StigData/Processed/Windows-2012R2-IISServer-1.3.xml
|
<DISASTIG id="IIS_8-5_Server_STIG" version="1.3" created="7/3/2018"> <DocumentRule dscresourcemodule="None"> <Rule id="V-76679" severity="medium" conversionstatus="pass" title="SRG-APP-000015-WSR-000014" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>If web administration is performed at the console, this check is NA. If web administration is performed remotely the following checks will apply: If administration of the server is performed remotely, it will only be performed securely by system administrators. If website administration or web application administration has been delegated, those users will be documented and approved by the ISSO. Remote administration must be in compliance with any requirements contained within the Windows Server STIGs, and any applicable Network STIGs. Remote administration of any kind will be restricted to documented and authorized personnel. All users performing remote administration must be authenticated. All remote sessions will be encrypted and they will utilize FIPS 140-2-approved protocols. FIPS 140-2-approved TLS versions include TLS V1.1 or greater. Review with site management how remote administration, if applicable, is configured on the website. If remote management meets the criteria listed above, this is not a finding. If remote management is utilized and does not meet the criteria listed above, this is a finding.</rawString> </Rule> <Rule id="V-76699" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000015" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Interview the System Administrator about the role of the IIS 8.5 web server. If the IIS 8.5 web server is hosting an application, have the SA provide supporting documentation on how the application's user management is accomplished outside of the IIS 8.5 web server. If the IIS 8.5 web server is not hosting an application, this is Not Applicable. If the IIS web server is performing user management for hosted applications, this is a finding. If the IIS 8.5 web server is hosting an application and the SA cannot provide supporting documentation on how the application's user management is accomplished outside of the IIS 8.5 web server, this is a finding.</rawString> </Rule> <Rule id="V-76701" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000075" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Click on “Start”. Open Control Panel. Click on “Programs”. Click on “Programs and Features”. Review the installed programs, if any programs are installed other than those required for the IIS 8.5 web services, this is a finding. Note: If additional software is needed supporting documentation must be signed by the ISSO.</rawString> </Rule> <Rule id="V-76719" severity="high" conversionstatus="pass" title="SRG-APP-000211-WSR-000030" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Obtain a list of the user accounts with access to the system, including all local and domain accounts. Review the privileges to the web server for each account. Verify with the system administrator or the ISSO that all privileged accounts are mission essential and documented. Verify with the system administrator or the ISSO that all non-administrator access to shell scripts and operating system functions are mission essential and documented. If undocumented privileged accounts are found, this is a finding. If undocumented non-administrator access to shell scripts and operating system functions are found, this is a finding.</rawString> </Rule> <Rule id="V-76725.a" severity="medium" conversionstatus="pass" title="SRG-APP-000223-WSR-000011 Duplicate" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under "ASP.Net", double-click on the "Session State" icon. Under "Cookie Settings", verify the "Mode" has "Use Cookies" selected from the drop-down list.</rawString> </Rule> <Rule id="V-76725.b" severity="medium" conversionstatus="pass" title="SRG-APP-000223-WSR-000011 Duplicate" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under "ASP.Net", double-click on the "Session State" icon. Verify the "Regenerate expired session ID" check box is selected.</rawString> </Rule> <Rule id="V-76727.a" severity="medium" conversionstatus="pass" title="SRG-APP-000223-WSR-000145 Duplicate" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under the "ASP.NET" section, select "Session State". Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list.</rawString> </Rule> <Rule id="V-76729" severity="medium" conversionstatus="pass" title="SRG-APP-000225-WSR-000074" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Interview the System Administrator for the IIS 8.5 web server. Ask for documentation on the disaster recovery methods tested and planned for the IIS 8.5 web server in the event of the necessity for rollback. If documentation for a disaster recovery has not been established, this is a finding.