http___microsoftguru.com.au_hr_tag_forefront-tmg-2010__1.xml
1.1 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 35.2 36.1 37.1 38.1 38.2 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 49.2 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 58.1 59.1 60.1 60.2 61.1 62.1 62.2 62.3 63.1 64.1 65.1 65.2 65.3 66.1 66.2 66.3 66.4 66.5 67.1 68.1 69.1 69.2 69.3 69.4 69.5 70.1 71.1 72.1 74.1 76.1 78.1 78.2 79.1 80.1 82.1 84.1 86.1 87.1 87.2 88.1 89.1 90.1 91.1 92.1 93.1 94.1 94.2 95.1 96.1 96.2 97.1 97.2 98.1 98.2 98.3 99.1 99.2 100.1 101.1 101.2 101.3 102.1 102.2 102.3 102.4 103.1 103.2 103.3 103.4 104.1 104.2 105.1 106.1 107.1 108.1 109.1 110.1 111.1 112.1 112.2 113.1 114.1 114.2 115.1 116.1 116.2 116.3 116.4 117.1 118.1 119.1 119.2 120.1 120.2 121.1 122.1 122.2 123.1 124.1 125.1 126.1 127.1 127.2 128.1 129.1 130.1 130.2 131.1 131.2 132.1 133.1 133.2 134.1 136.1 136.2 138.1 140.1 142.1 144.1 145.1 146.1 148.1 150.1 151.1 151.2 152.1 153.1 153.2 154.1 154.2 154.3 154.4 154.5 155.1 156.1 157.1 157.2 157.3 158.1 158.2 158.3 159.1 159.2 159.3 159.4 160.1 160.2 161.1 161.2 162.1 162.2 163.1 164.1 165.1 166.1 167.1 168.1 169.1 170.1 171.1 172.1 173.1 174.1 175.1 176.1 177.1 178.1 179.1 179.2 180.1 180.2 181.1 182.1 182.2 183.1 184.1 186.1 188.1 189.1 189.2 189.3 190.1 191.1 192.1 193.1 194.1 195.1 196.1 196.2 196.3 196.4 197.1 198.1 199.1 200.1 201.1 202.1 203.1 204.1 205.1 206.1 207.1 208.1 208.2 208.3 208.4 209.1 210.1 211.1 212.1 213.1 214.1 215.1 216.1 217.1 218.1 219.1 220.1 221.1 222.1 223.1 224.1 225.1 225.2 225.3 225.4 225.5 226.1 227.1 228.1 229.1 230.1 230.2 231.1 231.2 232.1 233.1 234.1 235.1 236.1 237.1 238.1 238.2 239.1 239.2 240.1 240.2 240.3 241.1 242.1 243.1
Install and Configure Forefront Identity Manager 2010—Step by Step Systems requirements: - Windows Server 2008 x64 Standard or R2 - SQL 2008 x64 Standard or Enterprise DB Engine +Full Text Search - SQL 2008 x64 SP2 - Windows Power Shell 1.0 or 2.0 - NET 3.5 SP1 - Internet Information Services Role (IIS) - Exchange 2007 or 2010Management Console - Windows SharePoint Services 3.0 SP2 FIM Client Computers: - Windows XP SP2 or Windows 7 SP1 - Microsoft .NET Framework 3.5 SP1 - Microsoft Office Outlook 2007 SP2 - Smart Tag .NET Programmability Support (Available in Office Setup) - Smart Tag .NET Programmability Support (Available in Office Setup>Office Tools) Unsupported Configuration: SharePoint 2010 is NOT supported Prerequisites: - Create an email enabled domain service account to run the FIM Service component. - Create a domain service account to run the FIM Synchronization Service. - Create a FIM Service Management Agent account. - Configure the service accounts that are running the FIM server components - Office SharePoint 3.0 SP2 Web site installed and initialized. - Select the correct identity for the SharePoint Application Pool. - Implement Secure Sockets Layer (SSL) for FIM Portal. - Configure the server running SQL. - Configure the SQL aliases. - Configure the SQL collation settings. - Establish Service Principal Names (SPN) for FIM 2010. To Create Service Account in Active Directory Log on to Admin Server or Domain Controller and Create the following Service Accounts and Security Group Set password and account to never expires. Enable mailbox for FIM service account. To enable the FIM MA to log on locally Log on to FIM Server(s). Click Start>click Administrative Tools>Click Local Security Policy Expand Local Policies\User Rights Assignment. In the policy Allow log on locally, ensure that the FIM MA account is explicitly specified, or add it to one of the groups that is already granted access. Open Server Manager>Local Users and Groups>Add sa-fimservice into Users group. Apply>Ok. Important! - service accounts should not be members of the local administrators group. - The FIM Synchronization Service service account should not be a member of the security groups that are used to control access to FIM Synchronization Service FIMSyncAdmins - Ensure that the Exchange Web Service and IIS default Web site are not both configured to use port 80 - Ensure that a SharePoint Default Web site is installed and initial configuration is completed. - Verify the installation by navigating to http://localhost:80 on the server where you will install the FIM Portal - Select the correct identity for the SharePoint Application Pool To run the SharePoint Application Pool using an account that is located in the domain Start Administrative Tools>SharePoint 3.0 Central Administration Select Operations>Security Configuration> Click Service Accounts Select Web Application Pool, and select Windows SharePoint Services Web Application. Select the SharePoint Application Pool where the FIM Portal will be installed, which by default is SharePoint – 80. Enter the user name and password for the service account that you created in the first step.> Click OK. To Enable Application Pool for Windows Authentication using Kerberos: To learn more about Extended protection visit the KB and Enable the Application Pool to use the service account for Kerberos. To establish the SPNs for the FIM Service: Open Command Prompt in Admin Server or a DC type the following. setspn –S sa-fimservice/FIMPortal.microsoftguru.com.au microsoftguru\sa-fimservice setspn –A HTTP/FIMPortal.microsoftguru.com.au microsoftguru\sa-fimservice setspn –A HTTP/FIMPortal.microsoftguru.com.au FIM FIMPortal.microsoftguru.com.au is the Alias of FIM Server added into host header microsoftguru\sa-fimservice is the account for SharePoint App Pool uses and defined in IIS. microsoftguru\sa-fimservice service account for FIM service if you cannot add SPN using delegation tab. user computer account and service account attribute tab and add SPN. select “Trust this user for delegation to the specified services only”. If the address that the clients use to contact the FIM Portal is not the same as the server FQDN, you have to establish an SPN for HTTP. That is, if you use a CNAME