Introduction

Before we delve too deeply into the configuration of a bastion host, let s discuss just what is meant by the term bastion host.A bastion is generally defined as a stronghold or area that is exceptionally fortified against an attack. In network terms this could easily apply to most any security appliance.Typically, however, the term is used to describe a general-purpose networking device that has been intentionally hardened against attack because it will be providing some service to an untrusted network. In most cases, the untrusted network will be the Internet, but it could also be an extranet, wireless DMZ, or business-to-business (B2B) network. In short, much like the protective gates of an ancient castle, great effort is expended to secure a network device because you are expecting it to be attacked.The most common examples of a bastion host are an Internet-facing Web server or DNS server.These are servers that, by their nature, are exposed to the Internet and a nearly constant barrage of attacks.

At a high level, this hardening includes applying security patches, configuring logical access controls, and configuring operating system-specific settings to make the system more secure. Obviously, entire volumes could be and have been written to cover the hardening of specific operating systems.Therefore, this chapter provides a high-level overview of the steps that are needed to harden a Microsoft Windows 2000 or 2003 server, explaining the relevant concepts, pointing out any pitfalls or caveats in the process, and providing sources of additional information where...