TMA-IIS-2.8

Ensure 'credentials' are not stored in configuration files

FaibleNiveau 2Automatiséeiis

Description

The <credentials> element of the <authentication> element allows optional definitions of name and password for IIS Manager User accounts within the configuration file. Forms based authentication also uses these elements to define the users. IIS Manager Users can use the administration interface to connect to sites and applications in which they've been granted authorization. Note ... No forms credentials <user> entries may be stored in the root web.config or any site configuration. PowerShell 5.1 with the WebAdministration module; run elevated.

Méthode de vérification

Méthode d'audit: Commande shell

shell

Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { @(Get-WebConfiguration -Filter 'system.web/authentication/forms/credentials/user' -PSPath $_).Count -gt 0 }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Remove-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST/<site>' -Filter system.web/authentication/forms/credentials -Name '.'

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: iisauthentication
Référence: CIS Microsoft IIS 10 Benchmark v1.2.1 - 2.8 Ensure 'credentials' are not stored in configuration files

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target iis --level 2