0
votes
0answers
28 views

Are there security concerns involved with keepalive?

I'm configuring an IIS7 site for a third-party tool, and our team had a brief discussion about the keepalive setting. I have learned in my research that increasing this timeout will impact available ...
0
votes
0answers
29 views

Securing files on IIS 7 and Windows Server 2008 Server

What's the best practice for securing a file on an IIS 7 web application running on Windows 2008 server? I have the following requirements and ideas: Requirements: A authenticated user to my web app ...
0
votes
3answers
346 views

I think I'm under DoS attack. How can I respond?

My server's CPU has been spiking out for the past few days, to the point that it drops requests. I've been looking through the logs, and see certain IP's in the logs that are just simply downloading ...
2
votes
1answer
526 views

IIS7 Response header exposes server information when post request is incomplete

IIS reveals "Server: Microsoft-HTTPAPI/2.0" in the response header when a invalid Post request is made. e.g. content-length is not included in the header. The Response returned also says HTTP/1.1 411 ...
4
votes
1answer
53 views

What is this user name for and how did it get created?

When I created a website named Portal on my IIS 7.5 on the website permissions->security I got this user. What is its purpose? From what I have read the ApplicationPool runs under NetworkService ...
1
vote
1answer
96 views

Is opening port 80 for basic websites ok?

I have set up IIS 7.5 with some web applications, that are meant for internal use as well as for some of our customers. The information inside them is important to some extent, but not like credit ...
4
votes
3answers
181 views

Is there a downside to enforcing 128bit SSL for a website

On Windows Server 2008 R2 I can enforce 128bit SSL for a website by executing: appcmd set config "Default Web Site" -section:access -sslFlags:Ssl,Ssl128 -commit:apphost Is there a downside to that? ...
0
votes
2answers
152 views

Installing a Certificate in IIS 7

I have created a free certificate from https://www.startssl.com. It asked me to export that certificate on the disk. Now i want to install this certificate in IIS 7 on my webserver. How do i do that. ...
2
votes
1answer
384 views

Blocking OS fingerprinting windows server 2008 IIS7

We recently had a 3rd party auditor perform a penetration test on our MS 2008 webserver that uncovered remote OS detection vulnerability. It detected the OS as well as version of IIS. The Auditors ...
1
vote
1answer
309 views

How can I edit web.config to have a different MIME type for a single XML file not others?

I am trying to set the MIME type for Flash's cross domain file in web.config. Since this file has an extension of .XML the following command will edit the MIME type of all XML documents in my site ...
1
vote
1answer
308 views

Can IIS be configured to serve different sites depending on the ip of the incoming connection?

I'm looking to serve a "Work in progress" page to most of the internet, while allowing access to the site itself from a few specific, test, ip addresses. Is this doable with IIS 7? How would you go ...
3
votes
2answers
448 views

Does IIS7 have in-built, or available extensions, for responding to scan attempts?

Does IIS7 have an in-built mechanism, or are extensions available, for providing web-application-firewall type behavior? For example, dozens of successive attempts come in that look like scan ...
0
votes
1answer
587 views

Application Pool User Permissions

I've been in the process of updating our web servers recently to use domain accounts for IIS Application Pool identities. I know with IIS7 Microsoft created the idea of the ApplicationPoolIdentity ...
0
votes
2answers
226 views

Linux or Windows Server as Gateway/Firewall [closed]

In my house, i'm running a server I use for testing purposes, and I'm planning on throwing away my knackered router, and making the server my Gateway to the internet and using it as a server for ...
0
votes
1answer
395 views

How to configure IIS 7.5 to host multiple websites with the correct F/S permissions

So, heres my scenario: Dedicated server running Windows 2008 R2 IIS 7.5 Multiple sites using PHP / .NET 4 / Perl / Python Need to do: Ensure that the sites are not able to write/create/read ...
1
vote
1answer
131 views

Securtiy concerns about IIS websites' access rights - Restrict them not to be able to read c:\, etc

I have some security concerns about my IIS websites. From PHP-files (FastCGI) on our server the scripts are able to read my system's root directory (c:\), but even list the content of c:\windows. What ...
0
votes
1answer
192 views

IIS 7, ASP.NET security nightmares

For no apparent reason that I know of, my ASP.NET website on my local development server (IIS 7) started returning Error Code 500 - Internal server error. After granting the user "Users ...
0
votes
1answer
612 views

IIS7 web site not working properly after file sharing on wwwroot

I recently tried to add a file share on wwwroot to easily be able to deply some files from a different copmuter on the network. I added the share with full access to my user, but only me. After I had ...
0
votes
1answer
118 views

How to block All IPs in IIS7 with Address and Domain Restrictions

I want to block everyone from accessing my website but me. I am using IIS7 and have IPv4 Address and domain Restrictions installed.
1
vote
0answers
347 views

Basic authentication with IIS 7 reverse proxy

In our DMZ we currently have a facade or proxy web page (asp.net webform), which forwards requests to a web service (asp.net web service) in our intranet, then relays the web services response back to ...
0
votes
1answer
775 views

Any problems with using a 301 redirect to force https traffic in IIS?