resource record in DNS, have a SharePoint farm, or use NLB, this address must be registered or Internet Explorer cannot use the Kerberos protocol when it contacts the portal. Run the following command: Install .NET and IIS on FIM Server: Install Office SharePoint Services: To implement SSL with a certificate from an existing internal CA. Create a base-64-encoded certificate using this guide “Request and install an Web Server Certificate “ into FIM Server. Bind Web Server Certificate with Sharepoint – 80. IIS Manager>Click Sites> select Sharepoint – 80. Click Bindings, and then click Add. Select https. Select Certificate>Click OK. Remove the HTTP binding. Click SSL Settings, and then check Require SSL. Apply the settings. Click Start, click Administrative Tools, and then click Sharepoint 3.0 Central Administration. Click Operations, and then click Alternate Access Mappings. Click http://FIMservername. Change http://FIMservername to https://FIMservername click OK. Click Start, Run, enter iisreset, and then click OK. Test Office SharePoint is working on Port 443 Ensure that the service accounts used by SQL Server Database and SQL Server Agent are either domain accounts or built-in service accounts To locate databases on different drives Start Microsoft SQL Server Enterprise Manager Right-click the server, and then click Properties. Go to Database settings. Make the necessary adjustments on the Data and Log settings to ensure that the database files are located on a different drive than the operating system. Configure SQL aliases: If you plan to install FIM Service or FIM Synchronization Service on a server running SQL that is using a non default port, you must create a SQL alias for Setup to be able to contact the SQL server. To create a SQL alias for Setup to be able to contact the SQL server Start the SQL Server Configuration Manager. Navigate to SQL Native Client 10.0 Configuration/Aliases. Create a new alias with your server information. You do not have to do the SQL steps if you have a separate SQL server. I am doing it because this is my test environment. Install FIM Server Components: - FIM Synchronization Service - FIM Service - FIM Portal - FIM Password Portal To install the FIM Synchronization Service On the FIM 2010 startup screen, click the Install Synchronization Service link. Run Setup.exe, and then follow the instructions in the installation wizard. To install the FIM Service On the FIM 2010 startup screen, click the Install Service and Portal link. Run Setup.exe, and then follow the instructions in the installation wizard On the Custom Setup page, you are prompted for the applications that you want to install. In the drop-down menu next to FIM Services, click Will be installed on local hard drive. Click Next. On the Configure Common Services page, in the Database Server box, type the name of the server that hosts SQL Server 2008. Click Next. On the Configure Common Services – Configure mail server connection page, in Mail Server, type the name of the server hosting the Exchange Web services. Click Next. On the Configure Common Services – Configure service certificate page, select the option to generate a new self-issued FIM certificate that is used by the Web service to validate communication from the clients, or select a certificate from the certificate store, and then click Next. On the Configure Common Services – Configure the FIM service account page, provide the credentials for the FIM domain service account. In Service e-mail Account, ensure that you type the e-mail address for the FIM service account and not your personal e-mail address. Click Next. On the Configure Common Services – Configure the Forefront Identity Manager synchronization connection, in the Synchronization Server box, type the name of the server that is hosting the FIM Synchronization Service component. In the FIM 2010 Management Agent Account* box, type the domain\account of the FIM MA account. Example: microsoftguru\sa-fimagent . Click Next. In Configure FIM Service and Portal – Configure connection to the FIM Service, type the name of the server or the alias that the clients should use to contact the FIM Service. If you plan to use an alternative name (that is, a CNAME resource record in Domain Name System (DNS)), type the alternative name. If you plan to have several FIM Service servers in a Network Load Balancing (NLB) cluster, type the name of the cluster address. Click Next. On the Configure FIM Service and Portal – Configure security changes configured by setup, to allow clients to contact the Web service interface, select Open ports 5725 and 5726 in firewall. Example: https://localhost Click Next, then click Install. Post-Installation Tasks - Add the FIM Service service account to the FIM Synchronization Service security groups. - Configure the FIM Service service Exchange Server mailbox. - Turn off the SharePoint indexing. - Turn on the Kerberos v5 protocol only. - Install Exchange 2007 and Exchange 2010 Web Service Certificate. Installing the latest update for FIM: Updates for FIM are posted on Microsoft Update. Ensure that you install the latest update from Microsoft Update. - In Windows Server 2008, click Start, and then click Windows Update. - Click Check for updates. Install any new updates for FIM that are available. Add the FIM Service service account to the FIM Synchronization Service security groups - Add the service account used by the FIM Service to the FIMSyncAdmins group. This allows the FIM Service to configure the FIM Synchronization service. If you plan to use the Password Reset feature of FIM 2010, add the service account that the FIM Service uses to the security group FIMSyncPasswordSet. So that the group membership is effective, restart the FIMService service. Configuring the FIM Service service Exchange mailbox The following are best practices for configuring Exchange Server for the FIM Service service account. Configure the service account so that it can