Ensure IIS HTTP detailed errors are hidden from displaying remotely

SrednjaNivo 1Automatskaiis

Opis

A Web site's error pages are often set to show detailed error information for troubleshooting purposes during testing or initial deployment. To prevent unauthorized users from viewing this privileged information, detailed error pages must not be seen by remote users. This setting can be modified in the errorMode attribute setting for a Web site's error pages. httpErrors errorMode must be DetailedLocalOnly or Custom at server level and for every site. PowerShell 5.1 with the WebAdministration module; run elevated.

Kako se proverava

Metod provere: Komanda ljuske

shell

Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT/APPHOST') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { $c = Get-WebConfiguration -Filter 'system.webServer/httpErrors' -PSPath $_; [string]$c.errorMode -notin @('DetailedLocalOnly', 'Custom') }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/httpErrors -Name errorMode -Value DetailedLocalOnly

Svojstva

Operativni sistemi: Bilo koji
Oznake: iisinformation-disclosure
Referenca: CIS Microsoft IIS 10 Benchmark v1.2.1 - 3.4 Ensure IIS HTTP detailed errors are hidden from displaying remotely

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target iis