</rawString> </Rule> <Rule id="V-76735" severity="medium" conversionstatus="pass" title="SRG-APP-000266-WSR-000142" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Access the IIS 8.5 Web Server. Access an administrator command prompt and type "regedit <enter>" to access the server's registry. Navigate to KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs\. If this key exists then indexing is enabled; if the key does not exist then this check is Not Applicable. Review the Catalogs keys to determine if directories other than web document directories are being indexed. If so, this is a finding.</rawString> </Rule> <Rule id="V-76739" severity="high" conversionstatus="pass" title="SRG-APP-000315-WSR-000003" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>If web administration is performed at the console, this check is Not Applicable. If web administration is performed remotely the following checks will apply. If administration of the server is performed remotely, it will only be performed securely by system administrators. If website administration or web application administration has been delegated, those users will be documented and approved by the ISSO. Remote administration must be in compliance with any requirements contained within the Windows Server STIGs, and any applicable network STIGs. Remote administration of any kind will be restricted to documented and authorized personnel. All users performing remote administration must be authenticated. All remote sessions will be encrypted and they will utilize FIPS 140-2-approved protocols. FIPS 140-2-approved TLS versions include TLS V1.1 or greater. Review with site management how remote administration, if applicable, is configured on the website. If remote management meets the criteria listed above, this is not a finding. If remote management is utilized and does not meet the criteria listed above, this is a finding.</rawString> </Rule> <Rule id="V-76743" severity="medium" conversionstatus="pass" title="SRG-APP-000316-WSR-000170" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Interview the System Administrator and Web Manager. Ask for documentation for the IIS 8.5 web server administration. Verify there are documented procedures for shutting down an IIS 8.5 website in the event of an attack. The procedure should, at a minimum, provide the following steps: Determine the respective website for the application at risk of an attack. Access the IIS 8.5 web server IIS Manager. Select the respective website. In the "Actions" pane, under "Manage Website", click on "Stop". If necessary, stop all websites. If necessary, stop the IIS 8.5 web server by selecting the web server in the IIS Manager. In the "Actions" pane, under "Manage Server", click on "Stop". If the web server is not capable of or cannot be configured to disconnect or disable remote access to the hosted applications when necessary, this is a finding.</rawString> </Rule> <Rule id="V-76749" severity="medium" conversionstatus="pass" title="SRG-APP-000380-WSR-000072" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Right-click InetMgr.exe, then click “Properties” from the “Context” menu. Select the "Security" tab. Review the groups and user names. The following account may have Full control privileges: TrustedInstaller Web Managers Web Manager designees The following accounts may have read and execute, or read permissions: Non Web Manager Administrators ALL APPLICATION PACKAGES (built-in security group) SYSTEM Users Specific users may be granted read and execute and read permissions. Compare the local documentation authorizing specific users, against the users observed when reviewing the groups and users. If any other access is observed, this is a finding.</rawString> </Rule> <Rule id="V-76751" severity="medium" conversionstatus="pass" title="SRG-APP-000383-WSR-000175" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Review programs installed on the OS. Open Control Panel. Open Programs and Features. The following programs may be installed without any additional documentation: Administration Pack for IIS IIS Search Engine Optimization Toolkit Microsoft .NET Framework version 3.5 SP1 or greater Microsoft Web Platform Installer version 3.x or greater Virtual Machine Additions Review the installed programs, if any programs are installed other than those listed above, this is a finding. Note: If additional software is needed and has supporting documentation signed by the ISSO, this is not a finding.