Ensure Default IIS web log location is moved

SrednjaNivo 1Automatskaiis

Opis

IIS will log relatively detailed information on every request. These logs are usually the first item looked at in a security response and can be the most valuable. Malicious users are aware of this and will often try to remove evidence of their activities. It is recommended that the default location for IIS log files be changed to a restricted, non-system drive. The siteDefaults logFile directory and every site log directory must not be on the system drive (default %SystemDrive%\inetpub\logs\LogFiles). PowerShell 5.1 with the WebAdministration module; run elevated.

Kako se proverava

Metod provere: Komanda ljuske

shell

Import-Module WebAdministration -ErrorAction Stop; $sd = $env:SystemDrive; $dirs = @((Get-WebConfiguration -Filter 'system.applicationHost/sites/siteDefaults/logFile' -PSPath 'MACHINE/WEBROOT/APPHOST').directory) + @(Get-Website | ForEach-Object { $_.logFile.directory }); $bad = @($dirs | Where-Object { $_ -and [Environment]::ExpandEnvironmentVariables($_) -like "$sd*" }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.applicationHost/sites/siteDefaults/logFile -Name directory -Value 'D:\IISLogs' (a non-system volume with restricted ACLs)

Svojstva

Operativni sistemi: Bilo koji
Oznake: iislogging
Referenca: CIS Microsoft IIS 10 Benchmark v1.2.1 - 5.1 Ensure Default IIS web log location is moved

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target iis