonymous user who is browsing the site.

Authorization

Use security policy to cap external users permission (create deny policies to limit what external users can do).

My Sites

Grant the Create Personal Site right only to contributors who need to create personal sites.

InfoPath Forms Server

Disable the InfoPath Forms Services Web service proxy.

This topic is included in the following downloadable book for easier reading and printing:

See the full list of available books at Downloadable content for Office SharePoint Server 2007

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft