Windows permission settings detailed

We can view the user group and the users under the group through the "Control Panel" - "Administrative Tools" - "Computer Management" - "Users and User Groups". We right click on a directory under an NTFS volume or NTFS volume, select "Properties" - "Security" to set permissions on a volume, or a directory under a volume, we will see the following seven Permissions: Full control, modification, read and run, list of folder directories, read, write, and special permissions. "Full control" is an unrestricted full access to this volume or directory. Status is like the status of Administrators in all groups. With "Full Control" selected, the following five attributes will be automatically selected. "Modify" is like Power users, "Modify" is selected, and the following four attributes will be automatically selected. When any of the following items are not selected, the "Modify" condition will no longer be true. "Read and Run" is any file that allows reading and running under this volume or directory. "Listing Folder Directory" and "Reading" are necessary for "Read and Run". "Listing a folder directory" means that you can only browse subdirectories under the volume or directory, and cannot be read or run. "Read" is the ability to read data from that volume or directory. "Write" is the ability to write data to the volume or directory. The "special" is a breakdown of the above six permissions. Readers can conduct more in-depth research on "special" on their own, and there are not many details here. A simple server setup example operation: Below we have a comprehensive analysis of a WEB server system and its permissions that have just installed the operating system and service software. The server uses Windows 2000 Server and installs SP4 and various patches. The WEB service software uses IIS 5.0 that comes with Windows 2000 and removes all unnecessary mappings. The whole hard disk is divided into four NTFS volumes, the C disk is the system volume, only the system and driver are installed; the D disk is the software volume, all the installed software on the server is in the D disk; the E disk is the WEB program volume, the website The program is in the WWW directory under the volume; the F disk is the website data volume, and all data called by the website system is stored in the WWWDATABASE directory of the volume. Such a classification is still a standard that is more in line with a secure server. I hope that each novice administrator can reasonably classify your server data, which is not only convenient to find, but more importantly, it greatly enhances the security of the server, because we can give each volume or each directory as needed. Set different permissions and minimize losses in the event of a network security incident. Of course, you can also distribute the data of the website on different servers to make it a server group. Each server has a different username and password and provides different services, which is more secure. But those who are willing to do so have a feature -- have money :). Well, get down to business, the database of the server is MS-SQL, the MS-SQL service software SQL2000 is installed in the d:ms-sqlserver2K directory, the SA account is set with a strong enough password, and the SP3 patch is installed. In order to facilitate the web page producer to manage the web page, the website also has an FTP service. The FTP service software uses SERV-U 5.1.0.0 and is installed in the d:ftpserviceserv-u directory. The antivirus software and firewall are Norton Antivirus and BlackICE respectively. The paths are d:nortonAV and d:firewallblackice. The virus database has been upgraded to the latest. The firewall rule base defines only ports 80 and 21 to be open to the public. The content of the website is a forum using the Web 7.0, and the website program is under e:wwwbbs. Careful readers may have noticed that the path to install these service software I did not use the default path or just change the default path of the drive letter, which is also a security need, because a hacker enters your way through certain channels. The server, but did not get administrator privileges, the first thing he will do is to see which services you have open and which software is installed, because he needs to use these to improve his permissions. A hard-to-guess path plus good permission settings will keep him out. I believe that the WEB server configured in this way is enough to withstand most hackers who are not good at learning. The reader may ask again: "This does not use the permission settings at all! I have done all the other safe work, is the permission setting necessary?" Of course! The wise man must have a loss, even if you have perfected the security of the system, you must also know that new security vulnerabilities are constantly being discovered. Instance Attack
Permissions will be your last line of defense! Then let's take a mock attack on this server that has not been set up with any permissions and all use Windows default permissions to see if it is really impregnable. Assume that the domain name of the server external network is http://www.webserver.com, scan it with scanning software and find that it opens the WWW and FTP services, and finds that its service software uses IIS 5.0 and Serv-u 5.1, with some targeting Their overflow tool found invalid, and gave up the idea of ​​direct remote overflow. Open the website page and find that it is using the forum system of the mobile network, so add a /upfile.asp behind its domain name, find a file upload vulnerability, then capture the package, and submit the modified ASP Trojan with NC, prompting the upload success. Successfully got WEBSHELL, opened the ASP Trojan just uploaded, found that MS-SQL, Norton Antivirus and BlackICE are running. It is judged that the firewall has made restrictions and blocked the SQL service port.