Ensure 'application pool identity' is configured for all application pools

高レベル 1自動iis

説明

Application Pool Identities are the actual users/authorities that will run the worker process - w3wp.exe. Assigning the correct user authority will help ensure that applications can function properly, while not giving overly permissive permissions on the system. These identities can further be used in ACLs to protect system content. It is recommended that each Application Pool run under a unique identity. Every application pool and the applicationPoolDefaults must use identityType ApplicationPoolIdentity. PowerShell 5.1 with the WebAdministration module; run elevated.

チェック方法

監査方法: シェルコマンド

shell

Import-Module WebAdministration -ErrorAction Stop; $bad = @(Get-ChildItem IIS:\AppPools | Where-Object { $_.processModel.identityType -ne 'ApplicationPoolIdentity' }) + @((Get-WebConfiguration -Filter 'system.applicationHost/applicationPools/applicationPoolDefaults/processModel' -PSPath 'MACHINE/WEBROOT/APPHOST') | Where-Object { $_.identityType -ne 'ApplicationPoolIdentity' }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Set-ItemProperty IIS:\AppPools\<pool> -Name processModel.identityType -Value ApplicationPoolIdentity (and set applicationPoolDefaults the same way).

プロパティ

オペレーティングシステム: すべて
タグ: iisaccounts
参照: CIS Microsoft IIS 10 Benchmark v1.2.1 - 1.4 Ensure 'application pool identity' is configured for all application pools

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target iis