Microsoft designed Windows Server 2003 Web Server Edition specifically for low-end and entry-level web hosting environments, providing a specific platform for deploying web services and applications.

Although you can install Windows Server 2003 Web Server Edition with some of the same functionalities of the other operating system versions, it is also limited in the following ways:

Windows Server 2003 Standard Edition is designed with the day-to-day needs of the average business in mind and is the progressive replacement for the Windows NT Server 4/Windows 2000 Server line of server operating systems. It offers solutions for file and printer sharing, centralized management through Active Directory, secure Internet connectivity, and web services. It offers a certain level of scalability supporting two-way symmetric multiprocessing and up to 4GB of RAM. One of the main limitations of Standard Edition is that it does not support server clusters.

Windows Server 2003 Enterprise Edition is designed specifically for the needs of larger organizations because their needs surpass the functional levels of Windows Server 2003 Standard Edition. For example, if you need the operating system to support server clusters or if you require more advanced hardware scalability. Enterprise Edition is the progressive replacement for the Windows NT Server 4 Enterprise Edition/Windows 2000 Advanced Server line of server operating systems.

Windows Server 2003 Datacenter Edition is designed to provide the highest levels of scalability and availability. For example, it offers a reliable solution for businesses that need to support high-volume real-time transaction processing. Datacenter Edition is the progressive replacement for the Windows 2000 Datacenter Server line of operating systems.

The following list outlines the minimum system requirements and some additional information for Windows Server 2003 Standard Edition:

The optional hardware list includes items such as CD-ROM or DVD drives, which are usually required only for local installations. The optional hardware list also includes a listing for network adapters and related cables from the Hardware Compatibility List (HCL).

Table 2.1 outlines the different requirement levels of the Windows Server 2003 family, as listed on the Microsoft website. This site (http://www.microsoft.com/windowsserver2003/evaluation/features/compareeditions.mspx) has another table that compares major features for each version.

The 64-bit computing landscape can also add a bit of confusion. Systems based on the Intel Itanium processor require Windows Server 2003 64-bit Itanium Edition. 64-bit systems based on AMD x64 or Intel EMT64 processors can install any of the various editions in the Windows Server 2003 x64 Edition product family. None of these products can be installed on 32-bit hardware platforms.

If you elect to upgrade your current server operating system, you need to be aware that the Setup program automatically installs Windows Server 2003 into the same folder as the currently installed operating system, regardless of its naming convention.

You can perform direct upgrades to Windows Server 2003 from the following versions of Windows:

Remote Storage is not included with Windows Server 2003 Standard Edition. If you are using Windows 2000 Server with Remote Storage, you can’t upgrade the system to Windows Server 2003 Standard Edition. You have the option to upgrade to Windows Server 2003 Enterprise Edition, which has Remote Storage included. You can remove Remote Storage through Add/Remove Programs in Control Panel from your currently installed version of Windows 2000 Server, and then upgrade to Windows Server 2003 Standard Edition; or install Windows Server 2003 Standard Edition as a new installation, which effectively sets it up as a dual-boot system.

You cannot upgrade from Windows 9x, Me, Windows NT Workstation, Windows 2000 Professional, or Windows XP Home or Professional directly to any Windows Server 2003 version. (Clean installations from within those existing operating systems to other partitions or over the existing partition are allowed.)

Also, if you have Windows NT 4.0 Server Enterprise Edition running Service Pack 5 or later, you can upgrade directly to Windows Server 2003 Enterprise Edition, but not to Windows Server 2003 Standard Edition. A clean installation to Windows Server 2003 Standard Edition is available. If you have a version of Windows NT earlier than 4.0, such as Windows NT Server 3.x, you cannot upgrade directly to any product in the Windows Server 2003 family. You can upgrade to Windows NT 4.0, apply Service Pack 5, and then perform a direct upgrade, but this method is not recommended.

Configuring your system with the Configure Your Server Wizard is the same as doing it manually. Using the wizard, select the domain controller role. The wizard then runs DCPROMO.EXE to start the Active Directory Installation Wizard, which is discussed next.

Log file: C:Documents and SettingsJasonzMy DocumentsSecurityLogsDC History.log
-------------------------------------------
Saturday, March 15, 2003 12:54:18 PM
----Configuration engine was initialized successfully.----
----Reading Configuration Template info...

----Configure User Rights...
User Rights configuration was completed successfully.

