TMA-IIS-7.1

Ensure HSTS Header is set

RendahLevel 2Otomatisiis

Deskripsi

HTTP Strict Transport Security (HSTS) allows a site to inform the user agent to communicate with the site only over HTTPS. This header takes two parameters: max- age, "specifies the number of seconds, after the reception of the STS header field, during which the user agent regards the host (from whom the message was received) as a Known HSTS Host [speaks only HTTPS]"; and includeSubDomains. A Strict-Transport-Security custom header with max-age greater than 0 (480 or more recommended) must be set at server level or for every site. PowerShell 5.1 with the WebAdministration module; run elevated. CIS marks this recommendation Manual; the automated check implements its audit procedure.

Cara pemeriksaan

Metode audit: Perintah shell

shell

Import-Module WebAdministration -ErrorAction Stop; function Test-Hsts($p) { @(Get-WebConfiguration -Filter 'system.webServer/httpProtocol/customHeaders/add' -PSPath $p | Where-Object { $_.name -eq 'Strict-Transport-Security' -and $_.value -match 'max-age=([0-9]+)' -and [long]$Matches[1] -gt 0 }).Count -gt 0 }; if (Test-Hsts 'MACHINE/WEBROOT/APPHOST') { 'compliant' } else { $bad = @(Get-Website | Where-Object { -not (Test-Hsts "IIS:\Sites\$($_.Name)") }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' } }

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Add-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/httpProtocol/customHeaders -Name . -Value @{name='Strict-Transport-Security';value='max-age=480; includeSubDomains; preload'}

Properti

Sistem operasi: Apa saja
Tag: iistlsheaders
Referensi: CIS Microsoft IIS 10 Benchmark v1.2.1 - 7.1 Ensure HSTS Header is set

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target iis --level 2