BEST Security Config for e-Commerce

by Francois de Beer <fbeer(at)sars.gov.za>

 Date:  Fri, 4 Feb 2000 09:34:44 +0200
 To:  hwg-techniques(at)hwg.org
  todo: View Thread, Original
Hi all.

On In-House NT Server and IIS talkin to a Separate SQL Server6.5/7, What
would YOUR Suggestions be on secure e-Commerce transactions?

I want the whole lot that has been used in the wild:
Gautlet?
Firewall?
SSL?
NTFS?
Certificates?
ANY newer Ideas?

What products would you prefer and why?
Most of you should have set up several such configs and for me to explore
all other options (exempt of course the ones we use) could take months..

PS(for those of you who run asp on iis4.. PLEASE Consider installing a file
called: vrdcon4i.exe from Micky-Soft. It fixed the ::$DATA bug on our
servers that not even SP5 for NT could. 

Now please note: In OUR environment, we could use the file
ftp://ftp.microsoft.com/bussys/iis/iis-public/fixes/usa/security/iis4-datafi
x/iis4fixi.exe on NT SP3
 
BUT when we went over to SP5 we had to use the hotfix vrdcon4i.exe at 

Info: http://www.microsoft.com/downloads/release.asp?ReleaseID=16378

File for Fix:
http://download.microsoft.com/download/iis40/Patch/4.2.727.1/NT4/EN-US/vrdco
n4i.exe

File for fix and Debug:
http://download.microsoft.com/download/iis40/Patch/4.2.727.1/NT4/EN-US/vrdco
n4is.exe

Just a tip. To test YOUR security: Type http://yourURL/Global.asa::$DATA (If
applicable) Press enter (obviously) and view the source...... This is also
applicable to view asp code but the global.asa usually contains all the
logon info.

Also. PLEASE let us not fight about the products or shoot down someone's
suggestion. If someone suggested a product and you have a good reason why
NOT to use it, then please state so in a friendly tone..

;-)
Thanx
Beer

HWG hwg-techniques mailing list archives, maintained by Web Professional Association - IWA

This page is part of a preserved archive of archives.hwg.org. The site is no longer active and its content is not maintained. For enquiries about this archive, write to archive(at)iwanet.org.