TMA-IIS-2.6

Ensure transport layer security for 'basic authentication' is configured

VisokaNivo 1Automatskaiis

Opis

Basic Authentication can pass credentials across the network in clear text. It is therefore imperative that the traffic between client and server be encrypted, especially in cases where the site is publicly accessible and is recommended that TLS be configured and required for any Site or Application using Basic Authentication. For every site with Basic authentication enabled, system.webServer/security/access sslFlags must include Ssl (Require SSL). PowerShell 5.1 with the WebAdministration module; run elevated.

Kako se proverava

Metod provere: Komanda ljuske

shell

Import-Module WebAdministration -ErrorAction Stop; $bad = @(Get-Website | Where-Object { $b = Get-WebConfiguration -PSPath 'MACHINE/WEBROOT/APPHOST' -Location $_.Name -Filter 'system.webServer/security/authentication/basicAuthentication'; $s = Get-WebConfiguration -PSPath 'MACHINE/WEBROOT/APPHOST' -Location $_.Name -Filter 'system.webServer/security/access'; $b.enabled -eq $true -and [string]$s.sslFlags -notmatch 'Ssl' }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Location '<site>' -Filter system.webServer/security/access -Name sslFlags -Value Ssl

Svojstva

Operativni sistemi: Bilo koji
Oznake: iisauthentication
Referenca: CIS Microsoft IIS 10 Benchmark v1.2.1 - 2.6 Ensure transport layer security for 'basic authentication' is configured

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target iis