Securing Windows Shares
by h3r3tic
Purpose
The purpose of this tutorial is to protect you against tactics described in RiOtEr's two posts about netbios hacking:
http://www.antionline.com/showthread...hreadid=228798
http://www.antionline.com/showthread...hreadid=228778
and to give you a better sense of security when sharing files on your home or small office network.
This tutorial is mostly geared toward windows XP pro users. You may also want to check out this post by spools.exe before selecting your passwords:
http://www.antionline.com/showthread...229#post683229
Prior to step one
If you are not on a network and don't need to share files then don't. To disable file sharing right click on "My Network Places" and select properties, then right click on your local area connection and select properties. In the properties you will want to uninstall "Client for Microsoft Networks" and "File and Printer Sharing for Microsoft Networks" if they are installed. You also might want to turn on the XP firewall under the advanced tab, although I recommend using an alternative firewall. If you are going to share items, don't turn on the XP firewall, because I cannot get sharing to work with it on. Instead download and install the free firewall from www.zonelabs.com, They have a trusted zone which you can put all the computers on your network in, which makes for ease of configuration for file sharing.
Step one
The first thing you should do for more security is to disable simple file sharing. To do this open up my computer. In my computer go to the tools menu and select folder options. In folder options click on the view tab. The very last option should be "Use simple file sharing(Recommended)", you will want to uncheck that box to enable advanced file sharing. Then click apply and OK and you are done with step one.
Step two
Next you will want to to set a password for your Administrator and Guest accounts and rename them. To do this right click on my computer and select the option "Manage". In the box that pops up under system tools go to "Local Users and Groups". Select the Users folder and right click on the Administrator account and select "Set Password...". Then type in your selected password and click ok. Next, right click on the Administrator account again, select "Rename", and just type in a hard to guess username. Now do the same thing with the Guest account. You will also want to turn off the Guest account. Do not disable it in computer management or your computer will not function properly. Note that you should have the Guest account off not disabled. The difference is that if the Guest account off it disables local logon with that account, whereas when it is disabled it takes away all logon priviledges including network logon. This doesn't matter though when connecting through the network, because it still uses the Guest account whether it is off or on. You can try disabling it if you want to, but don't blame me if your operating system complains. I think that windows has the Guest account turned off by default, to check go to the control panel. Then click on "User Accounts". In user accounts you should see the account you just renamed in grey, and it should say "Guest account is off" under it. If it is like that you are in good shape if not, you should just be able to click on it and it will give you the option to turn it off.
Step three: Sharing files and assigning permissions
Now that you have advanced file sharing turned on and you are secure, you are going to want to share some files. To do this open up my computer and choose a folder you want shared. Right click that folder and select "Sharing and Security...". In the window that pops up go to the sharing tab and select the circle to "Share this folder". Then give your share a name under "Share name:". Next, click on the permissions button near the bottom of teh window. In the window that pops up there should be a list of Groups and users allowed to access that file. Remove all of them except the user you want to be able to access the share. If the user is not in that list do the following: Click the "Add..." button. Then, click on the "Advanced..." button and click the "Find Now" button. From the list that comes up choose the user you want to have access to the share then click OK then click OK on the other window. Now you should have just added the user you want to have access to the shared folder. One other thing to check, go to start>run. At the run prompt type gpedit.msc. In the group policy editor go to Computer Configurations>Windows Settings>Security Settings>Local Policies>User Rights Assignment. In the user rights assignment the first option should be "Access this computer from the network". Double click that and make sure that you remove "Everyone" from that list if it is there. On mine the only entries I have are as follows:
- Administrators
- Backup Operators
- Power Users
- Users
You may be able to remove some of those but you should be ok with how it is.
Concluding statement
I know that this is just a drop in the bucket when it comes to securing your windows box, but at least it is something. In addition to this, you will want to pick up a firewall and anti-virus software. For anti-virus I recommend AVG from Grisoft, it is free and works pretty well. For a free firewall I only have experience with zonealarm, and it wasn't too bad. for a non-free firewall, I recommend McAfee because it won the roundup on the screensavers. Also, FrameWork highly recommends Sygate, followed by, coming in second place, Outpost.I want to here comments and suggestions about this tutorial, so don't hold back.
