Yiziphi izimbobo ezizovulelwa i-Active Directory, i-RDP, i-DNS, nokuningi ku-Windows Server

Ukuphatha inethiwekhi esekelwe ku-Windows Server kudinga ukuqonda okunembile ukuthi yimaphi ama-port okumele avulwe ukuze izinsizakalo zisebenze kahle. Kusukela ekuvumeleni ukungena ngemvume okude nokuqinisekisa ubuqiniso bomsebenzisi kuya ekuxazululeni kahle amagama esizinda, amaphrothokholi ahlukahlukene ancike kuma-port athile ukuze asebenze. Ukuze uphathe la ma-port ngempumelelo, kuyasiza ukubonisana ngolwazi mayelana nezinhlobo zama-port enethiwekhi.

Kungakhathaliseki ukuthi usetha iseva ye-Active Directory (AD) , iseva ye-DNS , noma uvumela ukufinyelela kwe-Remote Desktop (RDP) , ukudlulisela i-port kubalulekile. Ukudlulisela i-port ngendlela engafanele kungaholela ekwehlulekeni kokuxhumeka, ezinkingeni zokuqinisekisa, noma ngisho nokubeka engcupheni ukuphepha kwengqalasizinda yakho uma kushiywa ama-port amaningi kunokudingekile evuliwe.

Imiqondo evamile mayelana nezivumelwano nezimbobo ku-Windows Server

I-Windows Server isebenzisa izinsizakalo ezahlukahlukene ezidinga ama-port e-TCP ne-UDP avulekile . La ma-port avumela ukuxhumana phakathi kwamadivayisi nezinsizakalo ezahlukene ngaphakathi kwenethiwekhi ngisho nangaphandle. Amaphrothokholi amabili ayinhloko asetshenziswa kula ma-port yi -TCP (Transmission Control Protocol) kanye ne -UDP (User Datagram Protocol).

I-TCP ichazwa njengephrothokholi egxile ekuxhumekeni ethembekile futhi eqinisekisa ukuthi wonke amaphakethe afika ngokulandelana okufanele. Ngakho-ke, isetshenziswa kumasevisi adinga ukuzinza, njenge-HTTP, i-FTP, kanye ne-RDP. Ngakolunye uhlangothi, i-UDP ishesha kodwa ayithembeki kakhulu, yingakho ikhethelwa izinsizakalo ezifana ne-DNS, ukusakaza , imidlalo eku-inthanethi, njll.

Ngaphezu kwalokho, amachweba ahlukaniswe abe:

• Amachweba Aziwayo (0-1023): Kusetshenziswa izivumelwano ezijwayelekile ezifana ne-HTTP (80), DNS (53) noma ssh (22).
• Izimbobo ezibhalisiwe (1024-49151): Idalelwe izinsiza ezingajwayelekile noma izinhlelo zokusebenza. Bangabhaliswa yizinkampani.
• Izimbobo ezinamandla noma ze-ephemeral (49152-65535): Kusetshenziswa isistimu lapho iklayenti liqala ukuxhumana. Kwaziwa nangokuthi izimbobo ezingahleliwe noma zesikhashana.

Izimbobo ezisetshenziswa yi-Active Directory (AD)

I-Active Directory iyinhliziyo yanoma iyiphi inethiwekhi yesizinda esekelwe ku-Windows. Ukuze izinsizakalo zayo zisebenze kahle, kubalulekile ukuvula amachweba amaningana ayisihluthulelo, ahlobene kakhulu nezinqubo ze -LDAP, Kerberos, kanye ne-RPC . Ungathola ulwazi olwengeziwe mayelana nendlela yokuxhumana nalezi zinsizakalo ekucushweni okuhlukahlukene.

