For environments requiring an Internet-facing capability, the SharePoint application server upon which Central Administration is installed must not be installed in the DMZ.

From SharePoint 2010 Security Technical Implementation Guide (STIG)

Associated with IA controls: EBBD-2, EBBD-1, EBBD-3

Associated with: CCI-001414

SV-36120r2_rule For environments requiring an Internet-facing capability, the SharePoint application server upon which Central Administration is installed must not be installed in the DMZ.

Vulnerability discussion

Information flow control regulates where information is allowed to travel within and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to the information. SharePoint Central Administrator is a powerful management tool used to administer the farm. This server should be installed on a trusted network segment. This server should be used to run required services rather than user-oriented web applications.

Check content

1. Inspect the logical location of the server farm web front end servers on a network diagram. 2. Verify the Central Administration site is not installed on a server located in a DMZ or other publicly accessible segment of the network. 3. Mark as a finding if Central Administrator is installed on a publicly facing SharePoint server.

Fix text

Remove the application server from the DMZ.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.