accept mail only from internal e-mail addresses. Specifically, the service account mailbox should never be able to receive mail from external SMTP servers. In the Exchange Management Console, select the FIM Service service account sa-fimservice, right click Properties, click Mail Flow Settings, and then click Mail Delivery Restrictions. Select the Require that all senders are authenticated check box. Configure the service account so that it rejects mail messages with sizes greater than 1 MB. Follow the best practice of configuring the Exchange 2007 message size limits. In the Exchange Management Console, select the FIM Service service account sa-fimservice, right click Properties, click Mail Flow Settings, and then click Message Size restriction Configure the service account so that it has a mailbox storage quota of 5 gigabytes (GB). Follow the best practice of configuring the Exchange 2007 mailbox size limits: In the Exchange Management Console, select the FIM Service service account sa-fimservice, right click Properties> Mailbox Settings>Storage Quota Disabling SharePoint indexing It is recommended that you disable SharePoint indexing. There are no documents that need to be indexed, and indexing causes many error log entries and potential performance problems with FIM 2010. To disable SharePoint indexing On the server that hosts the FIM 2010 Portal, click Start>Click All Programs list, Under Administrative Tools, click SharePoint 3.0 Central Administration. On the Central Administration page, click Operations. On the Operations page, under Global Configuration, click Timer job definitions. On the Timer Job Definitions page, click SharePoint Services Search Refresh. On the Edit Timer Job page, click Disable. Activating the Kerberos protocol only We highly recommend that you turn off portal authentication that uses NTLM. The Kerberos protocol is a more secure protocol to use. To activate Kerberos protocol only Open Elevated Command Prompt. Locate C:\inetpub\wwwroot\wss\VirtualDirectories\80 Type notepad Web.config , Locate the element Add requireKerberos=”true” so that it reads Save the Web.config file. Run iisreset from a command prompt. Installing the Exchange 2010 Web Service (EWS) Certificate: If your server running Exchange is using a certificate that is untrusted by the FIM Service, the certificate used by the Exchange server must be added to the local certificate store. To install the Exchange certificate on the FIM Service server Open Internet Explorer. In the address bar, type https://mailserver/EWS/exchange.asmx. Mailserver is the server running Exchange that you specified when you installed the FIM 2010 component. Select Continue to this Web site. In the Security Alert dialog box (where it reads Certificate Error), click View Certificate. In the Certificate dialog box, click Install Certificate. On the Welcome to the Certificate Import Wizard page, click Next. On the Certificate Store page, select Place all certificates in the following store, and then click Browse. Select the Show physical stores check box, navigate to Trusted People\Local Computer, and select this store. Click OK. Click Next. Click Finish to import the certificate. Verifying that the certificate and verify that the EWS can be reached To install the FIM Add-ins and Extensions Close Microsoft Office Outlook if it is running. Depending on the client computer’s architecture, on the FIM 2010 startup screen, click either the Install Add-ins and Extensions, 64 bit or the Install Add-ins and Extensions, 32 bit link. Run setup.exe, and then follow the instructions in the installation wizard. On the Custom Setup page, you are prompted for the applications that you want to install. The component FIM Password and Authentication extension installs the GINA/Credential provider and an ActiveX® control for Internet Explorer. On a 64-bit installation, an additional component is available, FIM Portal Authentication Extensions, that installs a 32-bit ActiveX control for Internet Explorer On the Configure FIM Add-ins and Extensions page, in FIM Portal Server address, type the name or alias of the server that hosts the FIM Portal. Decided whether you plan to contact the FIM Portal using http or https (recommended). In FIM Service service account e-mail address, type the e-mail address in SMTP format—that is, in a format similar to sa-fimservice@microsoftguru.com.au of the FIM Service service account. Do not type the alias or display name of the account. On the Configure FIM Add-ins and Extensions page, in FIM Service Server address, type the name or alias of the server that hosts the FIM Service. If the Service and Portal components are installed on the same server, this will be the same value as on the previous page. On the Configure FIM Add-ins and Extensions page, in the SiteLock box, type all addresses that the users can use to access the FIM Portal. For example, if users can access the server by using both FIMserver and FIMserver.microsoftguru.com.au, than enter FIMserver;fimserver.microsoftguru.com.au in this box. If you have FIM Portal and FIM Password Reset Portal on two different servers, enter both addresses in this box. Click Install. To install the FIM Add-ins and Extensions Language Pack - Log on to a client computer with administrator permissions. - Run Setup.exe, and then follow the instructions in the installation wizard. - On the Microsoft Forefront Identity Manager Client Language Pack Setup page, click Next. - On the End-User License Agreement page, click I accept the terms in the License Agreement, and then click Next. - On the Custom Setup page, select the languages that you want to install, and then click Next. - Click Install. - When the installation is complete, click Finish. View the FIM Add-in for Outlook and Password Reset Extensions in your selected language The following procedures demonstrate how to verify that the FIM Add-in for Outlook is using localization. To view the FIM Add-in