TMA-IIS-7.1

Ensure HSTS Header is set

FaibleNiveau 2Automatiséeiis

Description

HTTP Strict Transport Security (HSTS) allows a site to inform the user agent to communicate with the site only over HTTPS. This header takes two parameters: max- age, "specifies the number of seconds, after the reception of the STS header field, during which the user agent regards the host (from whom the message was received) as a Known HSTS Host [speaks only HTTPS]"; and includeSubDomains. A Strict-Transport-Security custom header with max-age greater than 0 (480 or more recommended) must be set at server level or for every site. PowerShell 5.1 with the WebAdministration module; run elevated. CIS marks this recommendation Manual; the automated check implements its audit procedure.

Méthode de vérification

Méthode d'audit: Commande shell

shell

Import-Module WebAdministration -ErrorAction Stop; function Test-Hsts($p) { @(Get-WebConfiguration -Filter 'system.webServer/httpProtocol/customHeaders/add' -PSPath $p | Where-Object { $_.name -eq 'Strict-Transport-Security' -and $_.value -match 'max-age=([0-9]+)' -and [long]$Matches[1] -gt 0 }).Count -gt 0 }; if (Test-Hsts 'MACHINE/WEBROOT/APPHOST') { 'compliant' } else { $bad = @(Get-Website | Where-Object { -not (Test-Hsts "IIS:\Sites\$($_.Name)") }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' } }

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Add-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/httpProtocol/customHeaders -Name . -Value @{name='Strict-Transport-Security';value='max-age=480; includeSubDomains; preload'}

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: iistlsheaders
Référence: CIS Microsoft IIS 10 Benchmark v1.2.1 - 7.1 Ensure HSTS Header is set

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target iis --level 2