Minimizing Windows Server 2003 network services

1. Introduction

This document is an evolution of the document

 Minimizing Windows network services - Examples with Windows 2000 and Windows XP

published for the first time in September 2002

 http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html

and explains how the same methodology can be applied to minimize network services
of Windows Server 2003 systems.

Windows network services are presented in details in the _Windows network
services internals_ paper, available at

 http://www.hsc.fr/ressources/articles/win_net_srv/


2. Target

The hardening recommendations presented in this document will only be used for
isolated Windows Server 2003 systems (systems that are not part of an Active
Directory domain).

Depending on the target environment, only a subset of the recommendations will
be implemented.

Yet, it is possible to apply all recommendations on hardened systems (such as
servers used in DMZ).

3. Overview of default Windows Server 2003 network services

The netstat command can be used to enumerate running network services on a
default Windows Server 2003 system:

C:\>netstat -ano 

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       680
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:1025           0.0.0.0:0              LISTENING       508
  TCP    0.0.0.0:1026           0.0.0.0:0              LISTENING       992
  TCP    192.70.106.144:139     0.0.0.0:0              LISTENING       4
  UDP    0.0.0.0:445            *:*                                    4
  UDP    0.0.0.0:500            *:*                                    508
  UDP    0.0.0.0:1027           *:*                                    992
  UDP    0.0.0.0:1029           *:*                                    912
  UDP    0.0.0.0:4500           *:*                                    508
  UDP    127.0.0.1:123          *:*                                    992
  UDP    192.70.106.144:123     *:*                                    992
  UDP    192.70.106.144:137     *:*                                    4
  UDP    192.70.106.144:138     *:*                                    4


When the -o netstat option is used, the PID column contains the process
identifier of the process that bound a socket.

The tasklist command displays the translation between process identifiers and
executable names:

C:\>tasklist

Image Name                   PID Session Name        Session#    Mem Usage
========================= ====== ================ =========== ============
System Idle Process            0 Console                    0         16 K
System                         4 Console                    0        212 K
smss.exe                     372 Console                    0        456 K
csrss.exe                    428 Console                    0      3 656 K
winlogon.exe                 452 Console                    0      1 988 K
services.exe                 496 Console                    0      3 052 K
lsass.exe                    508 Console                    0      8 284 K
svchost.exe                  680 Console                    0      2 732 K
svchost.exe                  728 Console                    0      3 748 K
svchost.exe                  912 Console                    0      3 792 K
svchost.exe                  964 Console                    0      1 868 K
svchost.exe                  992 Console                    0     17 352 K
spoolsv.exe                 1220 Console                    0      4 876 K
msdtc.exe                   1248 Console                    0      3 944 K
svchost.exe                 1340 Console                    0      1 748 K
svchost.exe                 1372 Console                    0      1 304 K
dfssvc.exe                  1568 Console                    0      3 116 K
wmiprvse.exe                1932 Console                    0      4 564 K
explorer.exe                1816 Console                    0     17 012 K
ctfmon.exe                   560 Console                    0      2 304 K
msiexec.exe                  204 Console                    0      3 168 K
wpabaln.exe                 1004 Console                    0      2 460 K
cmd.exe                      280 Console                    0      1 468 K
wmiprvse.exe                 276 Console                    0      4 744 K
tasklist.exe                1268 Console                    0      3 244 K



4. TCP and UDP ports used by Windows Server 2003 default network services 

4.1 IPSEC Services (PolicyAgent)

The IPSEC Services service opens two UDP sockets:

 - one UDP socket bound to UDP port 500 (ISAKMP support)
 - one UDP socket bound to UDP port 4500 (NAT-T support)

These two UDP ports appear in netstat's output:

  UDP    0.0.0.0:500            *:*                                    508
  UDP    0.0.0.0:4500           *:*                                    508
                                                                       ^^^

508 corresponds to the PID of lsass.exe (the PolicyAgent service runs inside
the LSA process): 

C:\>tasklist /svc /fi "pid eq 508"

Image Name                   PID Services                                     
========================= ====== =============================================
lsass.exe                    508 PolicyAgent, ProtectedStorage, SamSs                      

Stopping the PolicyAgent service immediately closes the two UDP sockets:

C:\>net stop policyagent
The IPSEC Services service is stopping.
The IPSEC Services service was stopped successfully.