Is there any problem with using a 301 redirect to force all traffic to go to a secure-only site? We originally had redirect rules, but enforcing SSL-only seemed more secure. Here is how we set it ...
0
votes
1answer
150 views

Server Administration [closed]

My client asked me for a job description of a system administration because I might be assigned this position along with the other guy I'm working with. To be honest, I do not know much about a System ...
1
vote
2answers
843 views

Default document not working after installing SP1 on Windows 2008 R2 x64

We have a web site that should only be available for authorized users. So we deny anonymous access for the site. However we do allow anonymous access to the default page and the login page. When we ...
1
vote
1answer
47 views

Securing access to a website on IIS

I've got a website running on IIS7.5. I want to ask for credentials (fixed user/password) on access to the website. I don't need to do anything with those credentials - just to make sure the user ...
1
vote
2answers
1k views

Unable to set NTFS permissions for ApplicationPoolIdentity on Windows 2008 SP2

On Windows 2008 R2 I am able to set NTFS permissions for an application pool's synthesised ApplicationPoolIdentity account thus: ICACLS d:\websites\site1\www /grant "IIS AppPool\site1":(CI)(OI)(M) ...
0
votes
1answer
102 views

make iis/asp.net give as less as possible information

This question is related to security of a website. I know that web servers give information as if it was a pride (mostly in header form yet also in error pages as well). In this case, IIS (dev. ...
1
vote
2answers
282 views

Why would a php file return 404 while in the bin directory on IIS7?

I'm running IIS7 and I have fastCGI installed and php code works just fine normally. Today I added a php file that contained only code an no html to the bin directory. And when I try to access it via ...
0
votes
2answers
257 views

Best solution for development IIS to reach files via UNC share

What is the best way to configure security with IIS to allow developers local IIS instances reach a UNC share for documents that are in our deployed website but not a part of the development source?
0
votes
1answer
377 views

IIS7 authentication

To give our user's the ability to protect content on their IIS6 sites we used a tool called IISPassword which emulates .htaccess to provide Basic authentication. There isn't support for IISPassword ...
1
vote
2answers
1k views

Best way to use large IP blacklist to deny access to a Windows 2008 web server?

Basically, I'm looking for a solution similar to the ones mentioned in a similar (but Linux-focussed thread) located here so that I can deny access to blacklisted IPs. I am specifically focussed on ...
18
votes
3answers
22k views

How do I block specific IPs and IP ranges in IIS7?

I'm trying to block various IP addresses from every site that I have hosted from an server running Windows 2008 and IIS7. I've found various information about how to do this using Deny rules from ...
2
votes
3answers
23k views

ASP.net user account permissions in IIS 7 on Windows 2008 server

I set up a global error handler in my ASP.net application, using Log4Net and a RollingLogFileAppender which has worked quite nicely up until. I'm in the middle of an upgrade to IIS 7 on Windows 2008 ...
1
vote
1answer
315 views

What user should an application pool bound to a Wordpress site use in IIS? [duplicate]

I've installed a wordpress site in a dedicated server with Windows 2008 server running IIS7 but I'm a little confused on what's the most secure way to set the appropriate file settings. The thing is ...
1
vote
2answers
2k views

IIS7 Applications: Deny WAN visitors and allow LAN visitors

Consider an IIS7 deployment with multiple Applications under a Web Site. Each is running under its own AppPool. We want to disallow all outside visitors access to one Application in particular. All ...
2
votes
2answers
3k views

Tips for setting up secure IIS7 webserver?

We are setting up our first Windows Server 2008 web server (previously we used Linux/Apache for all web servers), and I was hoping to get some helpful tips for setting it up and securing our ...
0
votes
2answers
1k views

What tools and/or procedures to use when hardening IIS7?

IIS6 had some tools for hardening, against attacks and holes. Does IIS7 have the same? If not, are there some standard thingst that should be done to protect it?
6
votes
1answer
9k views

In IIS 7.0, what is the difference between the application pool identity and the web site identity?

In IIS 5.0, by default the identity account of an application pool is ASPNET, and the website, unless impersonation is enabled, run under the account of its application pool's identity. But in IIS ...
0
votes
2answers
7k views

Why does my site use the IUSR account when configured for pass-through authentication?

I have an IIS7 website that is set to run in its own application pool. The application pool is configured as: Managed Pipeline Mode: Integrated Identity: I_siteuser (account is member of IIS_IUSRS) ...
2
votes
2answers
4k views

IIS7 is not propagating authorization to subdirectories

Our application is using forms authentication and the solution has been working well. Recently one of our 2008 servers developed a problem where the authorization is not being propagated to ...
2
votes
3answers
697 views

What should I do to secure a freshly installed Windows Server 2008?

A couple of times now my server has become none responsive, after checking the logs I was getting 10 requests a second to access IIS-FTP. After looking into that I noticed that the default settings ...
8
votes
3answers
11k views

Failed to generate a user instance of SQL Server

I'm using Windows 7 Beta and trying to install a web application locally. This web site uses Microsoft SQL Server 2005 Express (SQLEXPRESS) and a MDB file in the web site's ~/App_Data folder. I was ...