----Configure Group Membership...
Group Membership configuration was completed successfully.

----Configure Registry Keys...
Configure users.default.
Configure users.defaultsoftwaremicrosoft
etdde.
Configure machinesoftware.

Windows Server 2003 installs Routing and Remote Access Service (RRAS) by default during its installation, but it is not configured or enabled.

When you configure your server in the remote access/VPN server role, you can give remote users the proper access permission to access resources on the local area network (LAN) over a dial-up or DSL/cable connection.

When you run the Configure Your Server Wizard to set up your server as a remote access/VPN server, it starts the Routing and Remote Access Server Setup Wizard (see Figure 2.4).

Figure 2.4. You can choose the types of connections to establish via the Configuration page of the Routing and Remote Access Server Setup Wizard.

The file server role for a Windows Server 2003 implementation is as simple as it sounds: a server role designed to enable administrators to set up a location for data to be stored and shared in the enterprise.

You use the Configure Your Server Wizard to step through the entire process and configure settings for disk quotas and the Indexing Service. You can also set up the shares themselves and permissions.

The File Server Disk Quotas page is where you enable disk quotas by selecting the Set up default disk quotas for new users of this server check box (see Figure 2.5).

Figure 2.5. You can limit disk usage through the File Server Disk Quotas page.

After you enable quotas, you can limit the total space to any number of kilobytes, megabytes, gigabytes, terabytes, petabytes, and, finally, exabytes.

You can also set up a warning threshold numerically or by parameter (KB, MB, GB, and so on) so that a warning is sent when users approach their limits. For instance, if a user has a 100MB disk-writing limit, a warning could be set at 80MB.

To enforce the setting, you need to select the Deny Disk Space to Users Exceeding Disk Space Limit check box. If you do not select this check box, users can continue writing to the disk.

Two other settings can be enabled on this page: the Disk Space Limit check box and the Warning Level check box. Use these settings to configure the system logs to record each occurrence of these events.

After you have configured any disk space limits (you can also opt to not choose any), you arrive at the File Server Indexing Service page (see Figure 2.6). Usually, leaving this setting disabled on a server is recommended because it affects performance; if only limited searches will be performed, leaving this option disabled makes sense. If the server can handle the load or there will be enough searches against the existing data, you can enable this option.

Figure 2.6. The File Server Indexing Service page is where you configure the Indexing Service.

After you review the summary page of the options you have set and continue the role configuration process, the Share a Folder Wizard is displayed, where you can create new shares and paths to the shares (see Figure 2.7). You can also perform this action the “standard” way through Windows Explorer by right-clicking the folder you want to share and choosing Properties, and then electing to share the folder in the Sharing tab. In the next page (see Figure 2.8), you can supply a description for the share and configure offline settings for data in the share (whether the files should be made available when not connected to the network).

Figure 2.7. You can configure shares through the Folder Path page of the Share a Folder Wizard.

Figure 2.8. You can supply additional information about a share in the Name, Description, and Settings page of the Share a Folder Wizard.

Next is the Permissions page, where you set up permissions for a share. There are a few preconfigured settings (all users have Read access, Administrators have Full Control, and so on), and there is the option to configure your own access control. The initial setting is for share access, but you can customize the setting and set security permissions through NTFS. The final page is the summary page, which shows you that the share was successful and enables you to complete this process or run the wizard again to create another share (see Figure 2.9).

Figure 2.9. The Sharing Was Successful page provides a summary about the newly created share.

Unlike Windows 2000, which installs Internet Information Services (IIS) 5 by default, IIS 6 is not deployed on standard versions of Windows Server 2003 unless you explicitly choose to install it. You can install IIS 6 by using the Configure Your Server Wizard as outlined previously or by going to the Control Panel, choosing Add or Remove Programs, and choosing Add/Remove Windows Components.

If you use the Configure Your Server Wizard to enable the server’s role as an application server, the wizard installs IIS 6. A quick look shows that only the World Wide Web service is installed. File Transfer Protocol (FTP), Network News Transfer Protocol (NNTP), and Simple Mail Transfer Protocol (SMTP) are not added by default when you establish the server role in this way.

If you want to add those other services, you must go to Add or Remove Programs and choose Add/Remove Windows Components. In the Windows Components dialog box, highlight Application Server, and click Details to choose Internet Information Services. Then highlight Internet Information Services and click Details to select just the services you want to install.

