User manual MACROMEDIA BREEZE-SECURITY

[. . . ] 11 3 4 Contents Security and Macromedia Breeze Overview This document is targeted towards system administrators and program managers interested in ensuring security with Breeze. If you are installing Breeze for use on your intranet, it is recommended that you review and implement the best practices outlined in this article. However, if you are installing Breeze for use on the Internet, you must implement the best practices outlined in this article. Failure to do so will compromise the security of your Breeze application and the information contained within. [. . . ] Database Server Security Whether or not you are hosting your database on the same server as Breeze, you must make sure that your database is secure. Computers hosting a database should be in a physically secure location. Databases should be installed in the secure zone of your corporate intranet and never directly connected to the Internet. Back up all data regularly and store copies in a secure off-site location. The Microsoft security web site contains information that applies to both securing SQL Server 2000 and the Breeze built-in database: www. microsoft. com/sql/techinfo/administration/ 2000/security/ The following link provides a good starting point to making sure that your database is secure: www. microsoft. com/sql/techinfo/administration/2000/security/securingsqlserver. asp Note that Macromedia Breeze does not support Windows Authentication Mode. In addition, if you are running the Breeze built-in database, you should note that the Breeze built-in database uses `breeze' as the password by default. To change the password, type the following at the command line: osql -E -Q "sp_password @new='{new_password}', @loginame='sa'" where {new_password} is a strong password. Solutions for a Secure Infrastructure Most Breeze configurations will fall into one of two configurations: · A single server configuration · A multiple server configuration. This section discusses both setups and they provide examples on how to secure these environments. Security Levels 7 Single Server Configuration The easiest solution for a dedicated, single-server Breeze system is to block all ports on the Breeze box except 80, 1935 (and 443 for SSL-enabled servers). If the Windows server is carefully updated by your IT department with the latest Microsoft security patches, a software firewall can easily be configured to enable application security. An external hardware firewall appliance can provide an extra layer of protection and also provides additional protection against operating system flaws. Example: Securing a Single Server Configuration Assume that you are setting up Breeze Live and Breeze Presentation on a single server. You want users to be able to access Breeze on the Internet. Securing Breeze on a single server consists of the following steps: 1 Install a firewall 2 3 4 5 Since you are allowing users to access Breeze on the Internet, this means that your Breeze server is open to an attack by hackers. By using a firewall, you can block access to your servers and control what communications occur between the Internet and your servers. Configure your firewall After installing your firewall, you want to configure your firewall as follows: Inbound ports (from the internet): 80, 443, 1935 Outbound ports (to the mail server): 25 Since the database is located on the same server as Breeze, you do not need to open up port 1433 on the firewall. Install Breeze For information on installing Breeze, see the Breeze Installation Guide. Verify that Breeze is working After installing Breeze, you should verify that Breeze is working properly both from the Internet and from your local network. Test your firewall Now that you have your firewall installed and configured, you should verify that your firewall is working correctly. Test the firewall by attempting to use the blocked ports. Multi-server Solutions Multi-server solutions are inherently more complex and will vary from customer to customer. It is very important that the customer understand how to secure their multi-server installation. They can publish content to the Breeze system, including using the Breeze plug-in for PowerPoint to publish presentations to Breeze. Course Managers Members of the Course Managers group manage the Course Library including creating courses, incorporating course content from Account Authors, enrolling users, sending enrollee notifications, and setting up course reminders. Members of the Meeting Administrators are able to perform all functions associated with creating meetings including setting up a meeting, inviting participants, sending invitations and viewing reports. Meeting Administrators In addition to adding users to groups to grant them rights to use features in the Breeze system, you can also grant them permissions to access specific folders, content, courses and meetings. For example, you can control whether or not a certain Account Author has permissions to publish to a specific folder. [. . . ] For example, firewalls are easily tested using a port scanner for validation. Ongoing security checks help guard against user error that can lead to misconfiguration over time. Firewall Your Servers 10 Security and Macromedia Breeze Recommended Security Resources and References The following are sources of information and software which may aid the process of securing your Breeze server(s). · Network Security SANS Institute (www. sans. org) The SANS Institute (System Administration, Networking, and Security) is a cooperative research and education organization comprised of system administrators, security professionals, and network administrators. They have great network security courses, as well as certification in network security. SQL Server Security Microsoft Security Site (www. microsoft. com/sql/techinfo/administration/2000/security/) Microsoft site that provides information and resources on securing SQL Server 2000. [. . . ]