2

A couple of times now my server has become none responsive, after checking the logs I was getting 10 requests a second to access IIS-FTP.

After looking into that I noticed that the default settings allow 100,000 requests!

So I changed that to 5 and implemented "block all IPs except from.."

What other default settings should we be changing?

Improve this question

3 Answers 3

Reset to default
1

Take a look at the Security Configuration Wizard (http://technet.microsoft.com/en-us/magazine/cc194400.aspx) and the Windows Server 2008 Security Compliance Management Toolkit (http://technet.microsoft.com/en-us/library/cc514539.aspx). Both are free and will do everything you need. The wizard will help you secure a single server, and the toolkit includes the following:

  • Security guide – The updated security guide for Windows Server 2008. The guidance provides you with best practices and information about automated tools to help you plan and deploy your security baseline.
  • Attack Surface Reference workbook – A resource that lists the changes introduced as server roles are installed on computers running Windows Server 2008.
  • Security Baseline Settings workbook – A resource that lists the prescribed settings for each of the preconfigured security baselines that the guide recommends.
  • Security Baseline XML – An XML file that allows customers to consume the data defined in the Security Baseline Settings workbook.
  • GPOAccelerator tool – A tool that you can use to create all the GPOs you need to deploy your chosen security configuration.
  • INF Files – INF files for Windows Server 2008.
  • Baseline Compliance Management Overview – An overview that includes best practices about how to monitor security baselines for computers running Windows Server 2008.
Improve this answer
0

You could block all but your alloed IP's on your firewall if you have one seperatley from the server. This would take the workload off of the server and save your logs getting filled with request spam

Improve this answer
0

I'm not sure about IIS-7, but you should check for any connection delay settings. Slowing down consecutive requests is usually enough to make a spammer/scanner/bruce forcer go away (google "tarpit").

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .