Securing an installation of IIS 4. (No, seriously)

I'd like to add a few things to this (mostly from "Hacking Windows 2000 Exposed", AWESOM book!):

*Move your C:\inetpub\wwwroot folder to another drive (ex: d:\inetpub\wwwroot) so system files/executables (commands) aren't accessible with file system traversal vulnerabilities (can't change to other drives that way).

*DON'T store passwords or other login info in active server files, use COM components for backend connectivity
-> If you can't do that, at least don't store these in .inc files: change the extensions form .inc to .asp. This won't break the functionnality but will (if patched correctly!) prevent someone from guessing the file url and viewing the info since the page will be interpreted...

*Precisions on the NTFS perms: remove IUSR (IWAM) from guest group, make sure they only have read access. If write access is necessary, make sure they never have both read(/execute) and right access at the same time on the same folder/files.


Finaly, as I plugged earlier, "Hacking Windows 2000 Exposed" (McGraw Hill) is a must for anyone who administrers a windows network/servers. They have a nice checklist to sercure windows and IIS ans SQL server....

Ammo

Good work... A job well done... :thumbsup:

/me gives you some green for all the work you put into this thread...


System_0verload

Very good post and a good start for those that need insta-IIS help. I use apache and postgresql myself, but this is a very good tutorial, links and all. Greenies to you for this!

It is a good post and it sums up lot's of things but I would appreciate if you made your references more clear. At the end you refer to symantec, microsoft, packetstorm; however some parts ar taken directly from those sources. I'm not blaming you (I even gave you greenies) but for people that want to have a closer look into the principles or just more reading about the things you said, complete links would be usefull.
Here's an example:

Quote:

---

Best Practice: Least Privilege
Least Privilege requires that each subject be granted the most restrictive set of privileges needed for the performance of authorized tasks. Applying this principle will limit the damage that can result from either accident, error, or unauthorized use of an information system.

---

source: http://securityresponse.symantec.com...nt/1865-6.html

Quote:

---

Best Practice: Least Privilege
Least Privilege requires that each subject be granted the most restrictive set of privileges needed for the performance of authorized tasks. Applying this principle will limit the damage that can result from either accident, error, or unauthorized use of an information system.

---

source: http://www.antionline.com/showthread...hreadid=228538 by NTSA.

hmmm very similar...not?

Assuming you want to run IIS4, you're probably in a MS shop.

As such, I would think one of the first things you should do to secure IIS4 is

- Migrate to Win2k as soon as possible

IIS5 may not be terribly different from IIS4 in many respects, but they did close some loopholes and it's much more reliable (if still not ideal)

Most of the above points however apply equally is IIS5.

VictorKaum --

Yes, sorry - that bit should have been in quote /quote. Please accept it as a typo rather than deliberate plagerism though. Whilst I was writing the article I remembered reading that sentence on the symantec website and I didn't think I'd be able to match it for it's succinctness. I do quote symantec at the end of the article but just plain forgot to quote /quote that paragraph.

That said I re-read the rest of the article and that's the _only_ paragraph that wasn't 100% my own words.

Any-hoo - point taken - I will be more careful about quoting source references next time (the 1440 mins edit limit is now passed so I can't now make the changes on this article - I /did/ try ;)) Thanks for the greens!

Quote:

---

Originally posted here by ntsa
VictorKaum --

Yes, sorry - that bit should have been in quote /quote. Please accept it as a typo rather than deliberate plagerism. Whilst I was writing the article I remembered reading that sentence on the symantec website and I didn't think I'd be able to match it for it's succintctness. I did quote symantec at the end but just forgot to quote /quote that paragraph.

That said I re-read the rest of the article and that's the _only_ paragraph that wasn't 100% my own words.

Any-hoo - point taken - I will be more careful about source references next time (the 1440 mins edit limit is now passed so I can't now make the change on this article - I /did/ try ;)) Thanks for the greens!

---

Lol, I believe you NTSA, I took that paragraph as an example cause it was written in such a perfect English that it looked suspicious... ;) but hey no problem...

And indeed looking at those sentences again... I also don't know a way to explain it better then symantec did.

but hey no problem afterall you mention sources or at least you try to ;) j/k

nice 1 t/y

I was going to do a follow up to this on the SQL aspects - but zigar beat me to it. Check out his post (and my comments) here:
http://www.antionline.com/showthread...hreadid=230067