TMA-IIS-4.11

Ensure 'Dynamic IP Address Restrictions' is enabled

MediumLevel 1Automatediis

Description

Dynamic IP address filtering allows administrators to configure the server to block access for IPs that exceed the specified number of requests or request frequency. Note: Ensure that you receive the Forbidden page once the block has been enforced. Dynamic IP Address Restrictions denyByConcurrentRequests must be enabled at server level (fails when the IP and Domain Restrictions feature is not installed). Tune maxConcurrentRequests to your traffic. PowerShell 5.1 with the WebAdministration module; run elevated. CIS marks this recommendation Manual; the automated check implements its audit procedure.

How it is checked

Audit method: Shell command

shell

Import-Module WebAdministration -ErrorAction Stop; $c = Get-WebConfiguration -Filter 'system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests' -PSPath 'MACHINE/WEBROOT/APPHOST' -ErrorAction Stop; if ($c.enabled -eq $true) { 'compliant' } else { 'noncompliant' }

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests -Name enabled -Value True; set maxConcurrentRequests as appropriate

Properties

Operating systems: Any
Tags: iisdos
Reference: CIS Microsoft IIS 10 Benchmark v1.2.1 - 4.11 Ensure 'Dynamic IP Address Restrictions' is enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target iis