Under Windows 2000 Server, default security templates for web servers as well as secure and high-security templates were deployed on IIS systems through the Group Policy linked to an OU where the accounts for IIS servers were found.

This deployment method is no longer applicable under Windows Server 2003. When you install IIS, it runs with almost everything disabled and almost fully locked down. At the end of the installation, about the only thing you can do with the server is have it respond to client requests and serve up static (HTML) content. Therefore, no other content, such as Active Server Pages (ASP), ASP.NET pages, WebDAV publishing, and FrontPage Server Extensions, can be hosted from the server until you explicitly enable it.

In fact, a new Group Policy setting, Prevent IIS from Installing, enables Domain and Enterprise Administrators to control which Windows Server 2003 systems are allowed to install IIS 6.

You can use the Configure Your Server Wizard to enable your server as a print server. After you select the print server role, the wizard displays the Printers and Printer Drivers page (see Figure 2.10), where you select which network clients should have printers installed. You can choose one of two options: Windows 2000 and Windows XP Clients Only or All Windows Clients.

Figure 2.10. The Printers and Printer Drivers page is where you can select how to handle printer drivers for network clients.

At this point, the Add Printer Wizard starts, and you step through the prompts of choosing a local printer or a network printer. You can specify the local printer yourself or let Plug and Play find it. You then have the option of choosing one of the local ports already available on the system or creating a new one (see Figure 2.11).

Figure 2.11. Use the Select a Printer Port page to specify a port for the printer or create a new one.

You then choose the make and model of the printer attached to the port you selected earlier. On Windows Server 2003 configurations, all printers added with the Add Printer Wizard are shared by default. If for some reason you do not want to share the printer, you must manually deselect this default option. If the server is a member of a domain, the printer is also published in Active Directory by default.

When you run the Configure Your Server Wizard to set up your server in the mail server role, you can choose how your users are authenticated to the POP3 service: through the accounts that are local to the server, through Active Directory, or via an encrypted password file (see Figure 2.12).

Figure 2.12. You configure how users are authenticated for mail service via the Configure POP3 Service page.

This setting enables users to connect to the server and download email to their local systems by using Outlook, Outlook Express, or any other email client that supports POP3. After making your selection, the POP3 and SMTP services are installed on the local system.

After the process is completed, the Internet Information Services (IIS) Manager appears on the Administrative Tools menu. The IIS Manager enables administrators to configure the SMTP service that the Configure Your Server Wizard installed.

Configuring the SMTP service for this use is no different than any other SMTP configuration in Exchange Server 5.x, 2000, and 2003 or within IIS 4 and 5. Configuring the POP3 service is done through the POP3 Service MMC or through the command line by using WINPOP.

The usable WINPOP commands are as follows:

WINPOP.EXE <cmd> [<parameters>]
ADD, CHANGEPWD, CREATEQUOTAFILE, DEL ¦ DELETE, GET, LIST, LOCK, MIGRATETOAD, SET, STAT, UNLOCK
Options:ADD <domainname> ¦ <user@domainname [/CREATEUSER <password>]>
CHANGEPWD <user@domainname> <new password>
CREATEQUOTAFILE <user@domainname> [/USER:user]
Note: Quota files are created by default when adding mailboxes (for SAM and AD authentication)
/USER: To specify a different user account the quota file will reference.
DEL ¦ DELETE <domainname> ¦ <user@domainname [/DELETEUSER]>
GET <property>
LIST [domainname]
LOCK <domainname ¦ user@domainname>
MIGRATETOAD <user@domainname>
SET <property> <value>
STAT [domainname]
UNLOCK <domainname ¦ user@domainname>

The POP3 Service MMC also enables you to perform all these actions through a graphical user interface (GUI). You can complete tasks such as setting the authentication method, configuring the POP3 mail store, and setting the mail server to require Secure Password Authentication in whatever way you’re most comfortable working. You can also set the POP3 service state, the number of sockets, and the number of threads the service uses.

Like many of the other roles described so far, the terminal server role can be set up by running the Configure Your Server Wizard or by opening the Add or Remove Programs applet in the Control Panel, selecting Add/Remove Windows Components, and then Terminal Server.

Note that when you install Terminal Services by running the Configure Your Server Wizard, you see a warning that the system will be rebooted as part of the installation process. There is no option to cancel the reboot until later; it occurs as part of the process. No forewarning is given about a reboot when you install the role through Control Panel; however, you are given the option to reboot later through a dialog box.

