Slashdot Mirror
Microsoft Releases Windows Server 2003 SP1
Masq666 writes "Microsoft has wrapped up development on the first major update to its Windows Server 2003 operating system and released it for download, The company said that Windows Server 2003 Service Pack 1 is currently available for download via Microsoft's site and will soon start showing up on new servers. Among the primary benefits of the free update is the inclusion of security enhancements similar to those added to Windows XP with last year's Service Pack 2. News.com.com has more details and commentary."
First new and improved script-kiddie exploits available in 3...2..1...
I've been using the latest RC as a desktop OS for a while, and it's pretty good; it does have some issues with Steam, but then again, it's not meant to be a gaming OS, just a server OS.
All in all, though, it's damn stable and secure as is, and it's pretty responsive.
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
OK, I am not a Windows Server 2003 admin, but is it just me, or is it really odd that Microsoft is just now including a firewall?
If you don't know what AltaVista is (was), get off my lawn.
So what is "later this year" in Microsoft time?
This?
http://www.winsupersite.com/showcase/longhorn_pre
Longhorn Milestone 9 (M9) and platform complete
March 2005
Longhorn Beta 1
Late May 2005
Longhorn Beta 2
October 2005
Longhorn Release Candidate 0 (RC0)
Late February 2006
Longhorn Release Candidate 1 (RC1)
April 2006
Longhorn release to manufacturing (RTM)
May 24, 2006
In all seriousness, I definitely like the new "PSSU" (Post-Setup Security Updates) feature. Awful name, but it does the following when someone first installs Windows 2003:
1.) Blocks all incoming traffic.
2.) Immediately guides the first person who logs on through downloading updates.
This would be such a terrific blessing for new XP users: block traffic and immediately send them off to the update site. Excellent idea.
</sarcasm>
Enhancements
In addition to finding and updating security holes before hackers can exploit them, Service Pack 1 includes improvements to functionality that originally shipped with Windows Server 2003. Such enhancements make a great product better and raise the security, reliability, and productivity of Windows Server 2003. Below are brief descriptions of some of the key enhancements included in Service Pack 1:
Stronger defaults and privilege reduction on services--Services such as RPC and DCOM are integral to Windows Server 2003, but they are also an alluring target for hackers. By requiring greater authentication for RPC and DCOM calls, Service Pack 1 establishes a minimum threshold of security for all applications that use these services, even if they possess little or no security themselves.
Support for "no execute" hardware--Service Pack 1 allows Windows Server 2003 to utilize functionality built in to computing hardware, from companies such as Intel and Advanced Micro Devices, to prevent malicious code from launching attacks from areas of computer memory that should have no code running in it. For both 32-bit and 64-bit systems, this enhancement closes the door on one of the broadest and most exploited avenues of information attack.
Network Access Quarantine Control components included--Windows Server 2003 SP1now includes the Rqs.exe and Rqc.exe components to make deployment ofNetwork Access Quarantine Control easier. For more information, see Network Access Quarantine Control in Windows Server 2003.
IIS 6.0 metabase auditing--The metabase is the XML-based, hierarchical store of configuration information for Internet Information Services (IIS) 6.0. The ability to audit this store allows network administrators to see which user accessed the metabase in case it becomes corrupted.
New features
Microsoft is taking the opportunity afforded by the release of Service Pack 1 to introduce powerful new functionality to Windows Server 2003.
Windows Firewall--Also released with Windows XP Service Pack 2, Windows Firewall is the successor of the Internet Connection Firewall. Windows Firewall is a host (software) firewall, a firewall around each client and server computer on a customer's network. Unlike Windows XP Service Pack 2, the Windows Firewall is off by default on Server 2003 Service Pack 1, and must be turned on to begin protecting systems. The Windows Firewall is enabled for a brief time during Service Pack 1 clean installs for the duration of the new Post-Setup Security Updates portion of setup.
Post-Setup Security Updates (PSSU)--Servers are vulnerable in the time between initial installation and having the latest security updates applied. To counter this, Windows Server 2003 with Service Pack 1 uses Windows Firewall to block all inbound connections to the server after installation until Windows Update delivers the latest security updates to the new computer. After updating, Windows Firewall is turned off until it is configured for server roles. PSSU also guides users through immediate configuration of Automatic Updates.
