I am interested in finding out if there is documentation for securely configuring dotnetnuke on windows 2003 server standard with SQL Server 2005 standard.  Are there other technologies that should not be used with this configuration...for example, should you never install php4?

From my initial impression, dotnetnuke is secure on it's own and windows server 2003 standard is also considered secure out of the box.  So, with a firewall only allowing port 80 and https, the system should not get hacked?...provided the host and admin accounts have secure passwords?

Is there any kind of checklist?  A service that someone uses and can recommend for verifying the security of a configuration?  Perhaps a book I should read?  Or just a point in the right direction?

Thank you for any help you may provide.

Sincerely,

Bill

If a dotnetnuke site were to get hacked, how could you go about finding out what happened?

I'd like to touch on that 1 little comment there.  Before you fully put your trust in Windows 2003 Standard being secure "out of the box", I would suggestion immediately assuming it is not secure out of the box.  I say this because, well, Windows 2003 is not secure out of the box :)

If you google up Win2k3 security then you will find a lot of common things to change, including Windows FW, guest/anon accounts, execute-as accounts (such as IIS network services), and the like.  Also check out IISLock and URLScan.