</rawString> </Rule> <Rule id="V-76755" severity="medium" conversionstatus="pass" title="SRG-APP-000435-WSR-000148" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>If the IIS 8.5 web server is not hosting any applications, this is Not Applicable. If the IIS 8.5 web server is hosting applications, consult with the System Administrator to determine risk analysis performed when application was written and deployed to the IIS 8.5 web server. Obtain documentation on the configuration. Verify, at a minimum, the following tuning settings in the registry. Access the IIS 8.5 web server registry. Verify the following keys are present and configured. The required setting depends upon the requirements of the application. Recommended settings are not provided as these settings have to be explicitly configured to show a conscientious tuning has been made. Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\ "URIEnableCache" "UriMaxUriBytes" "UriScavengerPeriod" If explicit settings are not configured for "URIEnableCache", "UriMaxUriBytes" and "UriScavengerPeriod", this is a finding.</rawString> </Rule> <Rule id="V-76761" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Review the web server documentation and deployed configuration to determine which version of TLS is being used. If the TLS version is not TLS 1.1 or higher, according to NIST SP 800-52, or if non-FIPS-approved algorithms are enabled, this is a finding.</rawString> </Rule> <Rule id="V-76767" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Locate the HKEY_CLASSES_ROOT\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228} registry key. If the key exist, the File System Object component is enabled. If the File System Object component is enabled and is not required for operations, this is a finding. Note: If the File System Object component is required for operations and has supporting documentation signed by the ISSO, this is not a finding.</rawString> </Rule> </DocumentRule> <IisLoggingRule dscresourcemodule="xWebAdministration"> <Rule id="V-76681" severity="medium" conversionstatus="pass" title="SRG-APP-000092-WSR-000055" dscresource="xIISLogging"> <IsNullOrEmpty>False</IsNullOrEmpty> <LogCustomFieldEntry /> <LogFlags>Date,Time,ClientIP,UserName,Method,UriQuery,ProtocolVersion,Referer</LogFlags> <LogFormat /> <LogPeriod /> <LogTargetW3C /> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Click the "Logging" icon. Under Format select "W3C". Click "Select Fields", verify at a minimum the following fields are checked: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer. If not, this is a finding.</rawString> </Rule> <Rule id="V-76683" severity="medium" conversionstatus="pass" title="SRG-APP-000092-WSR-000055" dscresource="xIISLogging"> <IsNullOrEmpty>False</IsNullOrEmpty> <LogCustomFieldEntry /> <LogFlags /> <LogFormat /> <LogPeriod /> <LogTargetW3C>File,ETW</LogTargetW3C> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 server name. Click the "Logging" icon. Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected. If the "Both log file and ETW event" radio button is not selected, this is a finding.</rawString> </Rule> <Rule id="V-76687" severity="medium" conversionstatus="pass" title="SRG-APP-000099-WSR-000061" dscresource="xIISLogging"> <IsNullOrEmpty>False</IsNullOrEmpty> <LogCustomFieldEntry> <Entry> <SourceType>RequestHeader</SourceType> <SourceName>Connection</SourceName> </Entry> <Entry> <SourceType>RequestHeader</SourceType> <SourceName>Warning</SourceName> </Entry> </LogCustomFieldEntry> <LogFlags /> <LogFormat>W3C</LogFormat> <LogPeriod /> <LogTargetW3C /> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Access the IIS 8.5 web server IIS Manager. Click the IIS 8.5 web server name. Under "IIS", double-click the "Logging" icon. Verify the "Format:" under "Log File" is configured to "W3C". Select the "Fields" button. Under "Custom Fields", verify the following fields have been configured: Request Header >> Connection Request Header >> Warning If any of the above fields are not selected, this is a finding. </rawString> </Rule> <Rule id="V-76689" severity="medium" conversionstatus="pass" title="SRG-APP-000100-WSR-000064" dscresource="xIISLogging"> <IsNullOrEmpty>False</IsNullOrEmpty> <LogCustomFieldEntry /> <LogFlags>UserAgent,UserName,Referer</LogFlags> <LogFormat>W3C</LogFormat> <LogPeriod /> <LogTargetW3C /> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Access the IIS 8.5 web server IIS Manager. Click the IIS 8.5 web server name. Under "IIS", double-click the "Logging" icon. Verify the "Format:" under "Log File" is configured to "W3C". Select the "Fields" button. Under "Standard Fields", verify "User Agent", "User Name" and "Referrer" are selected. Under "Custom Fields", verify the following field have been configured: Request Header >> User-Agent Request Header >> Authorization Response Header >> Content-Type If any of the above fields are not selected, this is a finding. </rawString> </Rule> <Rule id="V-76747" severity="medium" conversionstatus="pass" title="SRG-APP-000357-WSR-000150" dscresource="xIISLogging"> <IsNullOrEmpty>False</IsNullOrEmpty> <LogCustomFieldEntry /> <LogFlags /> <LogFormat /> <LogPeriod>daily</LogPeriod> <LogTargetW3C /> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under "IIS" double-click on the "Logging" icon. In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written. Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging. Under "Log File Rollover", verify the "Do not create new log files" is not selected. Verify a schedule is configured to rollover log files on a regular basis. Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 8.5 web server to another logging device. If the designated logging path device is not of sufficient space to maintain all log files and there is not a schedule to rollover files on a regular basis, this is a finding.</rawString> </Rule> </IisLoggingRule> <ManualRule dscresourcemodule="None"> <Rule id="V-76685" severity="medium" conversionstatus="pass" title="SRG-APP-000098-WSR-000060" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Interview the System Administrator to review the configuration of the IIS 8.5 architecture and determine if inbound web traffic is passed through a proxy. If the IIS 8.5 web server is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server. Follow this procedure for web server and each website: Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Click the "Logging" icon. Click on "View log files" under the "Actions" pane. When the log file is displayed, review source IP information in log entries and verify the entries do not reflect the IP address of the proxy server. If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding.</rawString> </Rule> <Rule id="V-76691" severity="medium" conversionstatus="pass" title="SRG-APP-000118-WSR-000068" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Query the SA to determine who has update access to the web server log files. The role of auditor and the role of SA should be distinctly separate. An individual functioning as an auditor should not also serve as an SA due to a conflict of interest. Only management authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit. Only management authorized individuals with a privileged ID or group ID associated with either an SA or web administrator role may have read authority to log files for the web servers he or she has been authorized to administer. No other individuals may access log files. If an account associated with roles other than auditors, SAs, or web administrators have any access to log files, this is a finding. If an account with roles other than auditor has greater than read authority to the log files, this is a finding. This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. </rawString> </Rule> <Rule id="V-76693" severity="medium" conversionstatus="pass" title="SRG-APP-000119-WSR-000069" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Click the "Logging" icon. Click the "Browse" button and navigate to the directory where the log files are stored. Right-click the log file name to review and click “Properties”. Click the "Security" tab. Verify only authorized groups are listed, if others are listed, this is a finding. If an account associated with roles other than auditors, SAs, or web administrators have any access to log files, this is a finding. If an account with roles other than auditor has greater than read authority to the log files, this is a finding. This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. </rawString> </Rule> <Rule id="V-76695" severity="medium" conversionstatus="pass" title="SRG-APP-000120-WSR-000070" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Click the "Logging" icon. Click the "Browse" button and navigate to the directory where the log files are stored. Right-click the log file name to review and click Properties. Click the "Security" tab. If an account associated with roles other than auditors, SAs, or web administrators have any access to log files, this is a finding. If an account with roles other than auditor has greater than read authority to the log files, this is a finding. This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. </rawString> </Rule> <Rule id="V-76697" severity="medium" conversionstatus="pass" title="SRG-APP-000125-WSR-000071" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>The IIS 8.5 web server and website log files should be backed up by the system backup. To determine if log files are backed up by the system backup, determine the location of the web server log files and each website's log