|
| |
|
 |
Locking Down an IIS Box
Microsoft released the Latest IIS Lockdown tool last week. On that note we thought we could help you out with some info on securing an IIS box. Credit Mark Burnett and also eEye's Mark Maiffret for the following info on Locking down IIS.
Hardened configurations are a GREAT start, but not the end of it all, NOR is only one good security configuration or product the total end. And your environment will dictate what you do. You need everything, and then still need to pray to the server gods at night. This prayer includes having the SecureIIS god on your side.
Most of these preventions are common steps that are on many security checklists. In fact, there are eight basic steps that prevent most attacks:
- Put IIS on its own partition.
- Use packet filtering to block unused ports.
- Do not use FrontPage Server Extensions or WebDav on a production server.
- Disable all unused services or Windows components.
- Remove all unused ISAPI script mappings.
- Set the minimum required IIS permissions (do not allow script/executables if you are not using them).
- Set proper NTFS permissions.
- Do not put sensitive information in ASP files.
- Use the MaxClientRequestBuffer (see Q260694).
Of course, it is important to install service packs and hotfixes and it does help to have 3rd party add-ons for an additional layer of protection. We can help you manage the hotfixes too with UpdateEXPERT.
You want to follow the recommended best practices and hardening checklists for windows and IIS. A streaming video of SecureIIS, setup and config, 10 minutes, WM8: and click on the QUICKDEMO Icon. Eval downloads available too.
W2Knews Oct 21, 2002 (Vol. 7, #67 - Issue #398)
Copyright Sunbelt Software Distribution, Inc. 1996-2002. |
|
|
© Copyright
2002
Eric Hartwell.
Last update:
11/4/2002; 5:45:30 PM.
This theme is based on the SoundWaves
(blue) Manila theme. |
|
"Data! data! data!" he cried impatiently. "I can't make bricks without clay."
— Sherlock Holmes to Dr. Watson in "The Adventure of the Copper Beeches" by
Arthur Conan Doyle.
"I
like deadlines," cartoonist Scott Adams once said. "I especially like the
whooshing sound they make as they fly by."
"There is nothing like that feeling of spending days and days banging your head
against a wall trying to solve a programming problem then suddenly finding that
one tiny obscure and seemingly unrelated piece of the puzzle that unlocks the
solution. Oh yeah!"
- Chris Maunder, CodeProject Newsletter 28 Jan 2002
"Management at eSnipe,
which is me, is also feeling the pain of the 2002 bear market. So rather than
pout about it, I bought some stuff on eBay that I really didn’t need, but made
me feel better."
- Tom Campbell, president of
eSnipe
|
