Sharepoint Foundation 2010 Hardening

Question

I have never hardened a SharePoint site before and I am having a hard time using all the recommendations I find online.

This blog post discusses the different accounts that should be used for different purposes, but it doesn't match up with the services I have running on my Foundations server.

This is the list so far of the accounts that I should set up for the various services with "N/A" listed for those that don't seem to be referenced:

• Sharepoint 2010 Administration - SP_Farm account
• Sharepoint 2010 Timer - SP_Farm account
• Sharepoint 2010 Tracing - N/A
• Sharepoint 2010 User Code Host - N/A
• Sharepoint 2010 VSS Writer - N/A
• Sharepoint Foundation Search V4 - SVCSPFoundSearch

Are there services that I have not included here? As a note, my SharePoint site is fully contained on a single server at this time.

Answer 1

There are a few more considerations when you are hardening a Sharepoint box. Kerberos, SQL Aliases, firewall policies and fine grained permission policies on the box itself.

I recommend that you take a look at http://technet.microsoft.com/en-us/library/cc288143%28v=office.14%29.aspx and get familiar with SQL Hardening as well http://social.technet.microsoft.com/wiki/contents/articles/1256.database-engine-security-checklist-database-engine-security-configuration.aspx even if you are not the SQL Administrator it cant hurt to know the lingo and how your DBA thinks.

As for the accounts. You should be able to create new accounts in AD and then add the as managed accounts in Central Admin. Then you can assign them as Service accounts. Tracing, User Code host (sandbox) and VSS writer shouldn´t need any explicit permissions that Sharepoint wont give them in the Service Account provisioning process.

Hope this helps.

Funi.