Security hardening checklist for a StackRegent server

What the installer already did#

Before you start, know what is in place. The StackRegent installer applies a Windows baseline on every release:

• SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 off for server connections (IIS, Remote Desktop, SQL Server and mail use the Windows TLS stack),
• strong cryptography for .NET Framework applications,
• SMB 1 off and SMB signing required,
• the Print Spooler stopped and disabled,
• Network Level Authentication required for Remote Desktop,
• an account lockout policy when Windows had none,
• the firewall rules for remote management over WinRM and WMI disabled,
• Microsoft Defender present, with database files excluded from real-time scanning and website folders scanned.

Panel logins are stored only as bcrypt hashes, and passwords the server must reuse are encrypted with Windows DPAPI. The panel's own database listens on 127.0.0.1 only. Some baseline changes need a restart, so restart once after installing.

Security hardening checklist#

Administrator logins#

• Replace the generated admin password under My Profile › Change Password.
• Turn on two-factor authentication under My Profile › Profile & Preferences › Two-factor authentication. Two-step sign-in with an authenticator app is available for administrator logins.
• Give every colleague their own login under Tools & Settings › Additional Administrator Accounts, and leave Restricted ticked unless they need full rights. Tools & Settings › Restricted Mode Settings decides what restricted administrators may not change.
• Set password rules for everyone under Tools & Settings › Security Policy: Minimum length and Must contain.
• Shorten Session Idle Time and leave the option to keep a session when the browser's IP address changes off.

Access to the panel#

• Issue a trusted certificate for the panel under Tools & Settings › SSL/TLS Certificates with Secure the panel with Let's Encrypt, so logins never go over a certificate warning.
• Under Security Policy › Panel connections, choose TLS 1.3 only if all your administrators and customers use current browsers, or keep TLS 1.2 with forward-secret AEAD ciphers only. TLS 1.0 and 1.1 are never offered.
• Limit where administrators may log in from under Tools & Settings › IP Access Restriction Management. It covers administrator logins; websites, mail and FTP are not affected. Keep stackregent ip-access-reset in mind as the way back in.
• Optionally move the panel off 9443 with stackregent panel-port. It does not replace the items above but cuts down on noise in the logs.

Remote Desktop#

• In Tools & Settings › Firewall, set Remote Desktop to Only these addresses with your office or VPN addresses. The firewall follows the real Remote Desktop port if you moved it.
• Keep the Remote Desktop and Windows logons source on in Tools & Settings › IP Address Banning › Settings.
• Do not allow Remote Desktop in service plans unless a customer truly needs it; Account Isolation warns about subscriptions whose plan allows it.

Windows Firewall#

• Open Tools & Settings › Firewall and set every service you do not offer to Nobody, for example MariaDB and SQL Server when databases are only used locally.
• Use Only these addresses for services only you need, such as Web Deploy for your own developers.
• Remember the safety net: changes take effect only after Activate, and the previous settings come back by themselves if you do not click Keep these settings within 60 seconds. If you are locked out anyway, stackregent firewall-reset on the console undoes the limits; see panel not reachable after a firewall change.
• Know where Panic mode is. It blocks everything except the panel and Remote Desktop during an attack.

Brute-force protection#

• Check that the StackRegent Brute-force Guard service runs and Banning is on in Tools & Settings › IP Address Banning.
• Review the sources: Remote Desktop and Windows logons, the panel, FTP, SMTP, POP3, IMAP, password-protected website folders, Microsoft SQL Server and MariaDB. Turn on the database sources if you open database ports.
• Add your own networks under Trusted Addresses so a colleague's typo does not ban the office.

Web application firewall#

• Install ModSecurity for IIS with OWASP Core Rule Set under Tools & Settings › Server Components. It starts in detection-only mode.
• After a few days, review Recent Hits in Tools & Settings › Web Application Firewall, switch off rules that hit legitimate traffic, then set Mode to On (blocks with HTTP 403). Paranoia level 1 is the recommended start.
• Know what it checks: addresses, query strings and headers, not the bodies of posted forms. ModSecurity for IIS loses form data when it reads request bodies, so StackRegent leaves them out; see ASP.NET form posts arrive empty.

Isolation between customers#

• Run Tools & Settings › Account Isolation › Check all and Repair anything not shown as Isolated. Every subscription should run as its own Windows user in its own application pool, inside a webspace no one else can open.
• Make sure Enforce resource limits is on under Tools & Settings › Resource Usage, and set Default limits, so a hacked site cannot take the whole server down.
• Leave the default PHP disable_functions in place for every PHP version under Tools & Settings › PHP Settings; it blocks the functions uploaded web shells rely on.
• For SQL Server, keep Hide other clients' databases on under Tools & Settings › Database Servers.

Mail, FTP and DNS#

• Leave relaying to logged-in users only; list extra networks under Networks that may relay only when you must. The server is never an open relay.
• Set outgoing limits per domain and per subscription in Mail Server Settings, so a hacked mailbox cannot send thousands of messages in an hour.
• Tick Scan incoming and outgoing mail under Tools & Settings › Antivirus, with Defender real-time protection on.
• Set FTP over TLS (FTPS) to Require under Security Policy once your customers' FTP programs are set up for it.
• Keep Recursive DNS off (the default) under DNS Settings › Server-wide Settings, or limit it to this server, and list only your secondary name servers under Transfer Restrictions.
• Turn on Prohibited Domain Names and Restrict Creation of Subzones, so no customer can add gmail.com or a subdomain of someone else's zone.

Backups, monitoring and updates#

• Schedule server backups to remote storage, protected with a password kept off the server. A backup on the same disk does not survive a ransomware attack or a lost server.
• Turn on Monitoring alerts, including the alert for a service that stops.
• Review the Action Log now and then, and keep Notifications for failed certificate renewals and resource limits.
• Keep StackRegent current under Tools & Settings › Updates, the components under Server Components, and Windows through Windows Update.
• Open Tools & Settings › Advisor monthly; it rates the server and offers one-click fixes for many of the items above.

Reporting a security problem#

If you find a vulnerability in StackRegent, report it privately to support@stackregent.com or through the security contact form, not in the public forum. The StackRegent security page explains how reports are handled.