Security Configuration Wizard (SCW)--SCW is a wizard that configures server security based upon existing server roles. SCW asks questions about server roles and then stops all services not necessary to perform those roles. SCW will not add roles, but will configure the server around the roles it performs. Like boarding-up unused doors, this new feature helps reduce the attack surface of Windows Server 2003.
True, but they have a few excellent ideas in there. I'm a little "meh" about the "security configuration wizard" (personally, if you're using a wizard to configure security you probably shouldn't be admining a server in the first place.
The PSSU feature, though (as I mentioned in another post), that blocks incoming traffic on first boot and immediately directs the user to download updates is awesome. Why other companies haven't thought about this, I have no idea. I really hope this gets put into the next consumer version of Windows.
And not even Billy Gates would bet against it, he's too good a businessman for that.
Pfff! As if! Bill Gates would take your bet, then he'd make sure that copies of SP1 stay out of the hands of the most common bug reporters, that tech support convienently "loses" any reports that do come in, and he'd send CERT on an all expenses paid (and tax deductable!) vacation for doing such a good job.
Then he'd collect his 10 pounds, and make a fortune off of advertising that 2003 is more secure than ever!
Javascript + Nintendo DSi = DSiCade
I say wait until SP2.
IMHOP, the more interesting tidbit from this article is the info that XP 64-bit should go on sale next month :-) As the proud owner of 2 athlon 64's, that's actually something I would want to know about....
sometimes, i wonder if i'm the only conservative on teh intarweb. ah well, back to mah hogs and warmongerin'....
Ok, I have used Windows for development in 95 and 98 releases and now use OS X very happily. What surprises me is we are in late March of 2005 and Windows 2003 SP***1*** is being released.
--- Old Time NeXThead
Ok, you are basically throwing up the red flag saying, "I don't have a legitimate install of Windows 2003 Server, so I want to know if I can update my server without getting in trouble". To answer that, I say take your chances, because my company has ligitimate copies, so I don't have to worry about if it will let me update or not.
-----BEGIN PGP SIGNATURE-----
12345
-----END PGP SIGNATURE-----
Microsoft is also using the Windows Server 2003 SP1 code base as the starting point for the next desktop version of Windows, code-named Longhorn, which is slated to arrive next year.
Wasn't Longhorn supposed to originally be released this year? If they're going to use this service pack as a code base, they must be a long, long, long way off from a longhorn release . . .
It is quite hefty but then this is what I expect from "Service Packs" especially in one giant chunk.
"Download time remaining: 22 minutes"
So now I'm chained to box since I suspect at some point I need to click something on some dialog to complete installation (this is an assumption but past history on other updates tells me I should watch the process to make sure it goes all the way through).
On the other hand I had to setup sever based off of FC3 yesterday and out of the box it required to download 450MBish of stuff broken into 150+ individual downloads. After installing the gpg keys, I started the update ('yum -y update') and walked away from it. Other systems have something that is just as easy and dare say fool proof.
I would really like MS to bite off things in smaller chunks. I do recognize the fact that every part of the 329MB download is probably necessary but why not roll out in both a large chunk and small chunks to accomidate different enterprise configurations? I like having options on rollout but I constantly find Windows rollouts very lacking.
If you install this on SBS2003, do NOT run the new wizards - wait until SBS2003 SP1 is released in the next month or so.
1) They are easy to crack remotely with default installs.
2) Weekly if not daily patches are required.
So, Microsoft comes out with SP1 and people are already whining.
1) What is the "no inbound connections by default" stuff going to help?
2) The length of time between Windows 2003's release and its first service pack.
C'mon people, put it together.
This is beta software and not part of Windows Update. There's literally NO WAY it could have been automatically downloaded and installed: it must be manually downloaded and then explicitly installed.
Slashbots are morons for a) believing this troll and b) modding it up.
How did it "automagically" deploy on your box when MS isn't putting it on Windows Update until July? It can only be manually downloaded until then.
