WinServer 2k3 Newbie...

[GeorgePal]

I'm a newbie on servers generally, however just installed a Win2k3 Small Business Server on our enterprise with 13 clients using Win XP SP2 & Win2k2 SP4..
Currently one of the clients is sharing the internet connection and all the printers but soon i wont to have the server to run as internet sharing server.
I would like you to give me some starting tips of what r the main things i need to do so that i'm secure and so that the server runs effectivelly.
Before we were on Novell Netware..R there any main benefits gained by changing to 2003 server & XP Pro??

Forgot to say that the server is an IBM xSeries running 2 Xeon 3,06 Ghz CPUs with 1G RAM & 3 RAIDs on it. I have set a domain and all pcs login there.
Managed to configure DHCP to give ip addresses automatically. Is that safe?

Thanks in advance... Any external links for howtos & guides r also welcome

 

[GeorgePal]

Also how safe and ok is it to install 3rd party SW on the server, such as Spybot, AdAware, Spyware Blaster, NAV2004 (Not server edition) etc?

 

[bofhrevenge2]

Netware is a good platform but is coming to the end of it's life, a move to 2k3 server is sensible it's a stable reliable platform and it will be supported for a long time.

If you are going to have an always on internet connection then i would recommend buying a hardware firewall of some sort, there's loads of reasonable priced boxes that are suitable for small offices. The right box will be able to share your internet for you as well saving your server for more important tasks.
Using DHCP isn't a problem just remember to use WEP/WPA if you use any wireless on your network.

Here's a couple of links to read an locking down a Win server.

http://www.microsoft.com/technet/security/tools/mbsahome.mspx

http://www.blackhat.com/presentations/win-usa-04/bh-win-04-milroy/bh-win-04-milroy.pdf

 

[bofhrevenge2]

Deffinatly run AV software on you server the latest version of Symantec will scan for spyware as well (well the server edition does anyway). You shouldn't need to run adaware on your server as you won't be casually browsing the internet from it (will you?)

As a general rule the less software on your server the better, only install what you need and test it first.

 

[GeorgePal]

Thanks every1 for ur replies.
I installed the AV and everything looks to work fine apart from some speed probs and the internet sharing.
Concerning the speed probs, is there any possibility that extra protocols at my LAN connection at the client PCs, cause it?

I mean, since i am running an SQL App from the server which protocols r required?
I tested to leave only TCP/IP, Client at MS Networks, File & Printers sharing and seems to work OK. Didnt notice any serious change at the speed though.

Adding TCP/IP 6 or QoS Packet Scheduler will slow down or make the network faster?

P.S. The client app is an erp program based on SQL which is ran from the server (shortcut goes to \\server\app.exe\

 

[Stevehewitt]

If you don't need the additional protocols then don't use it. I am not aware of any offical figures about having multiple protocols on your system will slow the network down - but it would be logical to think that it would!
TCP/IP, MS Client, File & Printer and QoS are normally the default. Unless you have a large network and/or additional software / hardware (VoIP etc.) then you wouldn't have much use for QoS.

Normal networks setups are your internet connection to a firewall of some sort that also acts as your default gateway for external traffic. You then have your server with hardly anything other than essential, business critical apps. The server should issue out DHCP and run DNS server.
Unless you are running anything super special, normal TCP/IP, File & Printer and MS Client should do the trick at their default settings.

Good Luck,


Steve.

P.S. \\server\app.exe wouldn't work. It would need to under a share. (Folder) E.G. \\server\share\app.exe. File and Printer Sharing allows sharing to be done like the example.

 

[GeorgePal]

Steve, in my PS i meant as a shared folder in the server. Thanks however for ur reply.

Concerning the Internet Sharing what is the best way to be done? I currently got an ISDN connection switching to ADSL soon, however when i create the dialup connection i cannot share it (no advanced tab) thus the clients cannot connect to the net, while the server does. I have been suggested that i need to change some settings at the 'Routing & Remote Access' and enable the 'lan and demand dial' & finally enable NAT.

R all these required? And what effect will have on my network when they r done? Will for example the ip be reset or will the network stop for a couple of seconds? Can it be done while clients use server files?

 

[Stevehewitt]

Not too sure what you mean. You are going to be changing to a ADSL connection soon?

There are two ways to go about it. The easiest (and simpliest) is to get a ethernet firewall/modem/router and plug one end into your LAN and one into your ADSL port. Nice and Easy - works well.

If you want a bit more control (E.G. Add in content filters from 3rd parties) then you can have the ADSL connection to go straight into your Win2k3 box and enable RRAS. The wizard in RRAS is actually pretty good. You will need to setup NAT's as you can't have your local IPs going to the web.

You can configure RRAS with ease and from memory I don't think it will take your network down for a couple of seconds or anything. Your server IP will stay the same.
Clients can access the server.
(Don't hold me to this, but it would be as simple as RRAS stopping and starting your NIC - if anything at all.)

I would always recommend that if you are doing this sort of work on a non-dedicated server (used for lots of stuff) in a live enviroment then backup and do the work in the evening or when few users will be working.

Good Luck,

Steve.

 

[GeorgePal]

I managed to enable NAT and connect to the net through Routing and Remote Access and everything looks to be working fine.
However, how can i checkl which times my server is connected?
Also, is there any way i can disable demand dialing and make an easy way for one of the client PCs to dial up from the server?

How about the firewall? Am i protected? Does 2003 have a firewall and if yes where can i find it?

Cheers.

Giorgos

 

[moorethan]

I would consider using another PC as a firewall. Any cheap pc will do. I have used smoothwall (

http://www.smoothwall.org)for

a long time and found it easy to setup and configure. Using your server for ICS is just asking for trouble (in my opinion )especially if you are not confident in the setup.
I also used ISDN but had the wrong phone number configured all those little 10 second calls that the PC made added upto a £2000 bill so be carefull.

 

[Stevehewitt]

How are you connecting? ISDN, xDSL, standard dialup?

The best option if you have not got a seperate modem/firewall combo (fantastic devices) would be to do as moorethan suggests and use a seperate cheap old PC with some linux firewall app on it. (Smoothwall is good, and I have heard good things about IPCop too)

But the easiest and normally the cheapest would be to get a dedicated modem with a built in firewall.

The Draytek Vigor range are good and do the trick - use these at work. Also used to the Bintec products for ISDN (Bianca Brick Office XS).

 

[GeorgePal]

Termporarilt i'm on dial-up but adding adsl soon.
I'm wondering, if in the meantime, there is any way for an inexperienced user to easily connect & disconnect the demand dialing of the server, avoiding to connect remotely to the server