Chapter 10: The IAS Server Role

Published: December 31, 2003   |   Updated: April 26, 2006

Overview

This chapter provides recommendations and resources that will help you harden Internet Authentication Service (IAS) servers in your environment that run Microsoft Windows Server 2003 with SP1. IAS is the Microsoft implementation of a Remote Authentication Dial-in User Service (RADIUS) server and proxy that enables centralized management of user authentication, authorization, and accounting. IAS can be used to authenticate users in databases on Windows Server 2003, Windows NT® 4.0, or Windows 2000 domain controllers. IAS also supports a variety of network access servers (NAS), including Routing and Remote Access (RRAS).

The RADIUS hiding mechanism uses the RADIUS shared secret, the Request Authenticator, and the MD5 hashing algorithm to encrypt the User-Password and other attributes, such as Tunnel-Password and MS-CHAP-MPPE-Keys. RFC 2865 notes the potential need to evaluate the threat environment and to determine whether additional security should be used.

The settings in this chapter are configured and applied through Group Policy. A Group Policy object (GPO) that complements the Member Server Baseline Policy (MSBP) can be linked to the appropriate organizational units (OUs) that contain the IAS servers to provide the required security setting changes for this server role. This chapter only discusses those policy settings that vary from the MSBP.

Where possible, these settings are gathered in an incremental Group Policy template that will be applied to the IAS Servers OU. Some of the settings in this chapter cannot be applied through Group Policy. Detailed information about how to configure these settings manually is provided.

The name of the infrastructure server security template for the EC environment is EC-Infrastructure Server.inf. This template provides the settings for the incremental IAS Server template, which in turn is used to create a new GPO that is linked to the IAS Servers OU. Step-by-step instructions are provided in Chapter 2, "Windows Server 2003 Hardening Mechanisms" to help you create the OUs and Group Policies and then import the appropriate security template into each GPO.

For information about settings in the MSBP, see Chapter 4, “The Member Server Baseline Policy.” For information on all default setting configurations, see the companion guide, Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP, which is available at https://go.microsoft.com/fwlink/?LinkId=15159.

Note: The setting prescriptions for the IAS server role were tested for the Enterprise Client environment only. For this reason, the DoS attack information specified for the majority of the other server roles in this guide is not included here.

Audit Policy

Audit policy settings for IAS servers in the EC environment are configured through the MSBP. For more information about the MSBP, see Chapter 4, “The Member Server Baseline Policy." The MSBP settings ensure that all the relevant security audit information is logged on all IAS servers in an organization.

User Rights Assignments

User rights assignments for IAS servers in the EC environment are also configured through the MSBP. For more information about the MSBP, see Chapter 4, “The Member Server Baseline Policy." The MSBP settings ensure that appropriate access to IAS servers is uniformly configured throughout an organization.

Security Options

The security options settings for IAS servers in the EC environment are also configured through the MSBP. For more information about the MSBP, see Chapter 4, “The Member Server Baseline Policy." The MSBP settings ensure that appropriate access to IAS servers is uniformly configured across an enterprise.

Event Log

The event log settings for IAS servers in the EC environment are also configured through the MSBP. For more information about the MSBP, see Chapter 4, “The Member Server Baseline Policy."

Additional Security Settings

Although the security settings that are applied through the MSBP significantly enhance the security of IAS servers, this section discusses some additional considerations. However, the settings in this section cannot be applied through Group Policy, and must therefore be performed manually on all IAS servers.

Securing Well-Known Accounts

Windows Server 2003 with SP1 has a number of built-in user accounts that cannot be deleted, but can be renamed. Two of the most well known built-in accounts in Windows Server 2003 are Guest and Administrator.

By default, the Guest account is disabled on member servers and domain controllers. This configuration should not be changed. Many variations of malicious code use the built-in Administrator account in an initial attempt to compromise a server. Therefore, the built-in Administrator account should be renamed and the description altered to help prevent compromise of remote servers by attackers who try to use this well-known account.

The value of this configuration change has diminished over the past few years since the release of attack tools that specify the security identifier (SID) of the built-in Administrator account to determine its true name and then break into the server. A SID is the value that uniquely identifies each user, group, computer account, and logon session on a network. It is not possible to change the SID of this built-in account. However, your operations groups can easily monitor attempted attacks against this Administrator account if you rename it with a unique name.

To secure well-known accounts on IAS servers
  • Rename the Administrator and Guest accounts, and change their passwords to long and complex values on every domain and server.
  • Use different names and passwords on each server. If the same account names and passwords are used on all domains and servers, an attacker who gains access to one member server will be able to gain access to all others.
  • Change the account descriptions to something other than the defaults to help prevent easy identification of the accounts.
  • Record any changes that you make in a secure location.

Note: The built-in Administrator account can be renamed through Group Policy. This policy setting was not implemented in any of the security templates that are provided with this guide because every environment should choose a unique name for this account. However, the Accounts: Rename administrator account setting can be configured to rename administrator accounts in the EC environment. This policy setting is a part of the Security Options settings section of a GPO.

Securing Service Accounts

Never configure a service to run under the security context of a domain account unless it is unavoidable. If the server is physically compromised, domain account passwords could be easily obtained by dumping LSA secrets. For more information about how to secure service accounts, see The Services and Service Accounts Security Planning Guide at https://go.microsoft.com/fwlink/?LinkId=41311.

Creating the Policy Using SCW

To deploy the necessary security settings, you must use both the Security Configuration Wizard (SCW) and the security templates that are included with the downloadable version of this guide to create a server policy.