To set the startup mode of the PolicyAgent service to manual instead of
automatic (default configuration), use the following command:

C:\>sc config policyagent start= demand
[SC] ChangeServiceConfig SUCCESS


4.2 Windows Time service (w32time)


The Windows Time service opens one UDP socket bound to UDP port 123 for each
network adapter present on the system, plus the loopback IPv4 address
(127.0.0.1):

  UDP    127.0.0.1:123          *:*                                    992
  UDP    192.70.106.144:123     *:*                                    992
                                                                       ^^^

svchost.exe                  992 Console                    0     17 352 K
^^^^^^^^^^^                  ^^^

992 corresponds to the svchost.exe instance that hosts the w32time service.

Stopping the w32time immediately closes all sockets bound to UDP port 123:

C:\>net stop w32time
The Windows Time service is stopping.
The Windows Time service was stopping successfully.

To set the startup mode of the w32time service to manual instead of
automatic (default configuration), use the following command:

C:\>sc config w32time start= demand
[SC] ChangeServiceConfig SUCCESS


4.3 NetBIOS over TCP/IP driver (NetBT support)

By design, the NetBIOS over TCP/IP driver binds 3 sockets on the IP address of
each network adapter.

These 3 sockets correspond to the 3 NetBIOS over TCP/IP services:
 - 137/UDP : NetBIOS name resolution service
 - 138/UDP : NetBIOS datagram service
 - 139/TCP : NetBIOS session service

In our example, 3 sockets are bound to the network adapter:

  TCP    192.70.106.144:139     0.0.0.0:0              LISTENING       4
  UDP    192.70.106.144:137     *:*                                    4
  UDP    192.70.106.144:138     *:*                                    4
                                                                       ^

4 corresponds to the System process and confirms that these sockets are bound by
the NetBIOS over TCP/IP driver (netbt.sys), running in kernel-mode.

NetBIOS over TCP/IP is not needed if all systems of the environment are running
Windows 2000 or later.

Disabling NetBIOS over TCP/IP support on all network adapters (choose
Disable NetBIOS over TCP/IP in the WINS tab of the network adapter's Advanced
TCP/IP Settings window) closes sockets bound to 137/udp, 138/udp and
139/tcp.


4.4 NetBIOS over TCP/IP driver (raw SMB support)

Starting with Windows 2000, the SMB protocol (Windows protocol behind Windows
resource sharing and remote administration capabilities) can be carried directly
into TCP, using TCP port 445.

Thus, the netbt.sys driver of recent Windows systems (including Windows Server
2003) binds two sockets, one on TCP port 445 and one on UDP port 445.

The purpose of the UDP socket is, to the best of our knowledge, not documented.

These two sockets are bound to all network adapters (0.0.0.0):

  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  UDP    0.0.0.0:445            *:*                                    4


To close these two sockets, it is possible to either:
 - stop the NetBT driver
 - set the SmbDeviceEnabled registry value to 0

The NetBT driver can be stopped with the following command:

C:\>net stop /y srv 

The following services are dependent on the Server service.
Stopping the Server service will also stop these services.

   Distributed File System
   Computer Browser

The Distributed File System service was stopped successfully.

The Computer Browser service is stopping.
The Computer Browser service was stopped successfully.

The Server service is stopping.
The Server service was stopped successfully.

C:\>net stop rdr

The Workstation service is stopping.
The Workstation service was stopped successfully.

The netbt driver can then be stopped with the following command:

C:\>net stop /y netbt

The following services are dependent on the NetBios over Tcpip service.
Stopping the NetBios over Tcpip service will also stop these services.

   TCP/IP NetBIOS Helper

The TCP/IP NetBIOS Helper service was stopped successfully.


The NetBios over Tcpip service was stopped successfully.


Because of services dependencies, if the NetBT driver is disabled, the startup
mode of the following services must be set to manual or disabled:
 - Computer Browser service (Browser)
 - Distributed File System service (Dfs)
 - Server service (lanmanserver)
 - Workstation service (lanmanworkstation)
 - TCP/IP NetBIOS Helper (lmhosts)

To prevent the netbt.sys to be started at the next system startup, its startup
mode must be set to manual:

C:\>sc config netbt start= demand
[SC] ChangeServiceConfig SUCCESS


Startup modes of all services that depend on it must also be modified:

