TMA-IIS-2.6

Ensure transport layer security for 'basic authentication' is configured

AltaNivel 1Automatizadaiis

Descripción

Basic Authentication can pass credentials across the network in clear text. It is therefore imperative that the traffic between client and server be encrypted, especially in cases where the site is publicly accessible and is recommended that TLS be configured and required for any Site or Application using Basic Authentication. For every site with Basic authentication enabled, system.webServer/security/access sslFlags must include Ssl (Require SSL). PowerShell 5.1 with the WebAdministration module; run elevated.

Cómo se verifica

Método de auditoría: Comando de shell

shell

Import-Module WebAdministration -ErrorAction Stop; $bad = @(Get-Website | Where-Object { $b = Get-WebConfiguration -PSPath 'MACHINE/WEBROOT/APPHOST' -Location $_.Name -Filter 'system.webServer/security/authentication/basicAuthentication'; $s = Get-WebConfiguration -PSPath 'MACHINE/WEBROOT/APPHOST' -Location $_.Name -Filter 'system.webServer/security/access'; $b.enabled -eq $true -and [string]$s.sslFlags -notmatch 'Ssl' }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Location '<site>' -Filter system.webServer/security/access -Name sslFlags -Value Ssl

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: iisauthentication
Referencia: CIS Microsoft IIS 10 Benchmark v1.2.1 - 2.6 Ensure transport layer security for 'basic authentication' is configured

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target iis