Ensure Default IIS web log location is moved

보통레벨 1자동iis

설명

IIS will log relatively detailed information on every request. These logs are usually the first item looked at in a security response and can be the most valuable. Malicious users are aware of this and will often try to remove evidence of their activities. It is recommended that the default location for IIS log files be changed to a restricted, non-system drive. The siteDefaults logFile directory and every site log directory must not be on the system drive (default %SystemDrive%\inetpub\logs\LogFiles). PowerShell 5.1 with the WebAdministration module; run elevated.

점검 방법

감사 방식: 셸 명령

shell

Import-Module WebAdministration -ErrorAction Stop; $sd = $env:SystemDrive; $dirs = @((Get-WebConfiguration -Filter 'system.applicationHost/sites/siteDefaults/logFile' -PSPath 'MACHINE/WEBROOT/APPHOST').directory) + @(Get-Website | ForEach-Object { $_.logFile.directory }); $bad = @($dirs | Where-Object { $_ -and [Environment]::ExpandEnvironmentVariables($_) -like "$sd*" }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.applicationHost/sites/siteDefaults/logFile -Name directory -Value 'D:\IISLogs' (a non-system volume with restricted ACLs)

속성

운영 체제: 모두
태그: iislogging
참고 자료: CIS Microsoft IIS 10 Benchmark v1.2.1 - 5.1 Ensure Default IIS web log location is moved

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target iis