Microsoft IIS
TMA-IIS-4.11
Ensure 'Dynamic IP Address Restrictions' is enabled
Descrição
Dynamic IP address filtering allows administrators to configure the server to block access for IPs that exceed the specified number of requests or request frequency. Note: Ensure that you receive the Forbidden page once the block has been enforced. Dynamic IP Address Restrictions denyByConcurrentRequests must be enabled at server level (fails when the IP and Domain Restrictions feature is not installed). Tune maxConcurrentRequests to your traffic. PowerShell 5.1 with the WebAdministration module; run elevated. CIS marks this recommendation Manual; the automated check implements its audit procedure.
Como é verificado
Método de auditoria: Comando shell
Import-Module WebAdministration -ErrorAction Stop; $c = Get-WebConfiguration -Filter 'system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests' -PSPath 'MACHINE/WEBROOT/APPHOST' -ErrorAction Stop; if ($c.enabled -eq $true) { 'compliant' } else { 'noncompliant' }- Saída esperada
compliant
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests -Name enabled -Value True; set maxConcurrentRequests as appropriate
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- iisdos
- Referência
- CIS Microsoft IIS 10 Benchmark v1.2.1 - 4.11 Ensure 'Dynamic IP Address Restrictions' is enabled
Verificar este host
Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.
tmaegis scan --target iis