for Outlook and Password Reset Extensions in your selected language on Windows XP - Log on to a client computer with administrator permissions. - Click Start, and then click Control Panel. - In Control Panel, click Regional and Language Options. - On the Options tab, under Select an item to match its preferences, or click Customize to choose your own formats, select the language that you want. - On the Languages tab, under Language to be used in menus and dialogs, select the language that you want. - Click the Advanced tab, and under Select a language to match the language version of the non-Unicode programs you want to use:, click the language that you want. Click Apply. - If you are prompted by a message telling you that the required files are already installed on your hard disk, you can click Yes to use these files and skip the process of copying these files from the CD. Otherwise ,you may need the original Windows XP installation media to copy the required files. - Click Yes to restart the Windows XP client. - When the client restarts, log on to the computer. Open Outlook and use the functionality of the FIM Add-in for Outlook. - To view Windows another language, repeat steps 1 through 11. To view the FIM Add-in for Outlook and Password Reset Extensions in the language you want on Windows Vista or Windows 7 Log on to a client computer with administrator permissions. Click Start>Click Control Panel> In Control Panel, click Regional and Language Options. On the Keyboards and Languages tab, under Display language, select the language that you want to install. Click OK.> Click Apply> Click OK. Open Outlook, and use the functionality of the FIM Add-in for Outlook. To view Windows another language, repeat steps 1 through 9. Install Active Directory password reset notification component into a Domain Controller To Configure FIM Active Directory Domain Services follow the screen shoots: To Configure Profile follow the screen shots To configure global catalog server sync follow the screenshot Setup FTP 7.5 on Windows Server 2008 and publish through Forefront TMG 2010 There are two FTP servers that can be used with IIS 7. FTP 7.0 is included with Windows Server® 2008. FTP 7.5 is included with Windows Server® 2008 R2. you can download new FTP 7.5 from FTP for IIS 7.0 (x86) or FTP for IIS 7.0 (x64) depending on server architecture. Requirements - You must be using Windows Server 2008. - You must uninstall FTP 6.0 that is included with Windows Server 2008 before you install FTP 7.5. - IIS 7 must be installed, and IIS Manager should be installed if you are going to manage the FTP server by using the IIS Manager user interface. - You must be an administrator to install the FTP server. - IIS 7 supports a shared configuration environment, which must be disabled on each server in a Web farm before you install FTP server on each node. - Forefront TMG for publishing FTP to extranet To install the FTP service on Windows Server 2008 R2 On the Start menu, click Administrative Tools, and then click Server Manager. In the Server Manager Pane, in the Roles Summary section, click Web Server (IIS). In the Web Server (IIS) section, click Add Role Services. Under Role services, select FTP Publishing Service. This will install the FTP service and the FTP management console. Note that for Windows Server 2008, do not Select FTP publishing service. Download FTP 7.5 and install separately once IIS installation is completed. Click Next, and then click Install. To install FTP 7.5 separately: If you are using Windows Server 2008 R2, download FTP7.5 from Microsoft Download Center and install separately. Double click on ftp7_x86_75, Click Next and Accept Eula, Click Next and continue installation. Click Finish once installation completed. Verify FTP services Started Click on Start Menu, Click on Administrative Tools, Click Services Check Microsoft FTP Services and IIS Admin Services Started and Set Start-up type Automatic Click on Start Menu, Click on Administrative Tools, Click Event Viewer, Expand Windows Logs, Click on Setup As a best practice Check IIS setup completed with no error To Add FTP Site from the IIS management Console Expand down to Sites Click Add FTP site from the actions menu Specify a Site name, Specify a physical path Anon FTP For this article, I am showing anonymous ftp however, anonymous ftp isn’t recommended in production environment. Select and ip address (this would be your internal one) leave the port on 21 (Do not specify a host name – if you want make it simple and easy) Check Start FTP Site Automatically , I selected No SSL, You can select SSL if you want to. For this article, I leave it as no SSL. For Authentication I check Anonymous. Authorisation Allow access to Anonymous users With Read and Write. However, in production environment, never allow anonymous access. To setup the permissions in the local file system. Right Click on newly created FTP site, Click on Edit Permission. Right Click and get to the security tab and then click on Advanced Click Change Permissions, Un-check “Include inheritable permissions from the object’s parent” Click Add to add the original permission. Add or modify preferred permission. Close this all off. Follow the following steps to add anonymous access. Open the advanced permissions again (it should be nicely refreshed now) Click add, From the location field change this to the server, Enter the user name IUSR click check name and OK (this is the “Anonymous User” account) I Select Full control for this folder sub folders and files ( you can fiddle here if you want to restrict more) Close that all off. To publish FTP Site to extranet or internet: Click on FTP server (not site)>Click FTP Firewall Support, Type preferred port range and IP address of external NIC of TMG server. To Install Certificate for Secure FTPS To Publish FTP site from Forefront TMG 2010: you can publish ftp server using non-web publishing rule. To do this, right click on firewall policy>new>create non web publishing policy. Apply changes. Click ok. right click on newly firewall policy>click configure ftp>uncheck Read only>Apply and ok. Apply changes. Click on System>Application Filters>FTP Access Filter>click Allow active FTP access. Apply and ok. To Create FTP access rules in Forefront TMG 2010: Create another rule allowing ftp for internal networks. Test FTP connections using any ftp client. In conclusion, this is a test ftp server, there are lot more to do in terms of securing ftp and publishing for individual users.
