CLASnet: Security: NT Servers

Any server wishing to connect to a CLASnet network should follow our server connection policy. Those outside our college should consider drafting a similar policy.

This document will discuss version 4.0 of the Windows NT Server product. If you are running an earlier version you should seriously consider upgrading your OS/equipment.

Patch your Operating System

Keep your system as recent as possible. There are a few Denial of Service attacks that could affect you. Service packs are available at www.micrcosoft.com. When you change/add system software to your machine you must re-apply the latest service pack.

Stay Informed

There are many places to find information about Windows NT, here are a few:

NTBugTraq also has an email list you can subscribe to.
Brown University NetSpace Project has a BUGTRAQ email list which is mostly for unix reports but also carries messages about NT.

Monitor your System

Make sure you keep an eye on your event logs at least by using the event viewer. You can also use programs such as dumpel which is found on the NT Resource kit or visit Somarsoft, Inc. and use their DumpEvt program to dump event logs into text files and create a script to monitor the files and notify you by email/pager if there are problems.

Secure Resources

Educate yourself on what is open to everyone and what is not. If you have users that have home directories on the server, you must create a share for each user space. Otherwise, everyone can browse everyone's home directory.

Windows 95 Clients

You must put in a bit more effort with a windows 95 client. Use a logon scripting program such as kixtart, which comes on the NT resource disk or is available at various web sites. You will also find winset.exe a useful program for setting environmental variables on logon.

Here is a sample portion of a kixtart login script:

	;logon script
	$userdir="@lserver\@userid$"

	;set where user home resource is

	IF INGROUP("user")
		GOTO user
	ENDIF

	:user
	shell "\\llc-server\netlogon\winset pinerc=c:\local\pinerc"
	;notice use of winset in the above line to set environment variable pinerc
	use h: /d
	use h: $userdir
	;the above line creates a drive h where the user's home directory is
	settime "@lserver"
	goto end

	:end
	exit

Last updated: Aug 04, 2004 (02:52:36 PM EDT)
URL: http://www.clasnet.ufl.edu/security/nt.shtml