TMA-IIS-3.2

Ensure 'debug' is turned off

낮음레벨 2자동iis

설명

Developers often enable the debug mode during active ASP.NET development so that they do not have to continually clear their browsers cache every time they make a change to a resource handler. The problem would arise from this being left "on" or set to "true". Compilation debug output is displayed to the end user, allowing malicious persons to obtain detailed information about applications. compilation debug must be false in the root web.config and every site. PowerShell 5.1 with the WebAdministration module; run elevated.

점검 방법

감사 방식: 셸 명령

shell

Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { $c = Get-WebConfiguration -Filter 'system.web/compilation' -PSPath $_; $c.debug -ne $false }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST/<site>' -Filter system.web/compilation -Name debug -Value False

속성

운영 체제: 모두
태그: iisaspnet
참고 자료: CIS Microsoft IIS 10 Benchmark v1.2.1 - 3.2 Ensure 'debug' is turned off

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target iis --level 2