It is available through Windows Update right now. I don't know if it will work through Automatic Updates, but if you manually activate Windows Update the scan results page will inform you that it is one of the "Critical Updates and Service Packs".
The open-source world must scare you shitless then. A lot of those projects have a release-of-the-day or release-of-the-week...
According to these links, Microsoft has finally figured out how Linux boots with tftp:
BartPE using PXE
Booting Windows from a Debian box
It's nice to see Microsoft pick this up. Booting Windows with standard tools, what a concept!
I'm sooooo spoiled with anaconda kickstarts... can Microsoft make deploying servers as easy as RedHat/Fedora?
I had a pranoid thought the other day. It seems that the MS policy for supporting products runs for about 5 years. Support for 2K pro was dropped earlier this year. XP was first released in May 2001, longhorn May 2006. Is this the forthcoming strategy for the forced upgrades the we all know and love?
Our diversity is our strength
Oh, you will be suprised at what I get asked to do, and this is from business people with more money to spare than I do. "Hey, can you crack this software for me?" "Can't I just load this one copy on all the machines?" So many times I have to stick my neck out and say I can't do that, or that we need to buy more licenses. With that I get an angry face and a huff from them because I didn't want to compromise myself to save them a couple bucks. I became the IT manager of this company months ago and I'm still trying to fingure out if all our installs of MS Office are ligit or not, since the company didn't keep a record of anything, not even the disks that came with the PCs.
-----BEGIN PGP SIGNATURE-----
12345
-----END PGP SIGNATURE-----
Anyone know if it's still vulnerable to the old LAND attack?
-maztuh
The real litigious bastards...
Unless you're an introverted cubicle-minion who gets away dealing only with a narrow set of *nix or mainframe applications (which never talk to Windows boxes), I would think Win2K3sp1 is news.
Another way to look at is that Slashdot will happily post the latest release of "NotReallyNecessaryUtility 0.3 Beta" as news...
Hey, why aren't they rolling out a paired down version of Security Configuration Wizard (SCW) for XP?
The "Security Center" on XP is pretty cheesy, didn't even include an updated MBSA until a couple months after XP sp2 was released. Most folks won't dig into using the Local Security Policy snap-in or Security Configuration and Analysis snap-in, or fiddle with changing their template.
"I'm really at a loss of words to describe this brilliance.
Just think of it, closing all open ports from incoming traffic by default now. Wow. Why didn't anyone else come up with this great idea before?"
It's not what you're thinking of - I don't think you're getting it. This isn't a firewall that gets turned on. Rather, the user can't do anything on the network until the system is up-to-date. It basically sandboxes the user from all internet traffic but the update site. I don't know of a single other OS that does this.
It could be that many libraries were completely re-compiled with a better compiler that automatically closes some holes (like data overflows), so the whole shebang needs to be reapplied, even if there were actually no code changes.
The size is because the entire of the core services set has been recompiled to use the XP-SP2 Data-Execution prevention technology, which allows for NX support in all applications with appropriate hardware, and a further emulated NX feature that covers the core services infrastructure regardless of CPU platform. This doesnt require most applications to be recompiled, because most of the changes have occured behind the Hardware abstraction that all Windows applications are coded for.
Regards,
-Steven Gray
-Technical Director, Pulse Unsigned
This is different from Linux packages how, though? RPM doesn't do deltas. DEB doesn't do deltas. Every time there's a patch to one piece of the kernel, you have to download the entire kernel package again. Mandrake 10.1 has gone through at least three full RPM releases of KDE 3.2 for bugfixes -- that's not a fun set of downloads, let me tell you.
It's a valid criticism for everyone, not just MS.
If some of the security updates are related to compiling with different options (like the buffer overflow detection changes Visual C++ has been making), then every binary would be affected.
Who said it's insecure out of the box? I realize this is /. - one big, happy bandwagon - but serious try using it and reading about it. All unnecessary services are shutdown and not even IIS is installed by default (unless you get the web edition of 2003).
mainstream support for 2k pro and server expires on June 30, 2005. They're supposed to release an Update Rollup pretty soon, instead of a full blown (bloat) service pack 5. I'm guessing it'll come out around the end of May, beginning of June.
