TMA-IIS-4.11

Ensure 'Dynamic IP Address Restrictions' is enabled

中レベル 1自動iis

説明

Dynamic IP address filtering allows administrators to configure the server to block access for IPs that exceed the specified number of requests or request frequency. Note: Ensure that you receive the Forbidden page once the block has been enforced. Dynamic IP Address Restrictions denyByConcurrentRequests must be enabled at server level (fails when the IP and Domain Restrictions feature is not installed). Tune maxConcurrentRequests to your traffic. PowerShell 5.1 with the WebAdministration module; run elevated. CIS marks this recommendation Manual; the automated check implements its audit procedure.

チェック方法

監査方法: シェルコマンド

shell

Import-Module WebAdministration -ErrorAction Stop; $c = Get-WebConfiguration -Filter 'system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests' -PSPath 'MACHINE/WEBROOT/APPHOST' -ErrorAction Stop; if ($c.enabled -eq $true) { 'compliant' } else { 'noncompliant' }

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests -Name enabled -Value True; set maxConcurrentRequests as appropriate

プロパティ

オペレーティングシステム: すべて
タグ: iisdos
参照: CIS Microsoft IIS 10 Benchmark v1.2.1 - 4.11 Ensure 'Dynamic IP Address Restrictions' is enabled

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target iis