1.1 2.1 2.2 2.3 2.4 2.5 3.1 4.1 4.2 4.3 4.4 4.5 4.6 5.1 6.1 6.2 6.3 7.1 8.1 8.2 8.3 8.4 8.5 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 39.2 40.1 41.1 41.2 42.1 42.2 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 61.2 62.1 63.1 64.1 64.2 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 75.1 75.2 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 88.2 88.3 89.1 90.1 91.1 91.2 91.3 92.1 92.2 92.3 92.4 92.5 93.1 94.1 95.1 95.2 95.3 95.4 95.5 96.1 97.1 98.1 99.1 100.1 101.1 101.2 102.1 103.1 104.1 105.1 106.1 107.1 107.2 108.1 109.1 110.1 111.1 112.1 113.1 114.1 114.2 115.1 116.1 116.2 117.1 117.2 118.1 118.2 118.3 119.1 120.1 121.1 121.2 122.1 122.2 122.3 123.1 123.2 123.3 123.4 124.1 124.2 125.1 126.1 127.1 128.1 129.1 130.1 131.1 132.1 132.2 133.1 134.1 134.2 135.1 136.1 136.2 136.3 136.4 137.1 138.1 139.1 139.2 140.1 140.2 141.1 142.1 142.2 143.1 144.1 145.1 146.1 147.1 147.2 148.1 149.1 150.1 150.2 151.1 151.2 152.1 153.1 153.2 154.1 155.1 155.2 156.1 157.1 158.1 159.1 160.1 161.1 162.1 163.1 164.1 164.2 165.1 166.1 166.2 167.1 167.2 167.3 167.4 167.5 168.1 169.1 170.1 170.2 170.3 171.1 171.2 171.3 172.1 172.2 172.3 172.4 173.1 173.2 174.1 174.2 175.1 175.2 176.1 177.1 178.1 179.1 180.1 181.1 182.1 183.1 184.1 185.1 186.1 187.1 188.1 189.1 190.1 191.1 192.1 192.2 193.1 193.2 194.1 195.1 196.1 197.1 198.1 199.1 200.1 200.2 200.3 201.1 202.1 203.1 204.1 205.1
Kaljenje Sigurnost Server-The Bottom Line Osiguranje poslužitelje iz unutarnje i vanjske prijetnje je ključni aspekt upravljanja i vođenja Windows poslužiteljima. Ako pažljivo dizajniranje, implementaciju i održavanje IT infrastrukture ćete imati bolji noćni san znajući da su na sigurnom. Tu neće biti glazba u ušima oncall inženjer prema moru. Pa kako ste ostvarili čvrstu sigurnost i kontrolu na IT infrastrukturu bez ugrožavanja radno okruženje. Evo nekoliko savjeta za vas. Infrastrukturni Firewall Morate imati izoliranu mrežu glavom s poslovnici Office. Možete kupiti MPLS ili IP WAN uslugu od ISP-a. Alternativno, možete kreirati stranice na web VPN pomoću sigurnosnog aparata ili primjenu kao Forefront TMG 2010. Bolji pristup dizajn će biti multi-tier firewall, tako da je vaše unutarnje poslužitelj, DMZ poslužitelji i područne poslužitelji ostati čvrsto povezani. Možete imati određene VLAN za određene poslužitelje / Usluge / aplikacije s ispravnom Popis Access Control (ACL) u Cisco preklopnici i usmjerivači. To će dodati još jedan sloj firewall na mrežu. Računalne firewalli U sustavu Windows Server 2008 i Windows Server 2012, tu je izgrađen u firewall. Možete konfigurirati da izgrađen-in firewall za skupinu poslužitelja ili individualne poslužitelj osigurati domaćin based firewall. Oba Server 2008 i Server 2012 isporučen s naprednim Firewall i sigurnosne konfiguracije alata koje možete upravljaju kroz Group Policy objekta. Intrusion Detection System Drugi ključni aspekt firewall je sigurnosna uređaj koji Vam kako biste poboljšali sigurnost pomoću Intrusion Detection System (IDS) / upada sustav zaštite (IPS). To su third-party Uređaji ili aparata. IDS vam pomaže da praćenje mrežnog prometa, bilježi podatke o prometu, analizira promet na temelju potpisa i anomalija, prepoznaje potencijalne napade, a upozorava IT osoblje na percipirane napada. IPS čini sve to, ali također ima sposobnost da reagira na uočenu napada. IPS je također sposoban reagirati na napad na temelju vaših konfiguriranih pravilima. Server kaljenje-dno crta Možete izvršiti sljedeće akcije da se zaustavi bitak sjeckan ili poduzeti ove akcije kako bi se spriječilo sjeckanje - Izolat administratora uloge pojedinih zadataka sličnih njihovom opisu posla. - Zaustavljanje i onemogućiti sve nepotrebne usluge i aplikacije - Preimenovanje administrator računa - Provesti lozinka politika pomoću politiku Default Domain u Group Policy Object - Provesti GPO sigurnim poslužiteljima i klijentima - Brisanje ili onemogućiti sve nepotrebne korisničke račune - Korištenje usluge račun za pokretanje usluge i aplikacije umjesto trčanje usluge korištenja IT admin je generički račun i pohraniti lozinku na sigurno mjesto - Stvaranje Role Based korisnički račun umjesto korisnički račun korisničko ime - Zahtjev za jaku provjeru i certifikate za pristup aplikacijama - Izvođenje redovito firmware, operativni sustav i aplikacije nadogradnje koristeći WSUS ili SCCM - Instalacija poznati Antivirus i anti-spyware programa i upravljati njima centralno - Dokument sve konfiguracije sustava i pohranu tih dokumenata u sigurnom mjestu - Reviziju i nadzirati IT infrastrukture redovito kako bi se spriječilo bilo loše konfiguracije - Koristite samo za čitanje Domain Controller (RODC) za podružnice - Iskoristite veliku korist Server core tehnologija smanjuje površinsku napad dodatno - Koristiti NPS, nap i certifikat Serveri osigurati pristup aplikacijama i uslugama. Instalacija i konfiguriranje Forefront Identity Manager 2010-Korak po korak Sustavi zahtjevi: - Windows Server 2008 x64 Standard ili R2 - SQL 2008 x64 Standard ili Enterprise DB motora + Cijeli tekst pretraživanje - SQL 2008 x64 SP2 - Windows Snaga Shell 1,0 ili 2,0 - NET 3.5 SP1 - Internet Information Services Uloga (IIS) - Exchange 2007 ili 2010Management konzole - Windows SharePoint Services 3.0 SP2 FIM klijentskim računalima: - Windows XP SP2 ili Windows 7 SP1 - Microsoft. NET Framework 3.5 SP1 - Microsoft Office Outlook 2007 SP2 - Smart oznaka. NET Programmability