0

I would like to host a service (written in C#) on my server and allow it to be accessed from outside the network.

I know that I need to open a port in the firewall for this to work, and I managed to do this, but I have no idea how safe this is.

Is anyone able to advise on what basic precautions should be taken, or point me towards a resource which might help?

Some basic details:

  • Windows Server 2012
  • C# WCF Service
  • Hosted on IIS
  • MS Access Database
  • No SSL - I have not managed to get this working, but the data being sent is not sensitive so I think this should be okay?

I have taken some precautions in the service itself, for example I have parameterised database queries/inserts and I should be able to ask the user to include some sort of username/password in their message.

I also noticed that in windows firewall there is a Only allow connections from these computers option under Remote Computers when creating a rule. How reliable is this?

Much appreciate any help at all as I have no idea where to start with this!

2
  • 1
    There's multiple questions here, an open port by itself is arguably no risk, it depends on what is listening on that port. If you can lock that port down to connections from specific IPs that is certainly a big help. You should look at pen testing this service if it is publicly accessible. SSL is always an advantage, 'sensitive' data or not and you should look at adding authentication. Pen testing is too broad to cover here, seek professional help if this isn't a skill you want to learn yourself.
    – iainpb
    Jun 8 '17 at 13:04
  • Google search results produce a number of resources for you to get started. Jun 8 '17 at 13:43
1

I have taken some precautions in the service itself, for example I have parameterised database queries/inserts and I should be able to ask the user to include some sort of username/password in their message.

If you are asking them to pass a username and/or password of sorts through to the service it ideally wants to be running over HTTPS.

I also noticed that in windows firewall there is a Only allow connections from these computers option under Remote Computers when creating a rule. How reliable is this?

I would personally stick with IP restrictions if its a publically facing service. You can either whitelist or black list IPs. White listing is obviously more secure.

Much appreciate any help at all as I have no idea where to start with this!

I would make sure you pen test your service (application) before publishing it. You mention you have done some protection against user input, but I would spend some time going through testing it in as much detail as possible - ideally ask a third party to help, they may spot things you missed. For example make sure any authentication you are using is strong, and that your application doesn't have any errors that may allow an attacker to circumvent your access control. e.g. Check that all service paths require the correct authentication, and log successsful and failed attempts so you can see what sort of attacks are being tried.

Regarding the server security, the usual protection mechanisms should be used:

  • Change any default passwords for the server/services
  • Choose strong passwords
  • Test that only open ports are exposed, close the ports and services that are not needed
  • Install a good AV
  • Regularly patch the OS and any applications
  • Regularly re-test the above to make sure nothing has changed and accidentally exposed your server and/or application.
2
  • Thanks so much for your answer. We have a small IT team which may be able to help with some of the pen testing, and I will look into the rest of what you mentioned. I have 1 question - when you say I would personally stick with IP restrictions, is this found under Windows Firewall rules?
    – Bassie
    Jun 8 '17 at 13:20
  • 1
    Yes. Check this link out: howtogeek.com/112564/… I think you will find doing it by IP address is a better approach. It's worth noting (although I know you didn't ask, or probably need to know) that you can also filter by IP at IIS level. I would always apply the filtering to the firewall first and then IIS. For example. You could allow an IP range through the firewall into the server, and then break that range into different sites within IIS. All the best!
    – ISMSDEV
    Jun 8 '17 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.