Hi, can anyone give me some pointers how we would make a potential server that hosts only WSS 3.0 as secure as possible. WSS 3.0 will have a public IP through ISA, and SSL. When people type https url in browser, they will be presented with
username/password, and they will authenticate in AD.
Is there a way to close up all the remaining potential security holes (if any), and how can I prevent someone to just bruteforce guessing the password? Can we disable the user after 10 consecutive wrong passwords, and then it would have to be reenabled
by the administrator.
Thanks

There is an amazing pack of free network admin tools. click here to download it

additional question i would have is if the user misses the password 10 times, would it lock up the account if it has treshold set to 10. i mean if it misses 10 times trying to access sharepoint site, and not loging into the domain over the workstation.
is that the same? thanks

There is an amazing pack of free network admin tools. click here to download it

Hi
As this question is more related to WSS 3.0, I suggest you ask in the SharePoint Services forum:
SharePoint Products and Technologies Forums

http://social.technet.microsoft.com/Forums/en-US/category/sharepoint/


Need to support users over the internet? click here try our remote control online beta

HI Dadach
first
you should never expose a sharepoint site WSS3 or MOSS direct to the internet , you should have a ISA with public name translation rule pointing to a reserve proxy who is the only can talk to the reel alternate name mapping configure in sharepoint central
admin site
if your site need hardness configuration you should planning a upgrade to sharepoint2010 foundation edition how support
many authentication method like Certificate, SAML token, Claimbase
the password policy are configurable from the local policy, all user can by set like your example except the administrator account how can be disable by Brute Force attack , the workaround this is rename your administrator account for something that only
you and your IT team know the the specific account got the administrator rights

There is an amazing pack of free network admin tools. click here to download it