TMA-IIS-2.4
Ensure 'forms authentication' is set to use cookies
BajaNivel 2Automatizadaiis
Descripción
Forms Authentication can be configured to maintain the site visitor's session identifier in either a URI or cookie. It is recommended that Forms Authentication be set to use cookies. Wherever forms authentication is used, forms cookieless must be UseCookies. Compliant when forms authentication is not used. PowerShell 5.1 with the WebAdministration module; run elevated.
Cómo se verifica
Método de auditoría: Comando de shell
shell
Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { $a = Get-WebConfiguration -Filter 'system.web/authentication' -PSPath $_; $f = Get-WebConfiguration -Filter 'system.web/authentication/forms' -PSPath $_; [string]$a.mode -eq 'Forms' -and ([string]$f.cookieless -ne 'UseCookies') }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST/<site>' -Filter system.web/authentication/forms -Name cookieless -Value UseCookies
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- iisauthentication
- Referencia
- CIS Microsoft IIS 10 Benchmark v1.2.1 - 2.4 Ensure 'forms authentication' is set to use cookies
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target iis --level 2