podrška (Dostupan u Office Setup) - Smart oznaka. NET Programmability podrška (Dostupan u Office Setup> Ured Alati) Nepodržana konfiguracija: SharePoint 2010 NIJE podržana Preduvjeti: - Stvaranje e omogućen račun usluge domene za pokretanje komponentu FIM usluga. - Izradite račun usluge domene za pokretanje usluge FIM sinkronizacije. - Stvaranje upravljanja FIM račun SERVISERA. - Konfiguracija za usluge račune koji se izvode na FIM poslužitelja komponente - Office SharePoint 3,0 SP2 Web instaliran i pokrenut. - Odaberite točan identitet za bazenom SharePoint aplikacija. - Provesti Secure Sockets Layer (SSL) za FIM portalu. - Konfiguracija poslužitelj pokrenut SQL. - Konfiguracija SQL pseudonime. - Konfigurirajte postavke SQL uspoređivanje. - Uspostaviti Imena usluga (SPN) glavnice za FIM 2010. Kako stvoriti račun za uslugu u Active Directory Prijavite se na Admin Server ili kontroler domene i stvoriti sljedeće usluga Računi i Security Group Postavite lozinku i račun da nikada ne prestaje. Omogućiti spremnik za FIM računu usluga. Da biste omogućili FIM MA prijaviti na lokalno Prijavite se na FIM Server (s). Kliknite Start> kliknite Administrativni alati> Kliknite Local Security politiku Proširi lokalnih politika \ Korisničko prava dodjele. U politici Dopustite prijaviti na lokalnoj razini, osigurati da račun FIM PZ izrijekom je navedeno, ili ga dodali na jednoj od skupina koja je već odobrenih pristup. Otvoreno Server Manager> Lokalni korisnici i grupe> Dodaj SA-fimservice u Korisničke grupe. Nanesite> Ok. Važno! - uslužne računi ne smiju biti članovi lokalne grupe administratora. - Usluga FIM Sinkronizacija računa usluga ne smije biti član sigurnosnih skupina koje se koriste za kontrolu pristupa FIM uslugu sinkronizacije FIMSyncAdmins - Uvjerite se da Burza web usluga i IIS zadani web stranica nisu oboje konfiguriran za korištenje port 80 - Pobrinite se da web SharePoint Default site je instaliran i početna konfiguracija je završena. - Provjerite instalaciju navigacije na http://localhost:80 na poslužitelju gdje ćete instalirati FIM Portal - Odaberite točan identitet za bazenom SharePoint aplikacija Za pokretanje Pool SharePoint aplikacija koristeći račun koji se nalazi u domeni Početak Administrativni alati> SharePoint 3,0 središnju administraciju Odaberite operacija> Sigurnost Konfiguracija> Kliknite Računi usluga Odaberite Pool web aplikacija i odaberite Windows SharePoint Services web aplikacija. Odaberite Pool SharePoint Application gdje FIM Portal će biti instaliran, koji po defaultu je SharePoint - 80. Unesite korisničko ime i lozinku za uslugu obzir da ste stvorili u prvom koraku.> Kliknite OK. Omogućiti primjenu bazen za Windows provjeru autentičnosti Kerberos koristeći: Da biste saznali više o proširenoj zaštite posjetiti KB i Omogućite Application Pool koristiti uslugu račun za Kerberos. Za utvrđivanje SPNs za FIM usluga: Otvorena Command Prompt u administratorskom Server ili DC vrsti sljedeći. setspn –S sa-fimservice/FIMPortal.microsoftguru.com.au microsoftguru\sa-fimservice setspn –A HTTP/FIMPortal.microsoftguru.com.au microsoftguru\sa-fimservice setspn –A HTTP/FIMPortal.microsoftguru.com.au FIM FIMPortal.microsoftguru.com.au je pseudonim FIM Server dodan u glavnom zaglavlju microsoftguru \ SA-fimservice je račun za SharePoint App bazenom namjene i definirana u IIS. microsoftguru \ SA-fimservice račun za uslugu za FIM usluge ako ne možete dodati spn koristeći izaslanstvo karticu. korisnik računala račun i račun za uslugu atribut karticu i dodati SPN. odaberite "Vjeruj ovog korisnika za delegacije navedenih usluga samo". Ako adresa koje su klijenti koristiti kontaktirati FIM Portal nije isti kao poslužitelj FQDN, morate uspostaviti SPN za HTTP. To je, ako koristite CNAME zapis resursa u DNS, imaju SharePoint farme, ili koristiti NLB, ova adresa mora biti registriran ili Internet Explorer ne može koristiti Kerberos protokol kada se kontakti na portalu. Pokrenite sljedeću naredbu: Instalacija NET i IIS na FIM Server: Instalirajte Office SharePoint Services: Za provedbu SSL uz potvrdu iz postojeće interne CA. Stvaranje baze-64-kodiranu certifikat koristeći ovaj vodič " Zahtjev i instalirati certifikat Web Server "u FIM Server. Vežite Web Server potvrda sa SharePoint - 80. IIS Manager> Kliknite Mjesta> odaberite Sharepoint - 80. Kliknite vezovi, a zatim kliknite Dodaj. Odaberite https. Odaberite certifikat> Kliknite OK. Uklonite HTTP obvezujuće. Kliknite SSL postavke, a zatim provjerite je potreban SSL. Primijenite postavke. Kliknite Start, zatim Administrativni alati, a zatim Sharepoint 3,0 središnju administraciju. Kliknite operacije, a zatim zamjenske Access preslike. Kliknite http:// FIMservername . Promjena http://FIMservername da https://FIM NazivPoslužitelja kliknite OK. Kliknite Start, Run, upišite iisreset, a zatim kliknite U redu. Test Office SharePoint radi na luci 443 Uvjerite se da servis računi koriste SQL Server baze podataka i SQL Server Agent su ili domena račune ili ugrađeni u uslužne račune Da biste pronašli bazama podataka na različitim pogonima Početak Microsoft SQL Server Enterprise Manager Desni klik na poslužitelj, a zatim kliknite Svojstva. Idi na postavkama baze podataka. Napravite potrebne prilagodbe na podacima i prijavite postavke kako bi se osiguralo da se baza podataka nalazi na drugom disku od operativnog sustava. Konfiguracija SQL pseudonime: Ako planirate instalirati FIM usluga ili FIM uslugu sinkronizacije na poslužitelju sa sustavom SQL koje koristi ne zadani priključak, morate stvoriti SQL pseudonim za postavljanje biste mogli kontaktirati SQL poslužitelj. Za izradu SQL pseudonim za postavljanje biste mogli kontaktirati SQL Server Pokrenite SQL Manager Configuration Server. Dođite na SQL Native Client 10,0 Configuration / aliasa. Stvaranje novog pseudonima s poslužitelja podataka. Vi ne trebate učiniti SQL korake ako imate zaseban SQL poslužitelj. Ja sam to radiš, jer ovo je moj Test okoliš. Instalirajte FIM Komponente Server: - FIM sinkronizacije usluga - FIM usluga - FIM Portal - FIM Lozinka Portal Za instalaciju usluge FIM sinkronizacije Na FIM 2010 početni zaslon, kliknite Usluga vezu Synchronization Install. Pokrenuti setup.exe, a zatim slijedite upute u instalacijskom čarobnjaku. Za instalaciju FIM usluga Na FIM 2010 početni zaslon, kliknite Install usluga i Portal vezu. Pokrenuti setup.exe, a zatim slijedite upute u instalacijskom čarobnjaku Na Custom Setup stranici, od vas se traži za aplikacije koje želite instalirati. U padajućem izborniku pored FIM usluga, kliknite Hoće li biti instaliran na lokalnom tvrdom disku. Kliknite na Dalje. Na konfigurirali zajedničke Services stranici, u okviru poslužitelja baze podataka, upišite naziv poslužitelja koji ugošćuje SQL Server 2008. Kliknite Dalje. Na konfigurirali zajedničke usluge - Konfiguracija poslužitelja e-pošte veze stranici, u Mail Server, upišite naziv poslužitelja hosting sustava Exchange Web usluge Kliknite Dalje.. Na Konfiguracija Zajednička Usluge - Konfiguracija stranicu usluga certifikat, odaberite opciju za generiranje novog self-izdanih FIM certifikat koji se koristi web servis za provjeru komunikaciju s klijentima, ili odaberite potvrdu iz certifikata trgovine, a zatim kliknite Dalje . Na Konfiguracija Zajednička usluge - Konfiguracija račun FIM uslugu stranicu, pružiti vjerodajnice za usluge FIM domene računa u službi e-mail računa, osigurati da unesete e-mail adresu za račun FIM usluga, a ne vaš osobni e-. mail adresa. Kliknite Dalje. Na Konfiguracija Zajednička usluge - Konfiguracija Manager Forefront Identity vezu sinkronizacije, u okviru sinkronizacijski poslužitelj, upišite naziv poslužitelja koji je hosting usluga FIM sinkronizacije komponentu U FIM 2010 Uprave Agent računa * upišite domenu \ računa. na račun FIM MA. Primjer:. Microsoftguru \ SA-fimagent Kliknite Dalje. U Konfiguracija FIM Služba i Portal - konfigurirati vezu s FIM službe, upišite naziv poslužitelja ili nadimak koji su klijenti trebali koristiti da se obratite FIM usluga. Ako planirate koristiti alternativne ime (koje je, CNAME resurs rekord u Domain Name System (DNS)), upišite alternativni naziv. Ako planirate imati nekoliko FIM usluga poslužitelja u Balansiranje opterećenja mreže (NLB) klastera, upišite naziv klastera adresu. Kliknite Dalje. Na Configure FIM usluga i Portal - Konfigurirajte sigurnosne promjene konfiguriraju postava, kako bi se omogućilo klijentima da obratite sučelje Web usluge, odaberite otvorene portove 5725 i 5726 u firewall. Primjer: https://localhost Kliknite na Next, a zatim kliknite Instaliraj. Post-instalaciju Zadaci - Dodajte usluge FIM račun usluga na FIM uslugu sinkronizacije sigurnosnih skupinama. - Konfiguracija FIM Usluga usluge Exchange Server spremnik. - Isključite indeksiranje SharePoint. - Uključite Kerberos v5 protokol samo. - Instalacija Exchange 2007 i Exchange 2010 web usluga sertifikata. Instalacija najnovije ažuriranje za FIM: Obnova za FIM su objavljene na Microsoft Update. Pobrinite se da instalirate najnoviju nadogradnju iz Microsoft Update. - U sustavu Windows Server 2008, kliknite na Start, a zatim kliknite Windows Update. - Kliknite Provjera ažuriranja. Instalirajte bilo kakve nove ažuriranja za FIM koje su dostupne. Dodajte usluge FIM račun usluga na FIM uslugu sinkronizacije sigurnosnih skupinama - Dodaj servisni račun koji koristi FIM Služba za FIMSyncAdmins grupi. To omogućuje FIM usluga za konfiguriranje usluge FIM sinkronizacije. Ako planirate koristiti značajku Password Reset od FIM 2010, dodajte usluga račun koji FIM usluga koristi za FIMSyncPasswordSet sigurnosti grupe. Tako da grupa članstvo je na snazi, ponovno FIMService usluga. Konfiguriranje FIM Usluga usluge Exchange poštanski sandučić Evo najbolje prakse za konfiguriranje Exchange Server za usluge FIM usluge račun. Konfiguracija računa usluga, tako da se može prihvatiti mail samo iz unutarnjih e-mail adrese. Naime, spremnik račun usluga nikada ne bi trebao biti u mogućnosti primiti poštu iz vanjskih SMTP poslužitelja. U konzoli za upravljanje sustavom Exchange, odaberite FIM Usluga usluga račun SA-fimservice, desni klik Properties, kliknite Postavke Mail Flow, a zatim ograničenja isporuku pošte. Odaberite Zahtijevaju da se svi pošiljatelji ovjerena potvrdni okvir. Konfiguracija računa usluga, tako da odbacuje mail poruke s veličinama većim od 1 MB. Slijedite najbolje prakse konfiguriranje Exchange 2007 limite veličina poruke. U konzoli za upravljanje sustavom Exchange, odaberite FIM Usluga usluga račun SA-fimservice, desni klik Properties, kliknite Postavke Mail Flow, a zatim ograničenje veličina poruke Konfiguracija računa usluga, tako da ima kvotu spremnika za pohranu od 5 gigabajta (GB). Slijedite najbolje prakse konfiguriranje Exchange 2007 granice spremnika veličine: U konzoli za upravljanje sustavom Exchange, odaberite FIM Usluga usluga račun SA-fimservice, desni klik Nekretnine> Spremnik Postavke> Pohrana Kvota Onemogućavanje SharePoint indeksiranje Preporučuje se da se onemogući SharePoint indeksiranje. Nema dokumenata koji trebaju biti indeksirane i indeksiranje uzrokuje mnoge unose pogreškama Evidencija i potencijalne probleme performansi s FIM 2010. Da biste onemogućili SharePoint indeksiranje Na poslužitelju koji domaćini FIM 2010 Portal, kliknite Start> Svi programi Kliknite popis, pod Administrative Tools, kliknite SharePoint 3,0 središnju administraciju. Na središnje administracije stranici, kliknite operacije. Na poslovanje stranici, pod globalnom konfiguracijom, kliknite definicija timera posao. Na Timer posla Definicije stranici, kliknite SharePoint Services Traži Refresh. Na posao Edit Timer stranici, kliknite Onemogući. Aktiviranje Kerberos protokol samo Preporučamo da isključite portal autentičnosti koji koristi NTLM. Kerberos protokol je više siguran protokol koristiti. Za aktiviranje Kerberos protokol samo Otvorite Povišen naredbenog retka. Pronađite C: \ inetpub \ wwwroot \ \ WSS VirtualDirectories \ 80 Tip Notepad