The installation process has changed since Windows 2000 Server, most noticeably in the capability to configure security modes for operating the terminal server and the lack of an option to install Terminal Services in Application or Remote Administration mode. However, if you install it using the Add or Remove Programs icon it is the same as the application mode in Windows 2000.

Remote Desktop for Administration is now used in place of the Terminal Services in Remote Administration mode. This new feature allows server administration from most systems on your network. No licenses are required, and up to two simultaneous remote connections are allowed in addition to someone logged in at the local console.

To enable Remote Desktop on a system, go to the Remote tab of the System Properties dialog box and select the Allow Users to Connect Remotely to This Computer check box (see Figure 2.13).

Figure 2.13. You can enable Remote Desktop on your Windows Server 2003 system via the Remote tab of the System Properties dialog box.

Running in the terminal server role, your server can operate in two security modes:

After the terminal server role has been established on the server, you need to configure two additional items: Internet Explorer Enhanced Security Configuration settings and configuring the Terminal Server License Server.

When you enable Internet Explorer Enhanced Security Configuration, users that log on as an administrator have high security settings configured for the Internet and local intranet security zones to disable scripts from running. The Microsoft Virtual Machine (VM) and Microsoft ActiveX controls are disabled, and users are prevented from downloading files in these zones.

Medium security settings are configured for the trusted sites zone only, which effectively means that trusted sites, by default, are the only ones that allow Internet Explorer to completely render websites as they are actually designed. Although static HTML pages are usually not affected in the Internet and local intranet zones, pages designed with Microsoft VM and ActiveX controls are not displayed or don’t function correctly.

The Terminal Server License Server must also be configured so that it continues to function normally after installation. When a server is set up in the terminal server role on a Windows Server 2003 system, it runs for only 120 days from the date of the first client logon without the license server in place. After that time, the system stops accepting connections from unlicensed clients.

The Terminal Server Licensing Service is installed via Control Panel, Add or Remove Programs, Add/Remove Windows Components, Terminal Server Licensing and can be enabled at the enterprise level, domain level, or workgroup level. After the service is installed, you can activate the Terminal Server License Server in the Terminal Server Licensing MMC. Right-click the Terminal Server License Server you want to activate, and choose Activate Server to start the Terminal Server License Server Activation Wizard. In the Connection Method page, click the Automatic Connection to Connect over the Internet link after providing the required information for your company.

After completing this process, you need to install the client access licenses (CALs) on the Terminal Server License Server for your clients to use when they connect to the terminal server. When a client makes a first-time connection to a terminal server, the server locates a Terminal Server License Server to issue a new CAL to the client.

You can set up the DNS server role by running the Configure Your Server Wizard or through Control Panel, Add or Remove Programs, Add/Remove Windows Components, Networking Services, Domain Name System (DNS). (To install DNS only, click the Networking Services option in the Components list, and click the Details button.)

If you opt to use the Configure Your Server Wizard, click the Add or Remove Role prompt in the Manage Your Server window, click Next, and then click DNS Server, which installs DNS and runs the Configure a DNS Server Wizard (see Figure 2.14).

Figure 2.14. You can install DNS via the Configure a DNS Server Wizard.

In the wizard’s Configuration Action page, you can create a forward lookup zone only, a forward and reverse lookup zone, or root hints only.

In the Primary Server Location page, you have the option to choose where the DNS and SRV records for your zone are maintained. You can choose the server you are configuring, which enables you to set up a primary forward lookup zone. You can also choose a secondary forward lookup zone, which is set up if another DNS server is authoritative for the zone, and the copy to be installed on this server should be a read-only copy.

Next, in the Zone name page, enter the name of the DNS zone you are enabling on this server, such as cert.zandri.net or gunderville.com.

The next page is the Zone File page, where you set the path of the standard primary or standard secondary DNS zone file. (The type depends on the answer you provided in the Primary Server Location page.)

In the Dynamic Update page (see Figure 2.15), notice that the default selection is Do Not Allow Dynamic Updates because this is the most secure option when zones are set up as standard primary zones. (A standard secondary zone is a readonly copy and can’t be edited directly.)

Figure 2.15. You can specify which type of updates to allow for your DNS zone via the Dynamic Update page.

