Review the secure topology design checklists (Windows SharePoint Services)

Applies To: Windows SharePoint Services 3.0

 

Topic Last Modified: 2009-04-15

In this article:

• Server topology design checklist

• Networking topology design checklist

• Logical architecture design checklist

• Operating system design checklist

In Windows SharePoint Services 3.0, successful server hardening depends on a server topology and logical architecture that are designed for targeted isolation and secure communication.

Previous planning articles address topology and logical architecture in depth. This article provides checklists that you can use to ensure that your plans meet the criteria for a secure design.

Use the secure topology design checklists with the following security environments:

• Internal IT hosted

• External secure collaboration

• External anonymous access

Server topology design checklist

Review the following checklist to ensure that your plans meet the criteria for a secure server topology design.

[ ]	The topology incorporates dedicated front-end Web servers.
[ ]	Servers that host the Windows SharePoint Services search role and database server role are protected from direct user access.
[ ]	The SharePoint Central Administration site is hosted on the same server that hosts the Windows SharePoint Services search role.

Networking topology design checklist

Review the following checklist to ensure that your plans meet the criteria for a secure networking topology design.

[ ]	All servers within the farm reside within a single data center and on the same vLAN.
[ ]	Access is allowed through a single point of entry, which is a firewall.
[ ]	For a more secure environment, the farm is separated into three tiers (front-end Web, search, and database), which are separated by routers or firewalls at each vLAN boundary.

Logical architecture design checklist

Review the following checklist to ensure that your plans meet the criteria for a secure logical architecture design.

[ ]	At least one zone in each Web application uses NTLM authentication. This is required for the search account to crawl content within the Web application. For more information, see Plan authentication methods (Windows SharePoint Services).
[ ]	Web applications are implemented by using host names instead of the randomly generated port numbers that are automatically assigned. Do not use Internet Information Services (IIS) host header bindings if the Web application will be hosting host header–based site collections.
[ ]	Consider using separate Web applications for the following circumstances: Your company policy requires process isolation for content and applications. You are implementing sites that integrate with external data sources where the content provided by these data sources is sensitive or requires greater security.
[ ]	In a reverse proxy environment, consider using the default port for the public-facing network while using a nondefault port on your internal network. This can help prevent simple port attacks on your internal network that assume HTTP will always be on port 80.
[ ]	When deploying custom Web Parts, only trustworthy Web Parts are deployed within Web applications that host sensitive or secure content. This protects the sensitive content against intradomain scripting attacks.
[ ]	Separate application pool accounts are used for central administration and for each unique Web application.

Operating system design checklist

Review the following checklist to ensure that your plans meet the criteria for a secure operating system design.

[ ]	The server operating system is configured to use the NTFS file system.
[ ]	Clocks on all servers within the farm are synchronized.

Download this book

This topic is included in the following downloadable book for easier reading and printing:

• Planning and architecture for Windows SharePoint Services 3.0, part 2

• Security for Windows SharePoint Services 3.0

See the full list of available books at Downloadable books for Windows SharePoint Services.