When you create your own policy, be sure to skip the "Registry Settings" and “Audit Policy” sections. These settings are provided by the security templates for your chosen environment. This approach is necessary to ensure that the policy elements that are provided by the templates take precedence over those that would be configured by SCW.

You should use a new installation of the operating system to begin your configuration work, which helps ensure that there are no legacy settings or software from previous configurations. If possible, the installation should be on hardware that is similar to the hardware that is used in your deployment to help ensure as much compatibility as possible. The new installation is called a reference computer.

During the server policy creation steps you will probably remove the File server role from the list of detected roles. This role is commonly configured on servers that do not require it and could be considered a security risk. To enable the File server role for servers that require it, you can apply a second policy later in this process.

To create the IAS server policy
  1. Create a new installation of Windows Server 2003 with SP1 on a new reference computer.
  2. Install the Security Configuration Wizard component on the computer through Control Panel, Add/Remove Programs, Add/Remove Windows Components.
  3. Join the computer to the domain, which will apply all security settings from parent OUs.
  4. Install and configure only the mandatory applications that will be on every server that shares this role. Examples include role-specific services, software and management agents, tape backup agents, and antivirus or antispyware utilities.
  5. Launch the SCW GUI, select Create new policy, and point it to the reference computer.
  6. Ensure that the detected server roles are appropriate for your environment, for example the IAS server (RADIUS) role.
  7. Ensure that the detected client features are appropriate for your environment.
  8. Ensure that the detected administrative options are appropriate for your environment.
  9. Ensure that any additional services that are required by your baseline, such as backup agents or antivirus software, are detected.
  10. Decide how to handle unspecified services in your environment. For extra security, you may wish to configure this policy setting to Disable. You should test this configuration before you deploy it to your production network because it may cause problems if your production servers run additional services that are not duplicated on your reference computer.
  11. Ensure the Skip this section checkbox is unchecked in the "Network Security" section, and then click Next. The appropriate ports and applications identified earlier are configured as exceptions for Windows Firewall.
  12. In the "Registry Settings" section, click the Skip this section checkbox and then click Next. These policy settings are imported from the supplied INF file.
  13. In the "Audit Policy" section, click the Skip this section checkbox and then click Next. These policy settings are imported from the supplied INF file.
  14. Include the appropriate security template (for example, EC-IAS Server.inf).
  15. Save the policy with an appropriate name (for example, IAS Server.xml).

Test the Policy Using SCW

After you create and save the policy, Microsoft strongly recommends that you deploy it to your test environment. Ideally, your test servers will have the same hardware and software configuration as your production servers. This approach will allow you to find and fix potential problems, such as the presence of unexpected services that are required by specific hardware devices.

Two options are available to test the policy. You can use the native SCW deployment facilities, or deploy the policies through a GPO.

When you start to author your policies, you should consider using the native SCW deployment facilities. You can use SCW to push a policy to a single server at a time, or use Scwcmd to push the policy to a group of servers. The native deployment method allows you to easily roll back deployed policies from within SCW. This capability can be very useful when you make multiple changes to your policies during the test process.

The policy is tested to ensure that the application of this policy to the target servers will not adversely affect their critical functions. After you apply the configuration changes, you should begin to verify the core functionality of the computer. For example, if the server is configured as a certification authority (CA), ensure that clients can request and obtain certificates, download a certificate revocation list, and so on.

When you are confident in your policy configurations, you can use Scwcmd as shown in the following procedure to convert the policies to GPOs.

For more information about how to test SCW policies, see the Deployment Guide for the Security Configuration Wizard at https://technet2.microsoft.com/WindowsServer/en/Library/5254f8cd-143e-4559-a299-9c723b3669461033.mspx and the Security Configuration Wizard Documentation at https://go.microsoft.com/fwlink/?linkid=43450.

Convert and Deploy the Policy

After you thoroughly test the policy, complete the following steps to convert it into a GPO and deploy it:

  1. At the command prompt, type the following command:

        scwcmd transform /p:<PathToPolicy.xml> /g:<GPODisplayName>
    

    and then press ENTER. For example:Note: The line has been split into multiple lines for readability. However, while trying it out on a system you must enter it as one line without breaks.

    scwcmd transform /p:"C:\Windows\Security\msscw\Policies\
                IAS Server.xml" /g:"IAS Policy"
    

    Note: The information to be entered at the command prompt shows on more than one line here because of display limitations. This information should all be entered on one line.

  2. Use the Group Policy Management Console to link the newly created GPO to the appropriate OU.

Note that if the SCW security policy file contains Windows Firewall settings, Windows Firewall must be active on the local computer for this procedure to complete successfully. To verify that Windows Firewall is active, open Control Panel and then double-click Windows Firewall.

You should now perform a final test to ensure that the GPO applies the desired settings. To complete this procedure, confirm that the appropriate settings wee made and that functionality is not affected.

Summary

This chapter explained the settings that can be used to harden IAS servers that run Windows Server 2003 with SP1 in the Enterprise Client environment that is defined in this guide. These settings may also work in the other environments defined in this guide, but they have not been tested or validated. The settings were configured and applied through a Group Policy object (GPO) that was designed to complement the MSBP. GPOs can be linked to the appropriate organizational units (OUs) that contain the IAS servers in your organization to provide additional security.

More Information

The following links provide additional information about topics that relate to hardening IAS servers that run Windows Server 2003 with SP1.