Win2k3 Web Edition - Usage of EFS

I'm trying to secure a co-loc server as much as possible, so I figgured, let me encrypt all the folders with sensitive data, including the folder with website data for IIS

Well it seems IIS does not like this at all and refused to work properly. I'm expecting a different NTFS user account is used for the EFS method

So is there any way to configure/use EFS so that my original idea would work?

Drew
Mon Jan 26 19:03:14 CST 2004

What user context does IIS run in? If you encrypt the files in that user
context things should "just work".
Note that anyone who can run in that user context can decrypt the files.
EFS won't add any security if you're running IIS as localsystem as anyone
with physical access to the server can become administrator and any
administrator can run as localsystem.
--
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.


"RoChess" <anonymous@discussions.microsoft.com> wrote in message
news:A845BF66-9F88-422F-8FD3-FD9F23C94235@microsoft.com...
> I'm trying to secure a co-loc server as much as possible, so I figgured,
let me encrypt all the folders with sensitive data, including the folder
with website data for IIS.
>
> Well it seems IIS does not like this at all and refused to work properly.
I'm expecting a different NTFS user account is used for the EFS method.
>
> So is there any way to configure/use EFS so that my original idea would
work?

anonymous
Tue Jan 27 08:21:08 CST 2004

IIS runs as service indeed, I assume in localsystem context. I did alter the default IIS permission scheme to add more protection. Each website has it's own IUSR_name account that only gives them NTFS access to their own folder with IIS having anonymous access set for that account on each website

So you think, that if I login with each of those IUSR_name accounts and EFS their own folders, that it would work

And you bring up another good point I've never got a good answer on. How does physical access alone give somebody else the means to become administrator? Back in the days on NT4 I've used a util to gain admin access at a client who lost the password, but isn't that all secured now

The only method that I thought was still open, was if a person would reinstall the OS or use another NTFS compatible OS to read the data disc. For that method I thought EFS would be the solution

I guess I'm over paranoid, but the server will eventually store a lot of sensitive information, such as credit cards, etc. so I've been setting this server up as secure as I can. The server itself will be at a data-center with 24/7 armed guards, so I don't have to worry too much about the physical aspect side, but still I've always wanna know the correct answer

So maybe you know :)

Torgeir
Tue Jan 27 14:52:24 CST 2004

RoChess wrote:

> And you bring up another good point I've never got a good answer on.
> How does physical access alone give somebody else the means to become
> administrator? Back in the days on NT4 I've used a util to gain admin
> access at a client who lost the password, but isn't that all secured now?
>

Hi

Unless the computer is a Windows Server 2003 domain controller, you
can use the same util to gain admin access (on a Windows 2000 domain
controller you will need to do some additional steps to be able to
log on as domain admin)...


--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: http://www.microsoft.com/technet/scriptcenter

Drew
Tue Jan 27 17:04:57 CST 2004

Like Torgeir says, that same tool (among other attacks) can make someone
with physical access an administrator. A parallel install will also allow
an attacker to bypass any NTFS ACLs. As would many other tools that can
raw-read the volume.

As long as only IUSR_name accesses the files in that folder, encrypting as
IUSR_name will work. And the data will be unreadable even to an attacker
with physical access.

If you use EFS, *please* back up those users' encryption certificates (and
private keys) and lock them in a safe or something. It may be a good idea
to use an EFS recovery agent, too. Data loss is the number one complaint
about EFS: customers reinstall the OS but don't back up key material first,
then they can't decrypt their old files.

And you're not being paranoid - you're just concerned about security.
That's probably why the bosses pay you. :-)
--
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.


"RoChess" <anonymous@discussions.microsoft.com> wrote in message
news:159012F2-C442-4C76-A119-49F7DB235096@microsoft.com...
> IIS runs as service indeed, I assume in localsystem context. I did alter
the default IIS permission scheme to add more protection. Each website has
it's own IUSR_name account that only gives them NTFS access to their own
folder with IIS having anonymous access set for that account on each
website.
>
> So you think, that if I login with each of those IUSR_name accounts and
EFS their own folders, that it would work?
>
> And you bring up another good point I've never got a good answer on. How
does physical access alone give somebody else the means to become
administrator? Back in the days on NT4 I've used a util to gain admin access
at a client who lost the password, but isn't that all secured now?
>
> The only method that I thought was still open, was if a person would
reinstall the OS or use another NTFS compatible OS to read the data disc.
For that method I thought EFS would be the solution.
>
> I guess I'm over paranoid, but the server will eventually store a lot of
sensitive information, such as credit cards, etc. so I've been setting this
server up as secure as I can. The server itself will be at a data-center
with 24/7 armed guards, so I don't have to worry too much about the physical
aspect side, but still I've always wanna know the correct answer.
>
> So maybe you know :)

anonymous
Wed Jan 28 05:46:07 CST 2004

Like Torgeir says, that same tool (among other attacks) can make someon
with physical access an administrator. A parallel install will also allo
an attacker to bypass any NTFS ACLs. As would many other tools that ca
raw-read the volume

Yeah, that's what I was worried about, for which I thought EFS would be the solution

But that brings up another point, since it will be a remote server, I will not be able to use the highest EFS security mode, in which a floppy or other media that has the key will be used to open the system for usage

So the key will be stored on the system. Do you think that will be secure enough, even if they gain physical access

And trust me on the backup, I usually backup and store such information at multiple secure locations

But that aside, encrypting all the seperate websites with each account looks like a lot of extra workload (and I still don't know if it will make IIS fully function), sure they pay me, but my BOFH genes rebel quick :) And I'm already planning on using a very high database encryption with MySQL. So I'm contemplating not even trying, at least not now

And you're not being paranoid - you're just concerned about security
That's probably why the bosses pay you. :-

Clients, but yeah :-

With Win2k boxes, I used 3rd party encryption utilities, but in this case I'm on a very strict budget, that was one of the reasons Web Edition was used, so I'm trying to squeeze the most out of what comes bundled with it

I was already very dissapointed that the simple firewall was removed from the Web Edition (had another thread for that), which eventually I had to solve with a Tinysoftware firewall solution. Thankfully it is only $79, so that was still doable.

