Ensure that the underlying Internet Information Services (IIS) Authentication module is set to use Kerberos as its Authentication Provider

MediaNivel 1Revisión manualsharepoint

Descripción

The Kerberos protocol is a more secure protocol than NTLM and is based on ticketing. In this scheme, a user provides a valid user name and password to an authentication server. Then, the authentication server grants the user a ticket. The ticket can be used on the network to request network resources. Manual review.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

For each SharePoint IIS site check the NTAuthenticationProviders / Windows Authentication providers (IIS Manager > Authentication > Windows Authentication > Providers, or appcmd/adsutil on legacy IIS). Verify Negotiate is listed (Negotiate,NTLM) so Kerberos is used; NTLM only (the default) is non-compliant.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set the Windows Authentication providers of each SharePoint site to Negotiate,NTLM (IIS Manager > Authentication > Windows Authentication > Providers, or adsutil set w3svc/<id>/root/NTAuthenticationProviders Negotiate,NTLM) and register the required SPNs.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: sharepointauthentication
Referencia: CIS Microsoft SharePoint 2019 Benchmark v1.0.0 - 1.4 Ensure that the underlying Internet Information Services (IIS) Authentication module is set to use Kerberos as its Authentication Provider