Ensure 'Dynamic IP Address Restrictions' is enabled

MittelStufe 1Automatisiertiis

Beschreibung

Dynamic IP address filtering allows administrators to configure the server to block access for IPs that exceed the specified number of requests or request frequency. Note: Ensure that you receive the Forbidden page once the block has been enforced. Dynamic IP Address Restrictions denyByConcurrentRequests must be enabled at server level (fails when the IP and Domain Restrictions feature is not installed). Tune maxConcurrentRequests to your traffic. PowerShell 5.1 with the WebAdministration module; run elevated. CIS marks this recommendation Manual; the automated check implements its audit procedure.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

Import-Module WebAdministration -ErrorAction Stop; $c = Get-WebConfiguration -Filter 'system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests' -PSPath 'MACHINE/WEBROOT/APPHOST' -ErrorAction Stop; if ($c.enabled -eq $true) { 'compliant' } else { 'noncompliant' }

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests -Name enabled -Value True; set maxConcurrentRequests as appropriate

Eigenschaften

Betriebssysteme: Beliebig
Tags: iisdos
Referenz: CIS Microsoft IIS 10 Benchmark v1.2.1 - 4.11 Ensure 'Dynamic IP Address Restrictions' is enabled

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target iis