files. Open the IIS 8.5 Manager. Click the IIS 8.5 server name. Click the "Logging" icon. Under "Log File" >> "Directory" obtain the path of the log file. Once all locations are known, consult with the System Administrator to review the server's backup procedure and policy. Verify the paths of all log files are part of the system backup. Verify log files are backed up to an unrelated system or onto separate media than the system the web server is running on. If the paths of all log files are not part of the system backup and/or not backed up to a separate media, this is a finding. </rawString> </Rule> <Rule id="V-76705" severity="high" conversionstatus="pass" title="SRG-APP-000141-WSR-000077" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Navigate to the following folders: inetpub\ Program Files\Common Files\System\msadc Program Files (x86)\Common Files\System\msadc If the folder or sub-folders contain any executable sample code, example applications, or tutorials which are not explicitly used by a production website, this is a finding.</rawString> </Rule> <Rule id="V-76707" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000078" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Access the IIS 8.5 web server. Access “Apps” menu. Under “Administrative Tools”, select “Computer Management”. In left pane, expand "Local Users and Groups" and click on "Users". Review the local users listed in the middle pane. If any local accounts are present and were created by features which have been uninstalled or are not used, this is a finding.</rawString> </Rule> <Rule id="V-76709" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000080" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Consult with the System Administrator and review all of the IIS 8.5 and Operating System features installed. Determine if any are installed which are no longer necessary for operation. If any utility programs, features or modules are installed which are not necessary for operation, this is a finding. If any unnecessary Operating System features are installed, this is a finding.</rawString> </Rule> <Rule id="V-76715" severity="medium" conversionstatus="pass" title="SRG-APP-000175-WSR-000095" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "Server Certificate" icon. Double-click each certificate and verify the certificate path is to a DoD root CA. If not, this is a finding.</rawString> </Rule> <Rule id="V-76717" severity="medium" conversionstatus="pass" title="SRG-APP-000206-WSR-000128" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Search the system for files with either .java or .jpp extensions. If files with .java or .jpp extensions are found, this is a finding.</rawString> </Rule> <Rule id="V-76721" severity="medium" conversionstatus="pass" title="SRG-APP-000211-WSR-000129" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Review the IIS 8.5 web server configuration with the System Administrator. Determine if the IIS 8.5 web server hosts any applications. If the IIS 8.5 web server does not host any applications, this is Not Applicable. If the IIS 8.5 web server hosts applications, review the application's management functionality and authentication methods with the System Administrator to determine if the management of the application is accomplished with the same functions and authentication methods as the web server management. If the IIS 8.5 web server management and the application's management functionality is not separated, this is a finding.</rawString> </Rule> <Rule id="V-76741" severity="medium" conversionstatus="pass" title="SRG-APP-000315-WSR-000004" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Note: The Management Tools must be installed in order to validate this requirement. Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under "Management", double-click "Management Service". If "Enable remote connections" is not selected, this is Not Applicable. If "Enable remote connections" is selected, review the entries under "IP Address Restrictions". Verify only known, secure IP ranges are configured as "Allow". If "IP Address Restrictions" are not configured or IP ranges configured to be "Allow" are not restrictive enough to prevent connections from nonsecure zones, this is a finding.</rawString> </Rule> <Rule id="V-76753" severity="medium" conversionstatus="pass" title="SRG-APP-000383-WSR-000175" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>If the Print Services role and the Internet Printing role are not installed, this check is Not Applicable. Navigate to the following directory: %windir%\web\printers If this folder exists, this is a finding. Determine whether Internet Printing is enabled: Click “Start”, then click “Administrative Tools”, and then click “Server Manager”. Expand the roles node, then right-click “Print Services”, and then select “Remove Roles Services”. If the Internet Printing option is enabled, this is a finding.