Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A vulnerability scan of our network has turned up this response:

"On this site, there is a problem with IIS. The SMB service has insecure permissions for Everyone: IIS Admin Service (IISADMIN) : DC, WD, WO http://oursite.com"

I've been looking at the services, and reading up on Windows SMB (Server Message Block) but still am not able to really detect what the problem is here. Does anybody have more understanding of SMB service or windows permissions, and can turn me in the right direction?

I've looked at the services, there is an "IIS Admin" service and I've checked the permissions on the executable (C:\windows\system32\inetsrv\inetinfo.exe) but it doesn't list anything abnormal:

C:\Inetpub\wwwroot\FM>cacls C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe BUILTIN\Users:R
                                         BUILTIN\Administrators:F
                                         NT AUTHORITY\SYSTEM:F

I've also checked the Local Security Settings:

 Microsoft network client: Digitally sign communications (always)             Disabled
 Microsoft network client: Digitally sign communications (if server agrees)   Enabled
 Microsoft network server: Digitally sign communications (always)             Disabled
 Microsoft network server: Digitally sign communications (if server agrees)   Disabled

Any help or direction is much appreciated!

share|improve this question
    
sorry for the link bomb but support.microsoft.com/kb/914392 also read the last paragraph it should bring the point home. –  tony roth Aug 8 '13 at 14:38
    
I wish I could up your comment @tony-roth, that was very helpful actually. Using the "sc sdshow iisadmin" command I was able to deduct and find the solution. I will just write up my Answer here, just for future reference. –  russds Aug 8 '13 at 18:13

2 Answers 2

up vote 0 down vote accepted

Using the "sc sdshow iisadmin" command I was able to see that "Everyone" had "Access" in the "Discretionary" permissions:

C:\Inetpub\wwwroot\FM>sc sdshow iisadmin
D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)S:(AU;
FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

I simply removed that "WD" entry by resetting the permissions with:

C:\Inetpub\wwwroot\FM>sc sdset iisadmin D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:
(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
[SC] SetServiceObjectSecurity SUCCESS

Then comfirming with:

C:\Inetpub\wwwroot\FM>sc sdshow iisadmin
D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

I restarted the service, and checked all the websites, everything seems to be running smooth. I'll have to wait for another scan to know for sure, since the scanning company didn't give any more details then what I reported in the question. Either way, it seemed a good idea to remove the "Everyone" entry from discretionary.

I did a lot of research, and had to document it. I wrote about it here: http://bit.ly/18dYVYi for anyone interested.

share|improve this answer

It's been a while since I've worked on a 2003 server, but it's possible that the scan (sounds like a Nessus scan to me) is picking up a best practices issue. You can look here: Secure the Root Folder of Each Disk Volume (IIS 6.0) and check and see if that's the issue.

Specifically:

Immediately after a new installation of Microsoft® Windows® Server 2003, the special group Everyone has Read and Execute permissions on the root of the system volume, which is the disk volume where Windows Server 2003 is installed.

Any folders created beneath the root of the system volume automatically inherit the permissions assigned to the root of the system volume. This means that the Everyone group will have Read and Execute permissions on any new folders created immediately beneath the root of the system volume. To prevent an accidental breach in security, remove the permissions assigned to the special group "Everyone" on dedicated Web servers.

and the fix:

To secure the root of the system volume by removing permissions

  1. Open Accessories, and then click Windows Explorer.
  2. In Windows Explorer, locate the root of the system volume.
  3. Right-click the root of the system volume, click Properties, and then click the Security tab.
  4. In the Group or user names list box, click Everyone, and then click Remove.
  5. Click OK.

HOWEVER, the scan should have told you what to do to resolve the issue I would think. You still have to be careful, because there are certain special permissions on the IIS admin service for the Everyone group: http://support.microsoft.com/kb/903072

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.