How secure will be this configuration?

Ok, ive received this configuration:

- An application needs to run on a windows server (2000 or 2003) and it needs to run with a logged administrator user .
- That application cant run as a service and it has a "window".
- That application will be in tcp listening mode on a port choosed by me.
- No, i cant change the application to run as a service. I didnt write it nor my client. My client bought that sh*t and the vendor have no idea how to run it as a service. The client must run as is (as a foreground application, with an admin user logged)
- Yes, it must be run as an admin. Ive tried to run it if several "less power" user configuration, but it didnt work. Ive ask the vendor, but only answer that i received was "it must run as an administrator". Why? "because..."
- I must install it and run on the best way i can.

What i did:
- ive disabled all shares, including administrative ones. That machine does not belong to a domain and the only port that is open (aparently) is that i choose to the application.
- Only local logon is allowed. Only administrators can log on on the server.
- Ive Disabled autorun for everything. Ive disabled usb ports too.
- Machine boots, autolog on the admin, starts the application and lock the server. (yes, the user wants that the process to be automatic - if you have a better idea to do that without human intervention, please post here)
- To shutdown the application: the application has a remote interface (thru that port too) that allow the application administration to shutdown it. When the application shutdowns, it runs AFTER a script the shutdowns the server too.

My concerns:
- how safe it is now?
- what i can do to enhance the security? (dont suggest to change the application - i cant do that)

Any analysis and/or suggestions will be wellcome.

I would use 2003.

Does the app have to be "The Administrator" or a member of the admin group??

MLF

Don't you just hate vendors like that?

The application needs a windows server but they have no clue how to run it as a service. They're also clueless as to what privileges the application needs. Sigh, makes you wonder what kind of programmers they've hired... Makes you wonder about the ports the app is opening too...

It sounds like how I would setup a server for crap like that.
One thing though.. physical access?

Quote:

---

Does the app have to be "The Administrator" or a member of the admin group??

---

the application must have admin priviledges. I suspect that it uses some kind of API that demands that. But unfortunetaly, vendor doesnt know (or doesnt want to reveal) which API is causing that. I did some kind of digging on objects and parts were written in VC, parts in VB and parts in Delphi :) Go figure if they didnt steal part of application from other companies.
Anyway, i dont want to go further since my client is paying to secure the environment and not to do reverse engineering on tha cr*p.

Quote:

---

Makes you wonder about the ports the app is opening too...

---

i did some scans on the server using several tools and it looks to open only the port that ive choose. However, i will lock all other ports anyway, since it can trigger some malware after i leave my client : :cool: - but its kinda useless doing that since the program is running under admin priviledges, so it can undo my "locks". Its the best that i can do without a external firewall.

Quote:

---

One thing though.. physical access?

---

rofl. The server is located in the middle of the office. Thats why my concerns about autorun and usb..... and before you suggest, i cant move it either to a safe location. (domain server are there anyway)

Quote:

---

rofl. The server is located in the middle of the office. Thats why my concerns about autorun and usb..... and before you suggest, i cant move it either to a safe location. (domain server are there anyway)

---

Is locking it in a box a viable option? There are some purpose built security box's on the market. Even a home made one would be better than leaving it open.

create an operator account, and lock down the administrator account. Lock down one thing at a time though since you have no idea what the account needs.

cheers,

catch

Quote:

---

create an operator account, and lock down the administrator account. Lock down one thing at a time though since you have no idea what the account needs.

---

already tried. It looks like that the application needs a high priviledge. But i cant expend a lot of time on that because the client wont pay me to do that. BTW, client demands that i install it as the vendor RECOMENDS....

Quote:

---

Is locking it in a box a viable option? There are some purpose built security box's on the market. Even a home made one would be better than leaving it open

---

tks for the idea, but since all other servers (DC include) are in the same situation, "client" doesnt want to put $$$ on that....

anyone can see other "logical vulnerabilities" on that config? on "Physical side" i cant improve more.. except maybe bomb the vendor :)

Quote:

---

already tried. It looks like that the application needs a high priviledge.

---

It can need all the priviledge it wants, so long as it doesn't actually use things like "take ownership", access to specific files, etc it'll work just fine.

Quote:

---

anyone can see other "logical vulnerabilities"

---

Yeah, your signature on that contract.

That aside, why? You don't seem to want or be able to fix them. Unless you make an attempt at implementing least priviledge on the Admin account there is no point in worrying about anything else.

cheers,

catch

Quote:

---

Yeah, your signature on that contract.

That aside, why? You don't seem to want or be able to fix them. Unless you make an attempt at implementing least priviledge on the Admin account there is no point in worrying about anything else.

---

I cant agree more, but i work for the money. My service is "customize" that crap as best as i can. But i cant kick my clients' butt just because i disagree of his security policies :)
On my final report i will report all problems that i see on that config and why i cant fix them.

But i need feedback from you to see "all" problems that i need to put on my report that i will deliver with my bill...

I'd simply state that the limitations of the application make it impossible to determine all liability, so you are accountable for nothing. You did the best you could, but as there are not standards, guidelines, or even best practices for this situation... you cannot be held liable for any security issues.

cheers,

catch

You might want to give utilities such as this one http://www.eltima.com/products/application-as-service/
that wrap programs and run them as a service...

You might also possibly be able to run the app as another user through the scheduler...

These are all rather ugly hack solutions, but then again, so is the app..!


Ammo


PS: Otherwise, a wise man once told me, while asking about a simililar situation "You are phecked, thus place the blame elswhere!"*


*You can search the archives for it!

Sorry cacosapo but it really seems like you are between "a rock and a hard place" or "the devil and the deep blue sea" on this one.

All I can suggest is take your money and run :D or..............

Get in a team of wandering spiders...........you should have a plentiful local supply?..........maybe a team of Sydney Funnel Webs as backup? (you want males, one of the few spiders where the male is larger and more dangerous than the female) What I am basically saying is that without physical security, system security is academic.

Unfortunately you have too many unknowns to solve the equation.

Good luck :)

Is this a situation where you may have over promised and can't deliver?

There is NEVER a reason to create extraneous liabilities for yourself.

Part of your job/responsibility is to level with your client about the realities you have explained to us.

When you manage risk, I don't think it is realistic or smart to sign your name with absolutes.

Sure you can minimize risk which I think you are doing but be careful about absolutes......

What is the application by the way? Is there a database involved (even flat file)?

your are taking this too seriously. Its just a job. I dont know there, but here is pretty common that a client ask me to do some kind of crap, such as "install AD on my 200 employee company using 3 domains and 3 forest because-i-know-that-is-the-best-config". If i cant convice the idiot that is a dumb idea, should i refuse to do the job? No way.
On every job i do my best, give some advice and warnings, send the report and bill. period.
I was just looking for other things that i may use to improve the crap that my client ordered.
No legal problems-- my client is aware that he is in trouble but -- he wants that and i think that i need to do my best, EVEN that the request is foolish.
"client is allways right" -- we use to say here :)

BTW, im trying Ammo solution with the demo provided and aparently is working,

Quote:

---

If i cant convice the idiot that is a dumb idea, should i refuse to do the job? No way.

---

You need better negotiating skills. ;)

cheers,

catch

Quote:

---

You need better negotiating skills.

---

Nope, i need smart clients, but they are in extinction. :)

Ammo' solution looks to work fine, (tks again ammo) but:
a) client doesnt want to pay
b) client is affraid that application will crash because vendor cant guarantee that it will work forever...(man, tks God ihe will pay me good money or i swear that i will shot this guy)

So, i pointed on my report the problems of that solution, (including physical access), and what are the reasons that i cant solve them. Also i advice the client to try to change (with the vendor) the application to allow it to "fit" on best pratices. Ive closed the report and sent the bill.

Tks, guys for your support.
Now, next client

Haha! Client doesn't want to pay!? Man, a single license of that util only costs 80 bucks. This can only mean that you're doing something wrong... dude, you're not charging him enough!!!


Ammo