</rawString> </Rule> <Rule id="V-76763" severity="medium" conversionstatus="pass" title="SRG-APP-000456-WSR-000187" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Determine the most recent patch level of the IIS 8.5 software, as posted on the Microsoft website. Open the IIS 8.5 Manager. Click "Help", and select "About Internet Information Services". If the version is more than one version behind the most recent patch level, this is a finding. </rawString> </Rule> <Rule id="V-76765" severity="high" conversionstatus="pass" title="SRG-APP-000516-WSR-000079" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Access the IIS 8.5 web server. Access Apps menu. Under Administrative Tools, select Computer Management. In left pane, expand "Local Users and Groups" and click on "Users". Review the local users listed in the middle pane. If any local accounts are present and are used by IIS 8.5 verify with System Administrator that default passwords have been changed. If passwords have not been changed from the default, this is a finding.</rawString> </Rule> <Rule id="V-76771" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="None"> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the “Authorization Rules” icon. If any user other than “Administrator” is listed, this is a finding. </rawString> </Rule> </ManualRule> <MimeTypeRule dscresourcemodule="xWebAdministration"> <Rule id="V-76711.a" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping"> <Ensure>Absent</Ensure> <Extension>.exe</Extension> <IsNullOrEmpty>False</IsNullOrEmpty> <MimeType>application/octet-stream</MimeType> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under IIS, double-click the “MIME Types” icon. From the "Group by:" drop-down list, select "Content Type". From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions: If any OS shell MIME types are configured, this is a finding. .exe</rawString> </Rule> <Rule id="V-76711.b" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping"> <Ensure>Absent</Ensure> <Extension>.dll</Extension> <IsNullOrEmpty>False</IsNullOrEmpty> <MimeType>application/x-msdownload</MimeType> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under IIS, double-click the “MIME Types” icon. From the "Group by:" drop-down list, select "Content Type". From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions: If any OS shell MIME types are configured, this is a finding. .dll</rawString> </Rule> <Rule id="V-76711.c" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping"> <Ensure>Absent</Ensure> <Extension>.com</Extension> <IsNullOrEmpty>False</IsNullOrEmpty> <MimeType>application/octet-stream</MimeType> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under IIS, double-click the “MIME Types” icon. From the "Group by:" drop-down list, select "Content Type". From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions: If any OS shell MIME types are configured, this is a finding. .com</rawString> </Rule> <Rule id="V-76711.d" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping"> <Ensure>Absent</Ensure> <Extension>.bat</Extension> <IsNullOrEmpty>False</IsNullOrEmpty> <MimeType>application/x-bat</MimeType> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under IIS, double-click the “MIME Types” icon. From the "Group by:" drop-down list, select "Content Type". From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions: If any OS shell MIME types are configured, this is a finding. .bat</rawString> </Rule> <Rule id="V-76711.e" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000081" dscresource="xIisMimeTypeMapping"> <Ensure>Absent</Ensure> <Extension>.csh</Extension> <IsNullOrEmpty>False</IsNullOrEmpty> <MimeType>application/x-csh</MimeType> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under IIS, double-click the “MIME Types” icon. From the "Group by:" drop-down list, select "Content Type". From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions: If any OS shell MIME types are configured, this is a finding. .csh</rawString> </Rule> </MimeTypeRule> <PermissionRule dscresourcemodule="AccessControlDsc"> <Rule id="V-76745" severity="medium" conversionstatus="pass" title="SRG-APP-000340-WSR-000029" dscresource="NTFSAccessEntry"> <AccessControlEntry> <Entry> <Type> </Type> <Principal>System</Principal> <ForcePrincipal>False</ForcePrincipal> <Inheritance> </Inheritance> <Rights>FullControl</Rights> </Entry> <Entry> <Type> </Type> <Principal>Administrators</Principal> <ForcePrincipal>False</ForcePrincipal> <Inheritance> </Inheritance> <Rights>FullControl</Rights> </Entry> <Entry> <Type> </Type> <Principal>TrustedInstaller</Principal> <ForcePrincipal>False</ForcePrincipal> <Inheritance> </Inheritance> <Rights>FullControl</Rights> </Entry> <Entry> <Type> </Type> <Principal>ALL