C:\>sc config lmhosts start= demand
[SC] ChangeServiceConfig SUCCESS

C:\>sc config dfs start= demand
[SC] ChangeServiceConfig SUCCESS

C:\>sc config browser start= demand
[SC] ChangeServiceConfig SUCCESS

C:\>sc config lanmanserver start= demand
[SC] ChangeServiceConfig SUCCESS

C:\>sc config lanmanworkstation start= demand
[SC] ChangeServiceConfig SUCCESS

In addition, the Remote Registry service (RemoteRegistry) can be disabled
because it is not possible to remotely access the registry when the server
service is not started:

C:\>sc config remoteregistry start= demand
[SC] ChangeServiceConfig SUCCESS


4.5 DNS Client service (Dnscache)

The Windows Server 2003 DNS Client service is a caching DNS resolver used by
applications that need a DNS resolution service.

When started, the Dnscache service binds a UDP socket to communicate with DNS
servers on UDP port 53.

The UDP socket used by the Dnscache service appears in netstat's output:

  UDP    0.0.0.0:1029           *:*                                    912
                                                                       ^^^

912 corresponds to the svchost.exe instance that hosts the Dnscache service:

C:\>tasklist /svc /fi "pid eq 912"

Image Name                   PID Services                                     
========================= ====== =============================================
svchost.exe                  912 Dhcp, Dnscache                               
                                       ^^^^^^^^

Stopping the Dnscache service closes the dynamic UDP port:

C:\>net stop dnscache
The DNS Client service is stopping.
The DNS Client service was stopped successfully.


4.6 RPC services listening on TCP

Windows Server 2003 LSA runs several RPC services that can be reached via a
dynamic TCP port:

  TCP    0.0.0.0:1025           0.0.0.0:0              LISTENING       508
                                                                       ^^^

As seen earlier, 508 corresponds to the LSA process (lsass.exe):

C:\>tasklist /svc /fi "pid eq 508"

Image Name                   PID Services                                     
========================= ====== =============================================
lsass.exe                    508 ProtectedStorage, SamSs                      


The Task Scheduler service runs several RPC services and also opens a dynamic TCP
port:

  TCP    0.0.0.0:1026           0.0.0.0:0              LISTENING       992

Finally, the MSRPC portmapper and COM SCM, started by the RpcSs service both use
TCP port 135:

  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       680

680 corresponds to the svchost.exe instance that hosts the RpcSs service:

C:\>tasklist /svc /fi "pid eq 680"

Image Name                   PID Services                                     
========================= ====== =============================================
svchost.exe                  680 RpcSs                                        
                                 ^^^^^


In Windows Server 2003, the netsh rpc context can be used to specify that RPC
services listening on TCP ports (ncacn_ip_tcp protocol sequence) should only
bind to a specific network adress.

Using netsh, it is possible to restrict these three RPC services so that they
only bind to the loopback IPv4 address (127.0.0.1):


C:\>netsh -c rpc

netsh rpc>show interfaces

Subnet          Interface       Status    Description

127.0.0.0       127.0.0.1       Enabled   MS TCP Loopback interface

192.70.106.128  192.70.106.144  Disabled  AMD PCNET Family PCI Ethernet Adapter

netsh rpc>show settings
Default

netsh rpc>add 127.0.0.0

netsh rpc>show settings 
Add List
127.0.0.0


After a reboot, the three RPC services only bind to 127.0.0.1, as shown below:

  Proto  Local Address          Foreign Address        State           PID
  TCP    127.0.0.1:135          0.0.0.0:0              LISTENING       740
  TCP    127.0.0.1:1025         0.0.0.0:0              LISTENING       788
  TCP    127.0.0.1:1026         0.0.0.0:0              LISTENING       516


4.7 Setting a port range for dynamic ports used by RPC services 

By default, dynamic (TCP or UDP) ports opened by RPC servers are allocated in
the Windows default range of dynamic ports: 1025-5000.

It is possible to use a dedicated port range for these RPC services, so that it
is is easier to identify running RPC services.