Drew
Wed Jan 28 19:39:27 CST 2004

I can't say what's "secure enough". Really - our lawyers would frown on
that. Before they fired me, of course.
What I can say is that if you're not encrypting in system context, the
weakest point in the files' security is probably the user's password. If
someone can log on as that user, the data is theirs. Using strong passwords
and changing those passwords once in a while is mitigation against that
attack.

You'll have to encrypt each of those dirs in the context of the account that
uses it, unfortunately. On the bright side, once a directory is "marked for
encryption" any new files created in it (not just renamed on the same
volume) will be encrypted in the context of the user who created them - you
only have to do the tedious stuff once. If you're bothered about logging in
as each user, encrypting, logging out, next user, etc., you could cut the
time down by using the cmdline:
runas /u:IUSR_someuser cmd.exe
(prompted for password, then a new instance of cmd.exe is spawned)
(in the new cmd.exe)
cipher /e /a /s:<that_user's_root_directory>
(while you're at it, it might be a good idea to back up the cert/key pair)
cipher /x that_user's_keys.pfx
(and you'll be prompted for password protection of the pfx, blah, blah,
blah)
(you can put the .pfx on some removable media and store it in a safe or
something)


By now you can probably see why I'm not a tech writer by profession. ;-)
--
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.


"RoChess" <anonymous@discussions.microsoft.com> wrote in message
news:2C0188F9-A06F-47F4-B9BB-1EB9EEA1AC4A@microsoft.com...
> Like Torgeir says, that same tool (among other attacks) can make
someone
> with physical access an administrator. A parallel install will also
allow
> an attacker to bypass any NTFS ACLs. As would many other tools that
can
> raw-read the volume.
>
> Yeah, that's what I was worried about, for which I thought EFS would be
the solution.
>
> But that brings up another point, since it will be a remote server, I will
not be able to use the highest EFS security mode, in which a floppy or other
media that has the key will be used to open the system for usage.
>
> So the key will be stored on the system. Do you think that will be secure
enough, even if they gain physical access?
>
> And trust me on the backup, I usually backup and store such information at
multiple secure locations.
>
> But that aside, encrypting all the seperate websites with each account
looks like a lot of extra workload (and I still don't know if it will make
IIS fully function), sure they pay me, but my BOFH genes rebel quick :) And
I'm already planning on using a very high database encryption with MySQL. So
I'm contemplating not even trying, at least not now.
>
>
> And you're not being paranoid - you're just concerned about security.
> That's probably why the bosses pay you. :-)
>
> Clients, but yeah :-)
>
> With Win2k boxes, I used 3rd party encryption utilities, but in this case
I'm on a very strict budget, that was one of the reasons Web Edition was
used, so I'm trying to squeeze the most out of what comes bundled with it.
>
> I was already very dissapointed that the simple firewall was removed from
the Web Edition (had another thread for that), which eventually I had to
solve with a Tinysoftware firewall solution. Thankfully it is only $79, so
that was still doable.

anonymous
Fri Jan 30 05:11:07 CST 2004

I can't say what's "secure enough". Really - our lawyers would frown on that. Before they fired me, of course.

Gotta have some humor in your work :)

What I can say is that if you're not encrypting in system context, the weakest point
in the files' security is probably the user's password.

I mostly use a minimum of 10 characters, consisting out of a wide range of ASCII chars. And I use various levels of passwords, it's funny tho, I got no problem remembering passwords like: 9$q_rK<bCUqB, but I sometimes forget names from people I meet instantly.

By now you can probably see why I'm not a tech writer by profession. ;-)

Actually I've always preffered talking to tech guys direct, seems to get more actual results. And it's like you read my mind, because I was wondering how I would be able to do it in a more automated process, so thanks for the simple example.

And I figgured the EFS system would have the same inherent usage for new files or modifying existing ones as NTFS does when inside the same user context. I do have to make special note on it in my logs, because in the past I've had problems where I copied websites direct with explorer via RDP, which messed up the ACLs, and the same solution for that will not work if EFS is in play. Always hate it when a client has no problem, then a year down the road you have to do maintenance and you forget these little details, they can cost a lot of time, I rather spend doing something else :o)

I do have to be very cautious now, because I'm happy to report the server is enroute to it's co-loc destination, so changes will have to be double checked before I apply them. I learned that the hard way when I was configuring a firewall and the main rule to block all TCP/UDP traffic got the highest priority by mistake, so I locked myself out of the server and needed NOC support to restore access. Some friends of mine still make fun of that, and I'm at the point where I can laugh along, but boy those are the moments you hit your head against the wall. I'm sure you have your own stories :-)

Ron