Sign in
Microsoft.com
 
Microsoft
 
 
 

locked
Security when exposed to the internet... RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    I would like to hear from users that have exposed there WHS to the internet directly with the built in features.  I have resisted doing it to date out of concern for the data I store on the shares.  Years ago I exposed a linux server to the internet and it wasn't a day before I was receiving various attempts to ssh/remote into the machine using common root passwords.  The nice thing was the linux distribution I was using neatly packaged up the various relevant portions of the logs and emailed them to me.

    But my employer has Windows 2003 Small Business Server exposed and we have not detected an attack so I'm beginning to reconsider turning on the internet features.  I have the usual things in place, autoupdate, router/firewall, decent passwords (will have to strengthen the kids though).

    So, has anyone had a security breach on the WHS?

     

    -Thanks,

    Sean

     

    Monday, March 9, 2009 6:44 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote
    Exposing a web server incurs increased risk. If there is a "zero day" exploit, nothing but an internal network that's not connected to the Internet at large will protect you.

    That said, Windows Home Server is built on Windows Server 2003, so it has that operating system's built-in firewall. Further, Windows Home Server only exposes the minimum set of ports to the internet: 80, 443, and 4125. So you're relatively safe. If you make your server available on the Internet, you should anticipate that it will be probed fairly regularly; mine is, at least. (Servers on home networks are a prime target for hackers, spammers, botnets, etc.) However, I've never had an intrusion.
    I'm not on the WHS team, I just post a lot. :)
    Monday, March 9, 2009 7:07 PM
    Moderator
  • Question
    Sign in to vote
    0
    Sign in to vote
    ssbktt said:

    I would like to hear from users that have exposed there WHS to the internet directly with the built in features.  I have resisted doing it to date out of concern for the data I store on the shares.  Years ago I exposed a linux server to the internet and it wasn't a day before I was receiving various attempts to ssh/remote into the machine using common root passwords.  The nice thing was the linux distribution I was using neatly packaged up the various relevant portions of the logs and emailed them to me.

    But my employer has Windows 2003 Small Business Server exposed and we have not detected an attack so I'm beginning to reconsider turning on the internet features.  I have the usual things in place, autoupdate, router/firewall, decent passwords (will have to strengthen the kids though).

    So, has anyone had a security breach on the WHS?

     

    -Thanks,

    Sean

     



    I've never been hacked either.  However, I went one step further than what Ken mentioned:  I decided not to forward port 80 in my router.  In order to logon to my website, you must use https (http gets you nothing :)  ).
    Tuesday, March 10, 2009 12:53 AM
    Moderator