TMA-IIS-2.6

Ensure transport layer security for 'basic authentication' is configured

TinggiLevel 1Otomatisiis

Deskripsi

Basic Authentication can pass credentials across the network in clear text. It is therefore imperative that the traffic between client and server be encrypted, especially in cases where the site is publicly accessible and is recommended that TLS be configured and required for any Site or Application using Basic Authentication. For every site with Basic authentication enabled, system.webServer/security/access sslFlags must include Ssl (Require SSL). PowerShell 5.1 with the WebAdministration module; run elevated.

Cara pemeriksaan

Metode audit: Perintah shell

shell

Import-Module WebAdministration -ErrorAction Stop; $bad = @(Get-Website | Where-Object { $b = Get-WebConfiguration -PSPath 'MACHINE/WEBROOT/APPHOST' -Location $_.Name -Filter 'system.webServer/security/authentication/basicAuthentication'; $s = Get-WebConfiguration -PSPath 'MACHINE/WEBROOT/APPHOST' -Location $_.Name -Filter 'system.webServer/security/access'; $b.enabled -eq $true -and [string]$s.sslFlags -notmatch 'Ssl' }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Location '<site>' -Filter system.webServer/security/access -Name sslFlags -Value Ssl

Properti

Sistem operasi: Apa saja
Tag: iisauthentication
Referensi: CIS Microsoft IIS 10 Benchmark v1.2.1 - 2.6 Ensure transport layer security for 'basic authentication' is configured

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target iis