Plan security for an external anonymous access environment (Search Server 2008)
Applies To: Microsoft Search Server 2008
Topic Last Modified: 2009-08-04
Note
Unless otherwise noted, the information in this article applies to both Microsoft Search Server 2008 and Microsoft Search Server 2008 Express.
Security guidance for an external anonymous access environment is to enable anonymous access to search functions while protecting back-end servers in the farm from direct user access or malicious actions that come through front-end Web servers.
There are several unique recommendations for an external anonymous access environment. Some of these recommendations might not be practical for all solutions.
In this article:
Protect back-end servers
Configure anonymous access
Secure the Central Administration site
Secure design checklist
Plan security hardening for server roles
Plan secure configurations for Search Server 2008 features
Protect back-end servers
Note
The information in this section does not apply to Microsoft Search Server 2008 Express. It applies to the full version of Microsoft Search Server 2008 only.
Hosting sites for anonymous use requires Internet-facing servers. You can limit the exposure to traffic from the Internet by protecting back-end servers. This includes the index server and other application server roles and servers that host databases:
Protect database servers At a minimum, place a firewall between front-end Web servers and servers that host databases. Some environments dictate that database servers be hosted in an internal network instead of directly in an extranet environment.
Protect application servers At a minimum, protect application servers by requiring Internet Protocol security (IPsec) to help secure communication between server farm computers. Additionally, you can put application servers behind the firewall used to protect database servers. Or, you can introduce an additional firewall between front-end Web servers and application servers.
Protect the index role The index component communicates through a front-end Web server to crawl content in sites. To protect this communication channel, consider configuring a dedicated front-end Web server for use by the index server. This isolates crawling communication to a front-end Web server that is inaccessible to users. Additionally, configure Internet Information Services (IIS) to restrict SiteData.asmx (the crawler SOAP service) to enable only the index server (or other crawlers) to access it. Providing a front-end Web server dedicated to content crawling also improves performance by reducing the load on the main front-end Web servers. This improves the user experience.
Configure anonymous access
For content to be available for anonymous access, the following must be configured:
The site or site collection must be configured to enable anonymous access.
At least one zone in the Web application must be configured to allow anonymous access.
Enable anonymous access only for Web applications that require unauthenticated access. If you want to use authentication for personalization, implement forms-based authentication by using a simple database authentication provider.
Secure the Central Administration site
Note
The information in this section does not apply to Microsoft Search Server 2008 Express. It applies to the full version of Microsoft Search Server 2008 only.
Because external users have access to the network zone, it is important to secure the Central Administration site to block external access and secure internal access:
Ensure that the Central Administration site is not hosted on a front-end Web server.
Block external access to the Central Administration site. This can be achieved by placing a firewall between front-end Web servers and the server that hosts the Central Administration site.
Configure the Central Administration site by using Secure Sockets Layer (SSL). This ensures that communication from the internal network to the Central Administration site is more secure.
Secure design checklist
Use this design checklist together with the checklists in Review the secure topology design checklists (Search Server 2008).
Topology
Note
The information in this section does not apply to Microsoft Search Server 2008 Express. It applies to the full version of Microsoft Search Server 2008 only.
[ ] |
Protect back-end servers by positioning at least one firewall between front-end Web servers and the application and database servers. |
[ ] |
Plan a dedicated front-end Web server for crawling content. Do not include this front-end Web server in the end-user front-end Web rotation. |
Logical architecture
[ ] |
Enable anonymous access only for Web application zones that host sites or site collections that are configured to allow anonymous access. For more information, see Plan authentication methods (Search Server 2008). |
[ ] |
Block access to the Central Administration site and configure SSL for the site. |
Plan security hardening for server roles
Note
The information in this section does not apply to Microsoft Search Server 2008 Express. It applies to the full version of Microsoft Search Server 2008 only.
The following table describes additional hardening recommendations for an external anonymous access environment.
| Component | Recommendation |
|---|---|
Ports |
Block external access to the port for the Central Administration site. |
Protocols |
Turn off SMTP. |
IIS |
If you are configuring a dedicated front-end Web server for indexing, configure IIS to restrict SiteData.asmx (the crawler SOAP service) to allow only the index server (or other crawlers) to access it. |
Plan secure configurations for Search Server 2008 features
The following table describes additional recommendations for securing Microsoft Search Server 2008 features in an external anonymous access environment.
| Feature or area | Recommendation |
|---|---|
Authentication |
Specify Anonymous authentication in IIS. |
See Also
Concepts
Plan environment-specific security (Search Server 2008)
Plan security for an internal team or department environment (Search Server 2008)
Plan security for an external secure search environment (Search Server 2008)