APPLICATION PACKAGES</Principal> <ForcePrincipal>False</ForcePrincipal> <Inheritance> </Inheritance> <Rights>ReadAndExecute</Rights> </Entry> <Entry> <Type> </Type> <Principal>Users</Principal> <ForcePrincipal>False</ForcePrincipal> <Inheritance> </Inheritance> <Rights>ReadAndExecute,ListDirectory</Rights> </Entry> </AccessControlEntry> <Force>True</Force> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <Path>%windir%\inetpub</Path> <rawString>Open Explorer and navigate to the inetpub directory. Right-click inetpub and select “Properties”. Click the "Security" tab. Verify the permissions for the following users; if the permissions are less restrictive, this is a finding. System: Full control Administrators: Full control TrustedInstaller: Full control ALL APPLICATION PACKAGES (built-in security group): Read and execute Users: Read and execute, list folder contents Creator/Owner: Special permissions to subkeys</rawString> </Rule> </PermissionRule> <RegistryRule dscresourcemodule="PSDesiredStateConfiguration"> <Rule id="V-76759.a" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry"> <Ensure>Present</Ensure> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server Verify a REG_DWORD value of "0" for "DisabledByDefault"</rawString> <ValueData>0</ValueData> <ValueName>DisabledByDefault</ValueName> <ValueType>Dword</ValueType> </Rule> <Rule id="V-76759.b" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry"> <Ensure>Present</Ensure> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server Verify a REG_DWORD value of "0" for "DisabledByDefault"</rawString> <ValueData>0</ValueData> <ValueName>DisabledByDefault</ValueName> <ValueType>Dword</ValueType> </Rule> <Rule id="V-76759.c" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry"> <Ensure>Present</Ensure> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server Verify a REG_DWORD value of "1" for "DisabledByDefault"</rawString> <ValueData>1</ValueData> <ValueName>DisabledByDefault</ValueName> <ValueType>Dword</ValueType> </Rule> <Rule id="V-76759.d" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry"> <Ensure>Present</Ensure> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server Verify a REG_DWORD value of "1" for "DisabledByDefault"</rawString> <ValueData>1</ValueData> <ValueName>DisabledByDefault</ValueName> <ValueType>Dword</ValueType> </Rule> <Rule id="V-76759.e" severity="high" conversionstatus="pass" title="SRG-APP-000439-WSR-000156" dscresource="Registry"> <Ensure>Present</Ensure> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server Verify a REG_DWORD value of "1" for "DisabledByDefault"</rawString> <ValueData>1</ValueData> <ValueName>DisabledByDefault</ValueName> <ValueType>Dword</ValueType> </Rule> </RegistryRule> <WebConfigurationPropertyRule dscresourcemodule="xWebAdministration"> <Rule id="V-76703" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000076" dscresource="xWebConfigKeyValue"> <ConfigSection>/system.webServer/proxy</ConfigSection> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>enable</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Under the "Connections" pane on the left side of the management console, select the IIS 8.5 web server. If, under the IIS installed features, "Application Request Routing Cache" is not present, this is not a finding. If, under the IIS installed features, "Application Request Routing Cache" is present, double-click the icon to open the feature. From the right "Actions" pane, under "Proxy", select "Server Proxy Settings...". In the "Application Request Routing" settings window, verify whether "Enable proxy" is selected. If “Enable proxy" is selected under the "Application Request Routing" settings, this is a finding.</rawString> <Value>false</Value> </Rule> <Rule id="V-76723.a" severity="medium" conversionstatus="pass" title="SRG-APP-000220-WSR-000201" dscresource="xWebConfigKeyValue"> <ConfigSection>/system.web/sessionState</ConfigSection> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>cookieless</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". Verify "cookieless" is set to "UseCookies".</rawString> <Value>1</Value> </Rule> <Rule id="V-76723.b" severity="medium" conversionstatus="pass" title="SRG-APP-000220-WSR-000201" dscresource="xWebConfigKeyValue"> <ConfigSection>/system.web/sessionState</ConfigSection> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>regenerateExpiredSessionID</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". Verify the "regenerateExpiredSessionID" is set to "True".