web.config, pronađite element Dodaj requireKerberos = "pravi", tako da se čita Spremite web.config datoteku. Trčanje iisreset iz naredbenog retka. Instalacija Exchange 2010 web usluga (EWS) Certifikat: Ako vaš poslužitelj trčanje Razmjena koristi certifikat koji je nepouzdano strane FIM Služba, certifikat koristi Exchange poslužitelj mora biti dodan na lokalnoj certifikata trgovine. Za instalaciju certifikat Exchange na poslužitelju FIM usluge Otvorite Internet Explorer. U adresnu traku upišite https:// MailServer / EWS / exchange.asmx. MailServer je poslužitelj pokrenut Exchange koji ste naveli kada ste instalirali FIM 2010 komponentu. Odaberite Nastaviti ovoj web stranici. U sigurnosti Alert dijaloškom okviru (gdje se čita pogreška certifikata), kliknite Prikaz certifikata. U okviru certifikata dijaloškom kliknite Instaliraj certifikat. Dana Dobrodošli u Čarobnjak Certificate Import stranici, kliknite Dalje. Na stranici Certificate Store, odaberite Postavite sve certifikate u sljedećem trgovini, a zatim pritisnite Pregled. Odaberite Prikaži fizička sprema potvrdni okvir, dođite do pouzdanih ljudi \ Local Computer i odaberite ovu trgovinu. Kliknite OK. Kliknite Dalje. Kliknite Završi da biste uvezli certifikat. Potvrda da je certifikat i potvrditi da su EWS može doći Za instalaciju FIM dodatke i proširenja Zatvorite Microsoft Office Outlook ako je pokrenut. Ovisno o klijentskom računalu arhitekture, na FIM 2010 početni ekran, pritisnite bilo Instalacija dodataka i nastavaka, 64-bitne ili Install Add-ins i proširenja, 32-bitni vezi. Pokreni setup . exe, a zatim slijedite upute u instalacijskom čarobnjaku. Na Custom Setup stranici, od vas se traži za aplikacije koje želite instalirati. Lozinka komponenta FIM i autentičnosti proširenje instalira Gina / Kvalifikacije davatelja i kontrolu ActiveX ® za Internet Explorer. Na 64-bitnom instalacije, dodatna komponenta je dostupna, FIM Portal Authentication proširenja, koji se instalira 32-bitni ActiveX kontrole za Internet Explorer Na Konfiguracija FIM dodatke i proširenja stranica, u FIM Portal Server adrese, upišite ime ili nadimak na poslužitelju koji domaćini FIM Portal. Odlučio li namjeravate kontaktirati FIM Portal koristeći HTTP ili HTTPS (preporučeno). U FIM usluge davatelja računa e-mail adresu, upišite e-mail adresu u SMTP formatu, to jest, u obliku sličnom SA-fimservice @ microsoftguru . com.au od davatelja usluge FIM račun. Ne utipkajte alias ili prikazati naziv računa. Na Konfiguracija FIM dodatke i proširenja stranica, u FIM usluge Server adrese, upišite ime ili nadimak na poslužitelju koji domaćini FIM usluga. Ako se usluga i Portal komponente instaliran na istom poslužitelju, to će biti ista vrijednost kao i na prethodnoj stranici. Na Konfiguracija FIM dodatke i proširenja stranica, u SiteLock upišite sve adrese koje korisnici mogu koristiti za pristup FIM Portal. Na primjer, ako korisnik može pristupiti poslužitelju pomoću oba FIMserver i FIMserver.microsoftguru.com.au, nego ući SRFI erver; fimserver.microsoftguru.com.au u tom okviru. Ako imate FIM portalu i FIM Password Reset portal na dva različita servera, unesite obje adrese u tom okviru. Kliknite Instaliraj. Za instalaciju FIM dodatke i proširenja Language Pack - Prijavite se na klijentsko računalo s administratorskim dozvolama. - Run Setup.exe, a zatim slijedite upute u instalacijskom čarobnjaku. - Na Microsoft Forefront Identity Manager Client Jezik Pack Setup stranici, kliknite Dalje. - Na kraju-korisničke licence stranici, kliknite na Prihvaćam uvjete u ugovoru o licenci, a zatim kliknite Dalje. - Na Custom Setup stranici, odaberite jezike koje želite instalirati, a zatim kliknite Dalje. - Kliknite Instaliraj. - Kada instalacija završi, kliknite Završi. Pregled FIM Add-in za Outlook i Password Reset proširenja u odabranom jeziku Sljedeći postupci pokazuju kako bi provjerili da FIM Add-in za Outlook koristi lokalizaciju. Za prikaz FIM Add-in za Outlook i Password Reset nastavcima u odabranom jeziku na Windows XP - Prijavite se na klijentsko računalo s administratorskim dozvolama. - Kliknite Start, a zatim Upravljačka ploča. - U upravljačkoj ploči, kliknite Regionalne i jezične odrednice. - Na kartici Options, pod Odaberite stavku kako bi se slagala svoje sklonosti, ili kliknite Prilagodi izabrati svoje formate, odaberite jezik koji želite. - Na kartici Jezici, pod jezik koji se koristi u izbornicima i dijalozima, odaberite jezik koji želite. - Kliknite karticu Advanced i pod Odaberite jezik kako bi se slagala jezika verziju non-Unicode programe koje želite koristiti: kliknite jezik koji želite. Kliknite Primijeni. - Ako se od vas zatraži porukom vam reći da su potrebne datoteke već su instalirani na tvrdom disku, možete pritisnuti Da bi ove datoteke koristiti i preskočiti postupak kopiranja ove datoteke s CD-a. Inače, možda ćete morati originalne Windows XP instalacijske medije kopirati potrebne datoteke. - Pritisnite Da za ponovno pokretanje klijenta Windows XP. - Kad klijent ponovno, prijavite se na computer.Open Outlook i koristiti funkcionalnost FIM Add-in za Outlook. - Za pregled Windows drugi jezik, ponovite korake 1 do 11. Za prikaz FIM Add-in za Outlook i Password Reset Extensions u jeziku želite na Windows Vista ili Windows 7 Prijavite se na klijentsko računalo s administratorskim dozvolama. Kliknite Start> Kliknite> Upravljačka ploča na upravljačkoj ploči, kliknite Regionalne i jezične mogućnosti. Na Tipkovnice i jezici kartici, pod Display jeziku, odaberite jezik koji želite instalirati. Kliknite OK.> Kliknite Apply> Kliknite OK. Otvorite Outlook, i koristiti funkcionalnost FIM Add-in za Outlook. Za pregled Windows drugi jezik, ponovite korake 1 do 9. Instalacija Active Directory lozinke komponentu obavijesti reset na kontroleru domene Da Konfiguracija FIM Active Directory Services domena slijedite zaslonske puca: Da Konfiguracija Profil slijedite snimke zaslona Za konfiguriranje globalni katalog Poslužitelj sinkronizacije slijediti screenshot