In the Forwarders page, you can enter IP addresses to specify whether your DNS server should forward lookup queries to DNS servers outside your location to another DNS server in your enterprise, or whether it should forward lookup queries to an ISP-owned DNS server.

In the next page, Completing the Configure a DNS Server Wizard, you can click Back to change any of the settings or click the Finish button to complete the installation of the service as configured.

The Configure Your Server Wizard then displays the This Server Is Now a DNS Server page. If needed, you can review the installation logs at systemrootDebugConfigure Your Server.log.

Under security information for DNS in “Need to Know More?” at the end of this chapter, the link supplied there takes you to a page listing a few of the typical threats your DNS infrastructure might be susceptible to, including denial-of-service (DoS) attacks, data modification, and DNS redirection. Proper setup and configuration of your DNS server provide some defense against these attacks; the rest is up to the defenses and firewalls enabled on your network.

You can set up the DHCP server role by running the Configure Your Server Wizard or through Control Panel, Add or Remove Programs, Add/Remove Windows Components, Networking Services, Dynamic Host Configuration Protocol (DHCP). To install only DHCP, highlight Networking Services in the Components list, and click the Details button.

In the Manage Your Server window, click Add or Remove a Role, click Next, select DHCP Server, and then click Next. The Configure Your Server Wizard installs the DHCP service and starts the New Scope Wizard to configure a new IP address scope for your DHCP server.

In the Scope Name page, enter a name for the scope. In the Description text box, you can optionally enter a descriptive entry for the scope.

Next is the IP Address Range page, where you define the IP address range this particular scope hands out to clients. To do this, type the IP address for the start of the range and the IP address for the end of the range. The wizard uses the IP address class denominator that you enter to determine the correct subnet mask in the Subnet Mask section. For example, the wizard knows that 131.15.0.1 is the start of the Class B range of addresses and sets the default subnet mask to 255.255.0.0. If necessary, you can change the default address to another address in use in your environment.

Excluding certain IP addresses in the Add Exclusions page configures the DHCP server to not lease these addresses to client systems. If the range of addresses in this scope is 199.168.1.5 through 199.168.1.254, and you want to exclude the 199.168.1.15 address (which belongs to a server with this address as a static entry, for example), enter the single address as an exclusion. If a range from this scope is dedicated as manually entered IP addresses for 10 printers on the floor where this scope is active, for example, enter the entire range as an exclusion, such as 199.168.1.21 through 199.168.1.30.

After you have entered any exclusions necessary for this scope, you arrive at the Lease Duration page, where you can define the length of time (in days, hours, and minutes) a client can use an IP address from this scope.

The DHCP server leases IP addresses to its clients. Each lease has an expiration date and time; the default duration is eight days. The client must renew the lease if it will continue to use that IP address. Defining the lease’s duration eases client administration, but this step is optional. If you leave all fields of the Lease Duration page blank and click Next, clients can still obtain IP addresses from the DHCP server.

In the Configure DHCP Options page, you can specify whether to configure additional DHCP options at this time. (If you decide not to, you can always return to the scope later and make these changes.) Using the default setting, Yes, is best, as one of the settings is the IP address of the router (default gateway), which allows clients that obtain a lease to have a default path out of their local subnet.

In the Configure DHCP Options section of the Domain Name and DNS Server page, you can assign DHCP clients the IP addresses of the preferred DNS servers they should use. You can also configure IP addresses of preferred NetBIOS name servers (WINS) for clients in the following page. Activating this newly created scope is the final step of setting up a DHCP server role.

You can set up the Windows Internet Naming Service (WINS) server role by running the Configure Your Server Wizard or through Control Panel, Add or Remove Programs, Add/Remove Windows Components, Networking Services, Windows Internet Naming Service (WINS). To install only WINS, highlight Networking Services in the Components list, and click the Details button.

Of all the server roles discussed in this chapter, this one is the easiest to configure with the Configure Your Server Wizard. In the Manage Your Server window, select Add or Remove Role and click Next. Then choose WINS Server, which installs WINS. After this process is completed on the server end, the WINS server will be running on your network.

The setup wizard uses several default configuration parameters for how NetBIOS name records are managed in the WINS server database; these parameters are fine for most environments.

Removing the role is just as easy: Simply run the Configure Your Server Wizard a second time and choose WINS to remove the role.

When it comes to securing domain controllers, ask why someone needs to log on locally at the console. This question is valid for many member servers as well. There should be a valid business reason (and proper change control) for working locally on a domain controller or any server system when most work can be done remotely with remote tools.