Phakathi kokubaluleke kakhulu esinakho:

• I-TCP/UDP 389: Yichweba elisetshenziswa yi-LDAP (I-Lightweight Directory Access Protocol). Kubaluleke kakhulu ukuqinisekiswa komsebenzisi kanye nokuphindaphinda uhla lwemibhalo.
• I-TCP 636: Isetshenziselwa i-LDAP phezu kwe-SSL (LDAPS).
• I-TCP/UDP 88: Ihlotshaniswa nephrothokholi ye-Kerberos, esetshenziselwa ukufakazela ubuqiniso.
• I-TCP 445: Isetshenziswa yi-SMB ekwabelaneni ngefayela nephrinta.
• I-TCP 135: RPC endpoint mapper.
• I-TCP 3268 / 3269: Ikhathalogi yomhlaba wonke (GC). 3268 ekusesheni, kanye no-3269 lapho uxhumano oluvikelekile (SSL) ludingeka.
• I-TCP 9389: I-Active Directory Web Services (ADWS).
• I-TCP/UDP 53: Imbobo yokulungiswa kwe-DNS.
• I-TCP 49152–65535: Ububanzi bembobo eguqukayo ye-RPC.

Lezi zimbobo kumele zitholakale kuzo zonke izilawuli zesizinda nezinhlelo ezisebenzisana ne-Active Directory. Ngaphezu kwalokho, uma usebenza nezilawuli zesizinda kumasayithi noma amanethiwekhi ahlukene, qiniseka ukuthi lezi zimbobo zivuliwe phakathi kwezindawo.

Izimbobo ziyadingeka ku-Remote Desktop (RDP)

I-Remote Desktop (RDP) ingenye yezici ezisetshenziswa kakhulu ezindaweni ze-Windows Server. I-port yayo ezenzakalelayo yi- TCP 3389 , yize lokhu kungashintshwa ngezizathu zokuphepha. Ukugcina ukufinyelela okuphephile kubalulekile ekuvikeleni inethiwekhi yakho.

Kuye nengqalasizinda kanye nenani lezindima ezisetshenzisiwe (ezifana ne-RD Gateway, i-RD Licensing, i-RD Session Host, njll.), izimbobo ezidingekayo ziyahlukahluka. Lapha sikubonisa okubalulekile:

• I-TCP/UDP 3389: Imbobo ye-RDP ezenzakalelayo.
• I-TCP 443: Uma i-Remote Desktop ngeWeb (RDWeb) noma i-Gateway isetshenziswa, ifakwe ku-HTTPS.
• UDP 3391: Ithrafikhi ye-RDP nge-UDP, isebenza kahle kakhulu uma isetshenziswa ne-Gateway.
• I-TCP 5504: Ukuxhumana phakathi kokufinyelela kuwebhu kanye nomthengisi wokuxhuma.
• I-TCP 5985: Okokuphatha nge I-PowerShell kanye ne-WMI.
• I-TCP 445: Ukuxhumana kwe-SMB phakathi kweseva yelayisensi nomsingathi.
• I-TCP 139 / UDP 137-138: Amasevisi e-NetBIOS asetshenziswa ezindaweni zefa.
• I-TCP 49152–65535: Ukusetshenziswa okunamandla yi-RPC.

Lawa machweba kumele avulwe kuye ngendima ethile esetshenziswa ngaphakathi kweseva ye-RDS. Uma usebenzisa uxhumano lwe-inthanethi noma ama-load balancers, i-RD Gateway iba yindlela efanelekile yokufaka i-RDP ku-HTTPS nokugwema izinkinga ngama-firewall noma ama-NAT.

Izimbobo zamaseva e-DNS

I-DNS (Domain Name System) ivumela amakhompyutha angaphakathi noma angaphandle kwenethiwekhi ukuxazulula amagama esizinda afana ne-"server.contoso.local" kumakheli e-IP. Qiniseka ukuthi ilungiselelwe kahle; ungafunda kabanzi mayelana nokuthi amaseva e-DNS asebenza kanjani.

Izimbobo ezibalulekile zale sevisi yilezi:

• UDP 53: Ngemibuzo eminingi ye-DNS.
• I-TCP 53: Isetshenziswa uma impendulo idlula usayizi wephakethe le-UDP noma ukudluliselwa kwendawo kuya kwezoni phakathi kwamaseva e-DNS.

Njengazo zonke izinsiza, kuwumqondo omuhle ukugcina izimbobo zivuliwe kuphela kumakhompuyutha asebenza njengamaseva e-DNS, futhi usebenzise imithetho ye-firewall ukuze uhlunge ukufinyelela kumanethiwekhi angagunyaziwe.

