IIS Security

IIS Security the hard way... Locking down Microsoft IIS is challenging, to say the least.

There are significant security improvements in each version going from IIS 4.0 on Windows NT 4.0, to IIS 5.0 on Windows 2000, and finally IIS 6.0 on Windows Server 2003. In spite of this, securing IIS is a tedious process because it requires significant manual configuration.

System Changes

1. The most important change you can make is moving the Inetpub directory off the system drive. By default, the Inetpub directory is created on the system drive leaving the system vulnerable to directory traversal attacks.
   Before making any changes, back up the IIS Metabase, and all the content in the Inetpub directory. Download this script to move the IIS sites to the D: drive. Feel free to modify and edit the file as needed; the comments in the file should allow you to make changes as needed. Once the Inetpub directory has been moved, delete the original directory from C:\Inetpub.
2. After moving the Inetpub directory, lock down the permissions on the D:\ drive. By default, the Everyone group is assigned Full Control permissions to the root of the drive. Remove the permissions for the Everyone group, assign the following permissions:
   
   1. Administrators (local group) - Full Control
   2. Authenticated Users (local group) - List Folder Contents
   3. Backup Operators (local group) - Change
   4. System - Full Control
3. Move the IIS log files off the system drive by editing the Master properties for the WWW, FTP, SMTP, and NNTP services to write the logs to a drive other than the system drive. The default behavior of IIS writes the log files to %systemroot%\system32\LogFiles\. This could cause problems by consuming drive space on the system drive, which is why the logs should be written to another volume.
4. Stop and disable the default website, default FTP site, and default SMTP site (as needed). These should only be enabled if specifically configured to run if required. At the very least, change the configuration on each to run on a specific IP instead of the default Any setting.
5. In addition to disabling the default website, the content in the site directories should be deleted and remove any references to the iisstart.htm page from the Documents tab on the default web site.
6. Disable Parent Paths in the root properties of the server.

Microsoft has tried to make system changes easier with two tools, the IIS Lockdown tool and URLScan. Both are really handy and critical for running IIS 4.0 or 5.0. Some of the functionality has been integrated into IIS 6.0 so IIS Lockdown is unnecessary for Windows Server 2003 systems.

IIS Lockdown

The IIS Lockdown tool removes components of IIS that are enabled by default and have known vulnerabilities. If you do not need any of that functionality, running IIS Lockdown and removing those components goes a long way toward securing the server. The IIS Lockdown tool also changes the security ACL's on files in the winnt and the inetpub directories to enhance security.

IIS Lockdown, do not run a web server without it! Pay special attention to the specifics of the type of server you are going to be running. Each IIS Lockdown template is different and choosing the wrong template can disable critical functionality.

1. Download the IIS Lockdown Tool for IIS 4.0 through 5.1.
2. Microsoft KB article on using the IIS Lockdown tools KB ID 325864 which includes links to configuring IIS Lockdown for specific roles such as Exchange front-end server or Share Point Portal Server.

URL Scan

URL Scan is a powerful and little understood tool that parses inbound web requests to the server, rejecting any requests that violate its configured settings. URL Scan intercepts requests before they are ever passed to IIS, so malicious URL requests can be blocked without IIS ever seeing them. There are a variety of malicious applications and scripts that scan the Internet looking for vulnerable hosts running IIS. These apps and scripts will send a load of requests with malicious URL's to the IIS server, trying to compromise the box or at least determine that the server will respond to those requests. URL Scan blocks those requests from reaching IIS, effectively shutting the malicious probe down.

1. Download URL Scan 2.5 to update the version that is included in the IIS Lockdown.
2. Change the default Logging Directory in the urlscan.ini to a non-system drive, perhaps the same directory with the IIS logs.
3. Modify the urlscan.ini to allow applications as needed. Some applications like Exchange require changes to the default URL Scan configuration.

Microsoft Baseline Security Analyzer

The Microsoft Baseline Security Analyzer is a free vulnerability assessment tool provided by Microsoft. The MBSA is available for download from Microsoft.

Final Notes

The most important thing to do for any public-facing web server, is keeping the system up-to-date with the latest patches for IIS, Windows, MDAC, XML, and so on. Use the MBSA to keep track of the patches applied to the server, and what patches require updating.