</rawString> <Value>True</Value> </Rule> <Rule id="V-76727.b" severity="medium" conversionstatus="pass" title="SRG-APP-000223-WSR-000145" dscresource="xWebConfigKeyValue"> <ConfigSection>/system.web/sessionState</ConfigSection> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>timeout</Key> <OrganizationValueRequired>True</OrganizationValueRequired> <OrganizationValueTestString>[TimeSpan]{0} -le [TimeSpan]'00:20:00'</OrganizationValueTestString> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under the "ASP.NET" section, select "Session State". Under Time-out (in minutes), verify “20 minutes or less” is selected. If the "Use Cookies” mode is selected and Time-out (in minutes) is configured for “20 minutes or less”, this is not a finding.</rawString> <Value> </Value> </Rule> <Rule id="V-76731" severity="medium" conversionstatus="pass" title="SRG-APP-000231-WSR-000144" dscresource="xWebConfigKeyValue"> <ConfigSection>/system.web/machineKey</ConfigSection> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>decryption</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "Machine Key" icon in the website Home Pane. Verify "HMACSHA256" or stronger encryption is selected for the Validation method and "Auto" is selected for the Encryption method. If "HMACSHA256" or stronger encryption is not selected for the Validation method and/or "Auto" is not selected for the Encryption method, this is a finding. </rawString> <Value>Auto</Value> </Rule> <Rule id="V-76733" severity="medium" conversionstatus="pass" title="SRG-APP-000251-WSR-000157" dscresource="xWebConfigKeyValue"> <ConfigSection>/system.webServer/directoryBrowse</ConfigSection> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>enabled</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "Directory Browsing" icon. Under the “Actions” pane verify "Directory Browsing" is disabled. If “Directory Browsing” is not disabled, this is a finding.</rawString> <Value>false</Value> </Rule> <Rule id="V-76737" severity="medium" conversionstatus="pass" title="SRG-APP-000266-WSR-000159" dscresource="xWebConfigKeyValue"> <ConfigSection>/system.webServer/httpErrors</ConfigSection> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>errormode</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "Error Pages" icon. Click each error message and click "Edit Feature Setting" from the "Actions" Pane. If any error message is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.</rawString> <Value>0</Value> </Rule> <Rule id="V-76757" severity="medium" conversionstatus="pass" title="SRG-APP-000439-WSR-000152" dscresource="xWebConfigKeyValue"> <ConfigSection>/system.webServer/asp/session</ConfigSection> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>keepSessionIdSecure</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Under "Management" section, double-click the "Configuration Editor" icon. From the "Section:" drop-down list, select “system.webServer/asp". Expand the "session" section. Verify the "keepSessionIdSecure" is set to "True". If the "keepSessionIdSecure" is not set to "True", this is a finding.</rawString> <Value>True</Value> </Rule> <Rule id="V-76769.a" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebConfigKeyValue"> <ConfigSection>/system.webServer/security/isapiCgiRestriction</ConfigSection> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>notListedCgisAllowed</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "ISAPI and CGI restrictions" icon. Click “Edit Feature Settings". Verify the "Allow unspecified CGI modules" check box is not checked</rawString> <Value>false</Value> </Rule> <Rule id="V-76769.b" severity="medium" conversionstatus="pass" title="SRG-APP-000516-WSR-000174" dscresource="xWebConfigKeyValue"> <ConfigSection>/system.webServer/security/isapiCgiRestriction</ConfigSection> <IsNullOrEmpty>False</IsNullOrEmpty> <Key>notListedIsapisAllowed</Key> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "ISAPI and CGI restrictions" icon. Click “Edit Feature Settings". Verify the "Allow unspecified ISAPI modules" check box is not checked</rawString> <Value>false</Value> </Rule> </WebConfigurationPropertyRule> <WindowsFeatureRule dscresourcemodule="PSDesiredStateConfiguration"> <Rule id="V-76713" severity="medium" conversionstatus="pass" title="SRG-APP-000141-WSR-000085" dscresource="WindowsFeature"> <FeatureName>Web-DAV-Publishing</FeatureName> <InstallState>Absent</InstallState> <IsNullOrEmpty>False</IsNullOrEmpty> <OrganizationValueRequired>False</OrganizationValueRequired> <OrganizationValueTestString /> <rawString>Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Review the features listed under the “IIS" section. If the "WebDAV Authoring Rules" icon exists, this is a finding.</rawString> </Rule> </WindowsFeatureRule> </DISASTIG> |