PCTech Forums

Recently when I scanned with Microsoft Baseline Security Analyzer I have encountered some security vulnerabilities - which are all cause of the Internet Information Services (IIS). I think it's better to take them one by one. So this is one of them:

Issue: IIS Logging enebled
Result: Some web or FTP sites are not using the recommended logging options.

What was scanned:

This check determines whether Internet Information Services (IIS) logging is enabled, and if the W3C Extended Log File Format is used.

IIS logging goes beyond the scope of the event logging or performance monitoring features of Windows. The logs can include information, such as who has visited your site, what the visitor viewed, and when the information was viewed last. You can monitor attempts, either successful or unsuccessful, to access your Web sites, virtual folders, or files. This includes events such as reading the file or writing to the file. You can choose which events you want to audit for any site, virtual folder, or file. By regularly reviewing these files, you can detect areas of your server or your sites that may be subject to attacks or other security problems. You can enable logging for individual Web sites and choose the log format. When logging is enabled, it is enabled for all the site's folders, but you can disable it for specific directories.

Result details:

Name: Default STP site
Protocol: FTP

SOLUTION:

Enable logging on your server running Internet Information Services (IIS) and use the W3C Extended Log File Format to log additional event properties.

Can someone tell me how to enable logging...? Windows XP

- Start Internet Information Services (IIS) Manager.

- Expand ServerName, and then expand Web Sites or FTP Sites. Right-click the Web site or the FTP site where you want to enable logging, and then click Properties.

- Click the Web Site tab, or click the FTP Site tab.

- Click to select the Enable logging check box.

- In the Active log format box, click the format that you want to use.

- Click Properties, and then specify the settings that you want. For example, if you use W3C Extended log file format, follow these steps: a. If you are running IIS 6.0, click the General tab. If you are running IIS 5.0 or IIS 4.0, click the General Properties tab. Specify the schedule that you want to use to create new log files. For example, to create a new log file every day, click Daily.

- If you want to use local time, click to select the Use local time for file naming and rollover check box.

-If you are running IIS 6.0, click the Advanced tab. If you are running IIS 5.0 or IIS 4.0, click the Extended Properties tab.

- Specify the options that you want. For example, specify the properties that are listed in the "Customize the data" section. Click OK.

- Click OK.

Hope this helps!

Sorry I took so long to reply. Had to go to work . Anyway you should choose the options that you want. The Options I set up for myself are:

Specify the schedule that you want to use to create new log files - I set mine to daily.

If you want to use local time, click to select the Use local time for file naming and rollover check box. - I put a check in that box (Use local time for file naming and rollover) and I changed the directory that my log file goes to under "Log File Directory".

Specify the options that you want.- Mine are- date, time, "Extended options" client ip, user name, service name, server name, method, URI stem, protocal status, time taken, host, referer.

You may want to go with diffrent options, but thats what I have mine set to. To view my log file I go to the folder I chose for it to be saved to and just open it.

Hope this helps ya!

I dont know if you have used the IIS lock down tool. I used it before I ran the Baseline Security Analyzer and passed all the checks. Heres the link »

Hmmm nothing, anyways. Now let me tell you the other vulnerabilities which are all IIS ones (4 marked with and '!' and 1 with 'x'):

! (Issue) Sample Application - Error Reading the IIS metabase (Result)

Check Description:

This check determines whether the following Internet Information Services (IIS) sample file directories are installed on the scanned computer:

- \Inetpub\iissamples
- \Winnt\help\iishelp
- \Program Files\common files\system\msadc

The sample applications typically installed with IIS illustrate dynamic HTML (DHTML) and Active Server Pages (ASP) scripting, and provide online documentation.

! (Issue) IISAdmin Virtual Directory - Error reading the IIS metabase (Result)

Check Description:

This check determines whether the IISADMPWD directory is installed on the scanned computer.

Internet Information Server (IIS) 4.0 enables users to change their Windows® passwords and to notify users that their passwords are about to expire. The IISADMPWD virtual directory that installs as part of the default Web site in IIS 4.0 contains files that are used by this feature. This feature is implemented as a set of .htr files located in the <system>\System32\Inetsrv\Iisadmpwd directory and an ISAPI extension named Ism.dll.

! (Issue) Parent Paths - Error reading the IIS metabase (Result)

Check Description:

This check determines whether the AspEnableParentPaths setting is enabled on the scanned computer.

By enabling parent paths on Microsoft® Internet Information Services (IIS), pages in Active Server Pages (ASP) can use relative paths to the parent directory of the current directory (that is, paths that use the .. syntax).

! (Issue) MSADC and Scripts Virtual Directories - Error reading the IIS metabase (Result)

Check Description:

This check determines whether the MSADC (sample data access scripts) and Scripts virtual directories are installed on a scanned server running Internet Information Services (IIS). These directories typically contain scripts that, if not required, should be removed to help reduce the attack surface of the computer.

X (Issue) IIS Lockdown Tool - The IIS Lockdown tool has not been run on the machine. (Result)

Check Description:

This check determines whether version 2.1 of the Internet Information Services (IIS) Lockdown tool, part of the Microsoft Security Tool Kit, has been run on the scanned computer.

The IIS Lockdown tool works by turning off unnecessary features in IIS, thereby reducing the attack surface available to attackers. Using the IIS Lockdown tool should be one of the first steps administrators take in securing their Web servers.

Note: The IIS Lockdown tool was developed for IIS 4.0, 5.0, and 5.1, and is not needed for new Microsoft® Windows® Server 2003 installations running IIS 6.0. If an upgrade is being performed from IIS 5.0 to IIS 6.0, then the lockdown tool should be run.

I picked "Other". And I left all the other settings alone.

Another tool you might want is IISPassword for IIS, v1.0. Its pretty easy to configure. It password protects your page through IIS. Get it here »

OH!! Genius

There's only 2 vulnerabilities remained which are:

1) IIS Lockdown tool is not installed yet
2) And IIS is not not using the recommended logging options

THANKS FOR THE IISPASSWORD

Glad to hear that things worked out for ya.

You got the "IIS Lockdown tool is not installed yet " after you installed and ran it?

" IIS is not not using the recommended logging options" I get that too. I thinks its because of the W3C Extended log file format. The diffrent formats are as follows»

The W3C Extended log file format, IIS log file format, and NCSA Common log file format are all ASCII text formats (unless UTF-8 is enabled for your Web sites). The W3C Extended and NCSA Common formats record logging data in four-digit year format. The IIS format uses a two-digit year format for years 1999 and earlier, and a four-digit format thereafter. For NCSA and IIS log file format , the data logged for each request is fixed. However, W3C Extended allows you to choose the properties you want to log for each request. W3C Extended format uses Coordinated Universal Time (UTC), basically the same as Greenwich Mean Time (GMT). W3C Extended format is a customizable ASCII format with a variety of different properties. You can log properties important to you, while limiting log size by omitting unwanted property fields. Properties are separated by spaces. Time is recorded as UTC. Thats why I picked W3C .

Just a note: I dont use IIS anymore. I switched to Apache Server so I have a whole new set of headaches now. Guess I just love the punishment.