Izimbobo ze-DHCP kanye ne-WINS

Kumanethiwekhi lapho amakheli e-IP anikezwa khona ngokuguquguqukayo nge- DHCP , kuyadingeka ukuvumela amachweba athile:

• UDP 67: Ilalelwe iseva ye-DHCP.
• UDP 68: Isetshenziswa amaklayenti ukuthola ukucushwa.

I-WINS, nakuba ihoxisiwe, isengaba khona ezindaweni zefa ngezinhlelo zokusebenza zefa:

• UDP 137: Ukulungiswa kwegama le-NetBIOS.
• UDP 138: Izinsizakalo zedathagram ye-NetBIOS.
• I-TCP 139: Izikhathi ze-NetBIOS.

Uma ungasebenzisi lezi zinsizakalo, kunconywa kakhulu ukuthi uzikhubaze bese uvala ama-port ahambisanayo ukuze uvimbele ubuthakathaka. Ungafunda futhi ukuthi ungawaphatha kanjani kahle amadivayisi e-USB njengengxenye yokuphepha kwesistimu yakho iyonke.

Izimbobo ziyadingeka kumaseva wokuphrinta

Amaseva wokuphrinta angaphinda amele indawo yokuchayeka uma izimbobo ezingasetshenzisiwe zishiywa zivuliwe. Ngakho-ke, uma uphatha imigqa yokuphrinta nge-Windows Server, qiniseka ukuthi lezi zimbobo ziyasebenza:

• I-TCP 135: I-RPC.
• I-UDP 137-138: I-NetBIOS iyadingeka ekwabelaneni ngephrinta kumanethiwekhi wefa.
• I-TCP 139: Ukuxhumana kwe-NetBIOS nge-TCP.
• I-TCP 445: Iphrothokholi ye-SMB yokwabelana ngamafayela namaphrinta.

Kungumqondo omuhle futhi ukuvula izimbobo eziphezulu eziguqukayo ezisetshenziswa iphrothokholi ye-RPC (49152–65535) uma iseva yokuphrinta izophathwa ukude. Ukukhohlisa lezi zimbobo kungaba semqoka ekusebenzeni kahle nokuphephile.

Izimbobo Zesevisi Yesikhathi (NTP/SNTP)

I-Windows Server ihlanganisa ngokuzenzakalelayo isevisi ye-Windows Time (W32Time), evumelanisa iwashi lesistimu nemithombo yangaphandle noma izilawuli zesizinda. Ukugcina isikhathi esinembile kubalulekile ekuvikelekeni kwesistimu nokusebenza.

Izikebhe zale sevisi yilezi:

• UDP 123: Imbobo esetshenziswa yi-NTP ne-SNTP.

Le mbobo kufanele ivuleke uma iseva ivumelanisa nomthombo wesikhathi wangaphandle, noma uma amanye amakhompyutha kunethiwekhi eyisebenzisa njengereferensi yesikhathi.

Izimbobo zezinsizakalo ze-imeyili (SMTP, POP3, IMAP)

Uma uneseva yemeyili, efana ne-Microsoft Exchange noma enye iseva esekelwe ku-Windows Server, udinga ukuvula:

• I-TCP 25: I-SMTP (ukuthumela i-imeyili).
• I-TCP 465 / 587: I-SMTP ene-SSL noma i-TLS.
• I-TCP 110: I-POP3.
• I-TCP 995: I-POP3 ene-SSL.
• I-TCP 143: I-IMAP.
• I-TCP 993: I-IMAP nge-SSL.

Isincomo ukusebenzisa ama-port abethelwe bese ususa noma uvimba ama-port ahlobene namaphrothokholi angavikelekile ukuze ugcine ubuqotho bokuxhumana kwakho. Ungafunda kabanzi mayelana nokuphathwa kwesistimu yokusebenza ku -Windows 11.

Izimbobo zezinsizakalo zewebhu ku-IIS

Uma iseva yakho isingatha amakhasi ewebhu isebenzisa i-Internet Information Services (IIS) , kuzodingeka uvule amachweba alandelayo ku-firewall yakho:

• I-TCP 80: I-HTTP (akukho ukubethela).
• I-TCP 443: I-HTTPS (ukubethela kwe-SSL/TLS).
• I-TCP 8080: Enye imbobo ye-HTTP, evame ukusetshenziswa ekuthuthukisweni noma ekulawuleni.

