If you work in a Windows shop and your company has a Web presence, chances are you are working with IIS. Security problems with IIS are well documented. When working with IIS, there are some important security issues to keep in mind. In this security tip, I take a look at a handful of quick but effective security improvements for IIS.
- Log for any and all activity of the IUSR account outside of the Web and FTP roots. If activity
for this account is detected on files or resources not designated as publicly accessible, this
indicates that your system has been compromised.
- Keep your root CA certifications on your Web server up to date. Regularly prune the list of
untrustworthy CAs and add in new CAs that are trustworthy. Make sure your system is properly
obtaining the CRL from your trusted CAs.
- Disable or remove all native default IIS applications. These are stored in the IISSamples,
IISHelp and MSADC folders. In most cases, you can simply delete these folders in their entirety.
But be sure to create a backup just in case you need to restore them.
- Remove the IISADMPWD Virtual Directory, especially if you are not using IIS's remote
administrative features. The contents of this folder are popular targets for numerous Web based
attacks and exploits.
- Disable or remove unneeded COM components. Removing any unused and unneeded service
Requires Free Membership to View
When you register, my team of editors will also send you the latest expert resources covering pertinent IT topics such as Windows server backup and recovery, server administration, storage management, infrastructure security, virtualization, Hyper-V, Active Directory and Group Policy.
Cathleen A. Gagne, Senior Editorial Director
- will reduce
the overall number of vulnerabilities of any system. As the number of vulnerabilities discovered
for IIS increase, keeping your risk exposure to a minimum is even more important.
- Disable parent paths (i.e. ".."). Parent paths allow the use of the double period command to move from a child to a parent folder while browsing directories. The parent path command can be included in URLs to access parent folder contents. Parent paths are disabled through a Web sites Properties dialog box by selecting the Home Directory tab, clicking the Configuration button, selecting the App Options tab, then clearing the Enable parent paths checkbox. This setting must be made individually on each separate Web site.
About the author
James Michael Stewart is a researcher and writer for Lanwrights,
Inc.
This was first published in October 2002