Ensure Default IIS web log location is moved

СредњаНиво 1Аутоматскаiis

Опис

IIS will log relatively detailed information on every request. These logs are usually the first item looked at in a security response and can be the most valuable. Malicious users are aware of this and will often try to remove evidence of their activities. It is recommended that the default location for IIS log files be changed to a restricted, non-system drive. The siteDefaults logFile directory and every site log directory must not be on the system drive (default %SystemDrive%\inetpub\logs\LogFiles). PowerShell 5.1 with the WebAdministration module; run elevated.

Како се проверава

Метод провере: Команда љуске

shell

Import-Module WebAdministration -ErrorAction Stop; $sd = $env:SystemDrive; $dirs = @((Get-WebConfiguration -Filter 'system.applicationHost/sites/siteDefaults/logFile' -PSPath 'MACHINE/WEBROOT/APPHOST').directory) + @(Get-Website | ForEach-Object { $_.logFile.directory }); $bad = @($dirs | Where-Object { $_ -and [Environment]::ExpandEnvironmentVariables($_) -like "$sd*" }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.applicationHost/sites/siteDefaults/logFile -Name directory -Value 'D:\IISLogs' (a non-system volume with restricted ACLs)

Својства

Оперативни системи: Било који
Ознаке: iislogging
Референца: CIS Microsoft IIS 10 Benchmark v1.2.1 - 5.1 Ensure Default IIS web log location is moved

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target iis