This brings me to my next point—limiting administrative access. Very few people should have Domain Administrator access, and even fewer should have Enterprise administrator permissions. Domain Administrator access should be limited to a select few people who need that level of access control over the domain. These users should also be trained and instructed (if they are not fully aware already) on the use of these domainwide unrestricted accounts.

They should not log in with administrative access to perform day-to-day work on their desktop systems and on servers except when necessary. More often than not, logging in on a daily basis with a standard user account (or perhaps a power user or server operator account) is usually good enough. When additional rights are necessary, administrators can always run the Run As service to be authenticated to the services they need to access with their administrator account.

By default, power users on local systems can install programs that do not modify operating system files or install system services. They can also create and manage local user accounts and groups, stop and start system services, and modify resources on systems through the Control Panel.

Server operators can log on interactively to domain controllers and create and delete shared resources. They also have permissions to start and stop some domainwide services, back up and restore data, format disk drives, and shut down the system.

The RUNAS command enables you to run EXE and MMC programs as another user. In this way, you can run the program at a higher level of privilege than your current settings allow. The Run As service requires the Secondary Logon service to be running on the local system. To start the Run As service for Control Panel programs, you still need to hold the Shift key down, right-click the shortcut you want to run, and choose Run As. For other Start menu icons and actual EXEs from within Windows Explorer, you just need to right-click them to get RUNAS to appear on the shortcut menu. You can also issue the command from the Run dialog box or at a command prompt.

When providing Domain Administrator access, users should be given their own accounts so that if necessary, administrative actions can be traced back to the specific user. If everyone used the default Administrator account, there would be no way to know who performed a certain action because it could have been anyone with that account access. Best practices dictate that the default Administrator account should be renamed; use a complex password and limit access to that password for emergencies only.

Enterprise Administrator accounts should be handed out even more sparingly because they have Full Control permissions over all domains in the enterprise. They too should be assigned to just those users who need this level of access and protected even more rigorously.

Many white papers and KnowledgeBase articles state that Windows Server 2003 is “secure out of the box.” I would counter that it is “more secure out of the box” because the only system that’s truly secure is one that is “never taken out of the box.” There have been great strides to make Windows Server 2003 as secure out of the box as possible. These efforts have brought the server operating system light years ahead of Windows NT Server 4 and Windows 2000 Server.

On the one hand, more than half of the system services installed by default under the basic Windows Server 2003 installation are not enabled for automatic startup (instead, they’re set to Manual) or are outright disabled. Most network services are not enabled until an administrator explicitly does so. With all these advances in default settings, it is still up to system administrators to have (or get) the required level of training and acquire the necessary level of knowledge to keep systems secure.

As mentioned earlier, there are steps you can take to limit system controls. In addition to limiting services on systems to only those who need them, you can, for example, take steps to allow only necessary traffic on your networks.

From an external to internal perspective, there is no need to allow certain port traffic through your firewall at the network’s perimeter if this type of access is not necessary. You might use FTP (port 20 and 21) to push data from one segregated subnet to another on the WAN, but if you never cross the firewall to the public network (in or out), there is no need to have that port open full time. If organizational needs required opening this port, however, you could enable change controls to make the necessary configuration changes and then close the ports when they’re no longer needed. Table 2.6 explains some of the more commonly used default Transmission Control Protocol (TCP) ports.

If there is no reason to allow this port traffic, the outside firewalls should deny it. This is especially critical for demilitarized zone (DMZ) systems that Internet users access; you should have those firewalls finely tuned to only the necessary traffic, and you might want to consider blocking the ports on the servers themselves.

One method to stop traffic to specific servers is by using Internet Connection Firewall (ICF). For example, if you have an FTP server in the DMZ next to an IIS server, the FTP server could be subjected to port 80 attacks because the firewall allows that traffic to pass through to connect to the IIS server. If port 80 is open on the FTP server (it would be by default), the system could be compromised on that allowed port.

You can configure ICF on the server to deny that traffic. To do that, follow these steps:

ICF also enables you to set logging information on system attempts and Internet Control Message Protocol (ICMP) traffic behavior. Network cards on servers can also be configured to allow only specific traffic.

If you are concerned that ICF could be defeated, you can configure the TCP/IP protocol bound to the specific network card to allow only specific traffic. To do this, follow these steps: