| Back to logs list

Reprinted from 308614111 at 21:20 on November 15, 2009 Reading (loading. ..) Comments (0) Category: Personal Diary
anticipation
were sitting in a chair or sofa, sit up straight, face forward, his arms drooping naturally,五脏排毒最简单有效的方法---值得收藏 - Qzone日志, his hands palms placed on the thigh,Happy New Year - Qzone log, knee joint angle was 90O, two feet shoulder width apart, body muscle relaxation,有驾照的朋侪出去练练本身的倒车程度吧! - Qzone日记, breathing evenly .
Anrou temple
clockwise rotation,coach handbags, a week is a film about doing 32 shooting. This point can be Shufeng Anrou solution table, clear the brain eyesight,coach women shoes, headache.
massage Baihui
Baihui the center point in the head with his left hand or right palm close to Baihui rotation,coach wallet, took a week for a total of 32 shooting to do. Massage can lower blood pressure here, Ning Shen Qing brain.
Anrou Fengchi
face with both hands rubbing the thumb screw bilateral Fengchi, clockwise rotation, a week is a film about doing 32 shooting.
Mount head clear brain
hands fingers naturally separated, with the hypothenar, respectively, from the forehead to the ear massage, running front to back arc as a shoot first, shoot some do 32. Can Shujin network,coach bags, Pinggan Xifeng, lowering blood pressure, clear the brain.
rubbing Quchi Xue
pulls his left hand with his right hand first, has rubbing elbow Quchi Xue, rotating week for a shoot, do a total of 32 shooting. This method can be heat, lower blood pressure.
rubbed off Chest
rubbing his left thumb with his right hand first Neiguan, and then rubbing his right hand with his left hand Neiguan, rubbing in a clockwise direction for a film week,coach outlet online, a total of 32 shooting to do. This method can be comfortable Chest.
blood lead down
respectively left and right thumb rubbing the left and right leg Zusanli,coach purses, rotating shot a week for a total of 32 shooting. This method can be spleen and stomach, blood lead down.
chest transfer gas
patients relax hands down, then shake fist, elbow raised, put shoulders back chest, and finally relax restore.
(high shock)

| Back to logs list

135462 2008 年 11 月 23 日 19:28 Reading (loading. ..) Comments (0) Category: Technology Category
Here I use the example, it will be a standard virtual host.

System: Windows2003

Service: [IIS] [SERV-U] [IMAIL] [SQL SERVER 2000] [php] [MYSQL]

Description: To demonstrate, bound up service, we can screen based on the actual situation, and so reduce

1. WINDOWS local security policy port restrictions

A. For our example, need to open the following ports

outside -> Local 80

outside -> Local 20

outside -> Local 21

outside -> use some of the local PASV Port

outside -> Local 25

outside -> Local 110

outside -> Local 3389

and then follow the specific circumstances, open the SQL SERVER and MYSQL

outside the port -> Local 1433

outside -> Local 3306

B. is open from the inside out and then need to open ports

in accordance with the actual situation, if no mail service, do not open the following two rules

local -> outside the 53 TCP, UDP

local -> external 25

light of specific conditions, if the need to access web pages on the server, try not to open the following ports

local -> external 80

C. In addition to be explicitly allowed to stop,coach handbags, this is the safety rules outside the key

-> local all protocols to prevent

2. User Account

A. renamed the administrator, example to root

B . Cancel all outside root for all users except administrators attribute

Remote Control -> enable remote control and

Terminal Services Configuration Files -> Allow log on to Terminal Server

C. will be renamed as the administrator and change the guest password

D. In addition to the administrator root, IUSER and IWAM and the ASPNET user, but disable all other users, including SQL DEBUG and TERMINAL USER so

3. directory permissions

rights of all letters, all read only

administrators group full access

ystem All rights

to C disk all subdirectories and files inherit the C disk sub-administrator (or user group) and all the permissions of the two permissions SYSTEM

and then make the following changes

C: Program Files Common Files Open Everyone listed in default read and run the file directory permissions to read the three

C: WINDOWS open Everyone listed in default directory to read and run permissions to read the three

C: WINDOWS Temp Open Everyone Modify, Read and Run, listing file directory,coach purses, read,coach outlet online, write permissions

WebShell now in the system directory will not be able to write files. Of course, you can use a more restrictive permission, in the WINDOWS directory to set permissions, respectively. But the more complex, the effect is not obvious.



4. IIS

in IIS 6, the application file types within a corresponding expansion of the type of ISAPI has been removed IDQ, PRINT, and so the script type of risk ,

under IIS 5 in addition to ASP, and we need all types other than ASA deleted.

install URLSCAN

in [DenyExtensions] generally add the following. cer

. cdx

. mdb

. bat

. cmd

. com

. htw

. ida

. idq

. htr

. idc

. shtm

. shtml

. stm

. printer

so intruders can not download. mdb database, this method than the outside number of special characters in the file header by adding the method more thoroughly.

because even if the file header by adding special characters, or can be constructed by encoding the

5. WEB directory permissions

as a virtual host, there will be many independent clients. Safer approach is for each customer to create a Windows user, then the response of the site in the IIS item executed within the IIS anonymous user, binds as the user and his point of directories, permissions for the administrators to change all the permissions

system to establish full authority

individual user (or IUSER) Select Advanced -> Open In addition to full control, Traverse Folder / run the program, made outside ownership of three other permissions

If the server is not much on the site, and there are forums, each forum we can get rid of the upload directory execute permissions for this user, only read and write permissions so that even if an intruder detection of file types to bypass the forum is uploaded webshell can not run.

6. MS SQL SERVER2000

Log Query Analyzer using the system account to run the following script use master

exec sp_dropextendedproc 'xp_cmdshell'

exec sp_dropextendedproc 'xp_dirtree '

exec sp_dropextendedproc' xp_enumgroups'

exec sp_dropextendedproc 'xp_fixeddrives'

exec sp_dropextendedproc' xp_loginconfig '

exec sp_dropextendedproc' xp_enumerrorlogs'

exec sp_dropextendedproc 'xp_getfiledetails'

exec sp_dropextendedproc 'Sp_OACreate'

exec sp_dropextendedproc 'Sp_OADestroy'

exec sp_dropextendedproc 'Sp_OAGetErrorInfo'

exec sp_dropextendedproc 'Sp_OAGetProperty'

exec sp_dropextendedproc 'Sp_OAMethod'

exec sp_dropextendedproc 'Sp_OASetProperty'

exec sp_dropextendedproc 'Sp_OAStop'

exec sp_dropextendedproc 'Xp_regaddmultistring'

exec sp_dropextendedproc 'Xp_regdeletekey'

exec sp_dropextendedproc 'Xp_regdeletevalue'

exec sp_dropextendedproc 'Xp_regenumvalues'

exec sp_dropextendedproc 'Xp_regread'

exec sp_dropextendedproc 'Xp_regremovemultistring'

exec sp_dropextendedproc 'Xp_regwrite'

drop procedure sp_makewebtask

go remove all the dangerous expansion of 7. NET.EXE permission to modify

CMD.EXE and the two permission to modify files to a specific administrator can access, such as in this case, we modified as follows

cmd.exe root user all the privileges of ownership

et.exe root user is

This would prevent unauthorized access to

can also use the example provided comlog program com.exe renamed _com.exe, then replace the com file, so you can record all executed command-line instructions



8.

use ntbackup backup software backup system state, the use of reg.exe critical data backup system,coach bags, such as reg export

LM SOFTWARE ODBC e: backup system odbc.reg / y

to back up the system ODBC

9. antivirus

Here MCAFEE 8i Enterprise Edition Chinese, because this version of the domestic many of the malware and Trojans are able to timely updates.

such as Hai Duong has been able to detect the top of 2006, and can kill other than IMAIL SMTP queue software viruses MIME-encoded file,coach outlet,信阳好吃的地儿！！！！ - Qzone日志, and many people like to install Norton Corporate Edition and Norton Corporate Edition, for WEBSHELL are basically no response. And can not be MIME-encoded files for antivirus.

in MCAFEE, we are also able to add rules to stop the windows directory to create and modify EXE.DLL documents, we have added to the WEB directory software antivirus program once a day,coach women shoes, and open real-time monitoring.

10.

off useless services we generally turn off the following services

Computer Browser

Help and Support

Messenger

Print Spooler

Remote Registry

TCP / IP NetBIOS Helper

for the domain if the server does not control,什么是五大管理职能？ - Qzone日志, we can disable the Workstation

11 . cancel the dangerous components

If the server does not require FSO,Life!, regsvr32 / uc: windows system32 scrrun.dll unregister the component, use regedit to / HKEY_CLASSES_ROOT under

WScript.Network

WScript.Network.1

WScript.Shell

WScript.Shell.1

Shell.Application

Shell.Application.1



key rename or delete these keys is included under the CLSID string

such as {72C24DD5-D70A-438B-8A42-98424B88AFB8}

to / HKEY_CLASSES_ROOT / CLSID name to find the key to these strings

Remove All

12. Audit

Local Security Policy -> Local Policies -> ; audit policy



open the following changes to audit policy success, failure

Audit system events Success, Failure Audit account login events

success, failure

Audit account management Success, Failure