TMA-IIS-3.9

Ensure 'MachineKey validation method - .Net 4.5' is configured

MediumLevel 1Automatediis

Description

The machineKey element of the ASP.NET web.config specifies the algorithm and keys that ASP.NET will use for encryption. The Machine Key feature can be managed to specify hashing and encryption settings for application services such as view state, Forms authentication, membership and roles, and anonymous identification. The following validation methods are available ... The .NET 4.x root web.config machineKey validation must be HMACSHA256 (HMACSHA384/512 are also accepted as stronger). PowerShell 5.1 with the WebAdministration module; run elevated.

How it is checked

Audit method: Shell command

shell

Import-Module WebAdministration -ErrorAction Stop; $c = Get-WebConfiguration -Filter 'system.web/machineKey' -PSPath 'MACHINE/WEBROOT'; if ([string]$c.validation -in @('HMACSHA256', 'HMACSHA384', 'HMACSHA512')) { 'compliant' } else { 'noncompliant' }

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT' -Filter system.web/machineKey -Name validation -Value HMACSHA256

Properties

Operating systems: Any
Tags: iisaspnetcrypto
Reference: CIS Microsoft IIS 10 Benchmark v1.2.1 - 3.9 Ensure 'MachineKey validation method - .Net 4.5' is configured

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target iis