Secure Remote Administration

You can use the following three technologies to administer an Application Center cluster remotely:

• Use the Microsoft Management Console (MMC)-based Application Center Administrative client
• Use the Microsoft Internet Explorer 5 Web browser to access the Web-based user interface
• Use Windows 2000 Terminal Services

  NOTE

  ---

  Any form of remote administration assumes that a secure connection from the remote user to the corporate network is in place. In most cases, this connection will either employ direct dial-up access to a modem pool or will use Network and Dial-Up Connections to connect to a remove access server via the Internet. In the case of WANs, some form of Virtual Private Networking (VPN) should be in place. (See the sidebar below.)

VPNs

---

VPN technologies are being widely deployed to implement wide area networking over the Internet backbone.

To get a good foundation of Microsoft's implementation of VPN, you should read the "Windows 2000 Virtual Private Networking Scenario," which is available from TechNet (http://www.microsoft.com/TechNet/win2000/vpnscen.asp).

Another good source of information about VPN technology, from a broader, industry-wide perspective, are Rick Allen's two articles, "The Reality of Building Secure Private Networks, Parts One and Two," which are available at the SecurityPortal Web site (http://securityportal.com/cover/coverstory20000306.html). These articles provide some very good information about the issues related to building secure networks by using VPN technology.

Securing Off-Site Computers

It's important to ensure that remote users adequately secure their computers, in particular portables because they are more vulnerable to theft. (As you may recall, 69 percent of the respondents in the computer crime survey reported portable thefts.)

Use the following checklist as a guideline for implementing security on off-site computers:

• Install a virus detection program, and test for up-to-date virus signatures during logon.
• If the user is gaining access to the corporate network over a DSL/cable connection, require the use of a personal firewall system. Test the remote system when it's connected to the corporate network for possible security weaknesses, such as unnecessary open ports and exposed file shares.
• Install Windows 2000 Professional, with NTFS formatted drives, on off-site computers. This will let the user encrypt sensitive files and directories.
• Disable the Network and Dial-Up Connections Save password option. Passwords stored as plain text in local files are an invitation to disaster, especially if their system is exposed over a DSL/cable connection or Network and Dial-Up is configured on a laptop. To disable this option:
  • Open the Registry editor, and add the REG_DWORD value DisableSavePassword to the HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/RasMan/Parameters key. Set the value of DisableSavePassword to 1.
• Don't make it easy for hackers by providing information about a user or the company. The Windows default setting that remembers the user name of the last person who was on the computer, and displays it the next time CTRL-ALT-DEL is typed, should be disabled. To disable this feature:
  • Open the Registry editor, and navigate to HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon.
  • Choose Edit, Add Value, and then create a new value named DontDisplayLastUserName, of type REG_SZ.
  • Enter 1 as the value for DontDisplayLastUserName.
  • Because Windows also retains and displays the name of the default user on a computer, you may want to disable this as well. Locate the DefaultUserName value in Winlogon, and then delete any user name that Windows assigned during Setup.
• Audit your security policies and configurations for remote users on a regular basis to ensure compliance, and revise these policies and configurations as needed.

The Application Center Administrative Client

The Application Center Administrative client, which you can install on a computer running Windows 2000 Professional, is the preferred method for administering a cluster. The minimum requirements for installing the Administrative client are a computer running:

• Windows 2000 Professional
• Windows 2000 Service Pack 1 (SP1)

  NOTE

  ---

  You can also install the Administrative client on any computer running Windows NT 4.0 that has Service Pack 6 installed.

Provided that you have the authority and can supply the authentication that Application Center requests for certain activities, such as adding/removing members and deploying applications, you have full access to the product feature set via the graphical user interface.

NOTE

---

The Administrative client installation does not include the AC.EXE command-line tool, Health Monitor, or Application Center Events and Performance Logging on the local computer.

The Application Center Web-Based Administrative Client

The Application Center Web-based Administrative client is limited to cluster monitoring features. The default page for the Web-based Administrative client view of the cluster is linked to port 4242 and can be accessed by entering http://servername:4242 in the address area of the browser.

WARNING

---

You should disable for all incoming Internet traffic by locking out port 4242.

The best way to restrict access to the cluster user interface is to set ACLs at the site directory level (Application Center 2000 Administrative Site). This will have some impact on performance because the user interface uses images that are located in the Images directory, which is included in the lockdown. You can also control access to the site by setting IP address and domain name restrictions on Application Center 2000 Administrative Site directory.

Windows 2000 Terminal Services

You can use the Terminal Services thin client to provide remote access to a server desktop, where the client acts as a terminal emulator. Terminal Services can be installed in either application server or remote administration mode. When this service is installed as an application server, you can configure the service to provide remote access to a specific application, such as Application Center.

Terminal Services running in application mode doesn't provide any functional gains over using the Application Center Administrative client on a remote connection, but it does provide an alternative for users who don't have access to a computer running Windows 2000 Professional. The Terminal client can run on a number of hardware devices, including Windows-based terminals. Terminal Services also supports access to a Terminal server by other devices, such as Macintosh computers or UNIX-based workstations, through the use of third-party software.

In remote administration mode, Terminal Services gives a remote user complete control over the server to which he connects. As a matter of security policy, you have to determine whether or not this level of access is really needed to support a cluster.

NOTE

---

Terminal Services provides robust security settings that you can implement for logon and authentication, permissions settings, and encryption.