Securing Windows Server 2003

DNS and DHCP Together

If you’re using both DNS and DHCP on the same network, as many of us are, you should consider a couple of specific things that involve the interaction between these two components.

DHCP Service Account

As mentioned often throughout this book, all applications and services run within a user context. This user context provides the access control list (ACL) that’s used by the various access control mechanisms in Windows to determine whether access is granted or denied to an object. With the DHCP service, there is a specific concern about what account this service uses.

The DHCP server runs in the Local System security context. When the DHCP server is running on an Active Directory domain controller and contacts a DNS server for record registration, it contacts that DNS server in the domain controller’s computer account context. This means that the connection has significantly elevated privileges. Such a connection could be used by an attacker who has compromised one server to “bounce” to another server in a highly privileged context.

To mitigate this threat, you should create a service account specifically for the DHCP service. You must configure your DHCP servers to start the DHCP service in that user context. This will avoid the privileged context problem and help ensure that an attacker has as little leverage as possible against your servers.

Automatic Record Updating

DHCP has a wonderful feature in Windows Server 2003. It can register A and PTR records on behalf ...