Kubalulekile ukuba nezitifiketi ezivumelekile ukuqinisekisa ukuthi ithrafikhi ye-HTTPS isebenza kahle futhi ugweme izexwayiso zokuphepha esipheqululini sakho. Khumbula ukuthi uma uphatha iziphakeli zakho, kubalulekile ukuba nokuqonda okuphelele kwezimbobo ezivulekile ukuze ugweme ubungozi.

Ungabuka kanjani futhi uhlole ukuthi imaphi amachweba avuliwe ku-Windows Server

Kusukela kusistimu ngokwayo ungasebenzisa izindlela ezimbalwa:

• netstat -an: Ibonisa konke ukuxhumana okusebenzayo nezimbobo zokulalela.
• Thola-NetTCPConnection (I-PowerShell): Iwusizo kakhulu ekufakeni kuhlu uxhumano lwe-TCP olusebenzayo.
• i-telnet : Hlola ukuthi imbobo iyafinyeleleka kwenye ikhompuyutha.
• I-Test-NetConnection: Umyalo owengeziwe wesimanje we-PowerShell wokuhlola ukuxhumeka.

Isibonelo:

Test-NetConnection -ComputerName servidor.contoso.local -Port 3389

Ungasebenzisa futhi i-nmap kusuka komunye umshini ukuskena uhla lwamachweba, okuyinto ekahle kakhulu ekuhlolweni. Ukuze uthole ukuskena nokuqapha okuphumelelayo, cabanga ngokufunda ngesofthiwe yokuqapha engakusiza ukuphatha kangcono izinsiza zakho.

Izimbobo eziyingozi noma ezivame ukuxhashazwa

Kunamachweba abekade eyizisulu zokuhlaselwa okukhulu. Ezinye izibonelo:

• I-TCP 3389: I-RDP ihlaselwe ngonya emikhankasweni eminingi ye-ransomware.
• I-TCP 445: Ixhashazwe ngu I-malware njengo-WannaCry.
• I-TCP 23: I-Telnet, ngaphandle kokubethela, akufanele neze ivezwe.
• UDP 161: I-SNMP, uma ingasetshenziswanga, kungcono ukuyivala.

Ukushiya la machweba evuliwe ngokungadingekile kungenye yamaphutha avame kakhulu okuphepha kwe-cyber . Yenza ukuskena njalo kunethiwekhi yakho ukuze uthole lezi zimo. Ukuphathwa kwamachweba kuwumsebenzi oqhubekayo wokuvikela inethiwekhi yakho, ngakho-ke udinga ukwazi ukuthi ungawaxazulula kanjani amaphutha avamile angavela.

Imikhuba emihle yokuvula amachweba

• Vula kuphela izimbobo ezidingekayo: Okuncane kuningi mayelana nokuphepha.
• Sebenzisa ama-firewall asendaweni kanye ne-perimeter: Lungiselela ama-firewall kuseva ngayinye futhi emaphethelweni enethiwekhi.
• Shintsha izimbobo ezizenzakalelayo uma ukwazi: Ikakhulukazi ku-RDP, ukushintsha i-port 3389 kunciphisa ukuhlasela okuzenzakalelayo.
• Khawulela ukufinyelela nge-IP: Sebenzisa uhlu olugunyaziwe ukukhawulela ukuthi yimiphi imisuka engafinyelela kuseva yakho.
• Hlola ngezikhathi ezithile: Sebenzisa amathuluzi okuskena ukuze uthole izimbobo ezivuliwe ngokungadingekile.

Ukuphatha kahle izimbobo ezivulekile ku-Windows Server kubalulekile hhayi kuphela ukuqinisekisa ukuthi izinsizakalo zisebenza kahle, kodwa futhi nokunciphisa indawo yokuhlasela. Ukwazi indima ngayinye, yiziphi izimbobo ozidingayo, nokuthi ungazivikela kanjani kuzokusiza ube nengqalasizinda eqine kakhulu ngokumelene nezinsongo zangaphakathi noma zangaphandle.

I-athikili ehlobene:

Isixhumanisi se-Windows 365: I-PC encane esebenza Windows 11 kusukela emafini