The rpccfg tool, part of Windows Server 2003 Resource Kit tools, can be used to
setup a port range (5050-5070 in the following example): 

C:\>rpccfg /pe 5050-5070
The following ports/port range will be used for Internet ports
        5050-5070

Default port allocation is from Intranet ports 

C:\>rpccfg /d 0
The following ports/port range will be used for Internet ports
        5050-5070

Default port allocation is from Internet ports 


Finally, the complete configuration of the RPC runtime can be displayed with the
/q option of rpccfg:


C:\>rpccfg /q
Admit List
      Subnet             Description
1    127.0.0.0       1  MS TCP Loopback interface


The following ports/port ranges will be used for Internet ports
        5050-5070

Default port allocation is from Internet ports


After a reboot, the three remaining RPC services only bind to 127.0.0.1 and the
two RPC services that previously used dynamic ports from the default range
(1025-5000) now use the first two ports from the range for Internet ports (5050
and 5051):

  Proto  Local Address          Foreign Address        State           PID
  TCP    127.0.0.1:135          0.0.0.0:0              LISTENING       752
  TCP    127.0.0.1:5050         0.0.0.0:0              LISTENING       844
  TCP    127.0.0.1:5051         0.0.0.0:0              LISTENING       516


5. Windows Server 2003 SP1

In Windows Server 2003 SP1, a new netstat option, -b, can be used to directly
display the Windows service or process that open sockets.

The output of the netstat -anb command on a default Windows Server 2003 SP1
system is shown below:

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       1244
  RpcSs
  [svchost.exe]

  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  [System]

  TCP    0.0.0.0:1025           0.0.0.0:0              LISTENING       856
  [lsass.exe]

  TCP    192.70.106.144:139     0.0.0.0:0              LISTENING       4
  [System]

  UDP    0.0.0.0:4500           *:*                                    856
  [lsass.exe]

  UDP    0.0.0.0:500            *:*                                    856
  [lsass.exe]

  UDP    0.0.0.0:445            *:*                                    4
  [System]

  UDP    0.0.0.0:1026           *:*                                    1296
  Dnscache
  [svchost.exe]

  UDP    127.0.0.1:123          *:*                                    1344
  W32Time
  [svchost.exe]

  UDP    192.70.106.144:137     *:*                                    4
  [System]

  UDP    192.70.106.144:123     *:*                                    1344
  W32Time
  [svchost.exe]

  UDP    192.70.106.144:138     *:*                                    4
  [System]


It seems that in Windows Server 2003 SP1, the Task Scheduler service no longer
opens a TCP port for its RPC services. 

Thus, compared to a default Windows Server 2003 system, there is one less
listening TCP socket on a default Windows Server 2003 SP1 system.

Otherwise, opened sockets are the same as the one found on a default Windows
Server 2003 system and the same methodology can be used.

6. Conclusion

Depending on the role and the environment, only a subset or all Windows Server
2003 network services will be minimized.

An isolated Windows Server 2003 system can be configured so that no listening
TCP port appear when scanned remotely with a network scanner.

However, when dealing with network services minimization, the most important
thing is not necessarily to close all ports but instead to determine which
network communications are needed, analyze the risks associated to the network
services and decide which network services are needed, must be hardened,
filtered or disabled.


7. List of TCP and UDP ports used by Windows Server 2003 network services

TCP:
 135/tcp: Remote Procedure Call (RPC) service (RpcSs)
 139/tcp: NetBIOS over TCP/IP driver (netbt.sys)
 445/tcp: NetBIOS over TCP/IP driver (netbt.sys)
 One dynamic TCP port (LSA RPC services): lsass.exe
 One dynamic TCP port (RPC services): Task Scheduler service (schedule)
  -> not in Windows Server 2003 SP1
 
UDP:
 123/udp: Windows Time service (w32time)
 137/udp, 138/udp: NetBIOS over TCP/IP driver (netbt.sys)
 445/udp: NetBIOS over TCP/IP driver (netbt.sys)
 500/udp, 4500/udp: IPSEC Services service (PolicyAgent)
 One dynamic UDP port: DNS Client service (Dnscache)


For further information, see the list of network ports used by Windows systems
found in the #832017 Microsoft knowledge base article:

http://support.microsoft.com/?id=832017

Because the RpcSs service can not be disabled nor the lsass.exe process stopped,
a Windows Server 2003 system will, at a minimum, always have two listening TCP
sockets, that can be bound only to 127.0.0.1 if the rpc subsystem has been
configured explictly with netsh, as shown earlier:

  Proto  Local Address          Foreign Address        State           PID
  TCP    127.0.0.1:135          0.0.0.0:0              LISTENING       740
  TCP    127.0.0.1:5050         0.0.0.0:0              LISTENING       788




$Id: min_w2k3_net_srv.tip,v 1.10 2005/04/07 08:16:18 marchand Exp $