I was just reading about WinFS being back-ported to XP and 2k3 server. Dunno, but that seems like we won't be herded into upgrades as forcefully as it initially appeared before indigo and avalon were backported.
You can disable it.....
Apply Windows 2000 Default Internet Explorer Security Settings
If Internet Explorer Enhanced Security Configuration is enabled on your server, you may decide to use the default Internet Explorer security settings used by Windows 2000.
To do this, follow these steps:
1. Open Control Panel, click Add or Remove Programs, and then click Add/Remove Windows Components.
2. Select Internet Explorer Enhanced Security Configuration, click to clear the selection, and then click OK.
3. Click Next, and then click Finish.
4. Restart Internet Explorer to apply the changes.
Bored? Why not join a decent mess
Which is what most people do. Which enhances security... how again? It's really a stupid way of "securing" a Windows machine, because it really amounts to nothing more than a nag screen telling you to not click on anything or the boogeyman is going to get you. :-/
Considering that the only reason why you need a web browser on a server is for troubleshooting and patch downloads, then disabling browser plugins, disabling auto-file open/external URL handlers, and removing ActiveX support should do the trick nicely.
Javascript + Nintendo DSi = DSiCade
Microsoft acknowledge January patch for 98/ME is flawed. Surprise!!
A computer makes it possible to do, in half an hour, tasks which were completely unnecessary to do before.
"Every time there's a patch to one piece of the kernel, you have to download the entire kernel package again. "
/pub/linux/kernel/v2.6 directory. It's how I've been updating my 2.6 since I first downloaded it at 2.6.4. cat ../patch-2.6.N | patch -p1 -E && make oldconfig does wonders.
Last time I looked at ftp.kernel.org, there were lots of nice patches in the
Some of the deltas are large (a couple mb), but nothing like the size of a full kernel download.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
First, last I checked none of Microsoft's patches required sending an activation code yet in order to download; so far, they're just asking very nicely (for a corporate behemoth)-- you could still say no and download any of them.
Second, for this service pack Billy Boy doesn't even ask; just go to the URL given in the story, click the button and download. Or, just download directly once someone provides the karma-whoring direct file link for you.
I presume, of course, you're not silly enough to be asking if Win2K3Srv still requires a key to install in the first place....
//Information does not want to be free; it wants to breed.
Why other companies haven't thought about this, I have no idea
What other companies make "server" software that allows someone to configure something without understanding what they are doing? I'm assuming the other companies you are talking about are all *nix vendors of some sort, and they don't have the same incidence of their customers plugging unpatched boxes into live, unfiltered networks.
You can either complain, or do nothing. You don't get both.
Are you kidding? 2k3 server makes for a far better desktop than XP. All the annoying crap is off by default.
No bubbly playskool theme. No MSN Messenger popups. No product activation. No "take the tour!". No windows media player intruding into everything. IE is crippled by default -- ripe for Firefox installation.
It feels a lot more like if you took 2000 Pro and added the few GOOD things about XP.
If you bought licenses through a volume-licensing agreement, you may be able to at least get your vendor to look up your authorization codes.
Gamingmuseum.com: Give your 3D accelerator a rest.
That's not always true. A wizard that quickly macros something you were going to do anyways sounds like a great idea.
Actually... there are a lot of Sys Admins that still will not even think about upgrading their server OS until SP1 comes out.
Ok Microserfs
Times a waste'n
Install that service pack so we can get past the debugging phase and to the part where I might consider applying this thing to my servers.
I would really like MS to bite off things in smaller chunks. I do recognize the fact that every part of the 329MB download is probably necessary but why not roll out in both a large chunk and small chunks to accomidate different enterprise configurations? I like having options on rollout but I constantly find Windows rollouts very lacking.
This is exactly what they do. The large 300+ MB download is designed for network administrators who want to download the whole thing to apply to multiple machines. If you're just going to be updating a single machine, use Windows Update to get SP1. It uses a smart installer to only download the pieces you need (typically one-third to one-half the size of the full update).