TMA-IIS-2.4
Ensure 'forms authentication' is set to use cookies
DüşükDüzey 2Otomatikiis
Açıklama
Forms Authentication can be configured to maintain the site visitor's session identifier in either a URI or cookie. It is recommended that Forms Authentication be set to use cookies. Wherever forms authentication is used, forms cookieless must be UseCookies. Compliant when forms authentication is not used. PowerShell 5.1 with the WebAdministration module; run elevated.
Nasıl denetlenir
Denetim yöntemi: Kabuk komutu
shell
Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { $a = Get-WebConfiguration -Filter 'system.web/authentication' -PSPath $_; $f = Get-WebConfiguration -Filter 'system.web/authentication/forms' -PSPath $_; [string]$a.mode -eq 'Forms' -and ([string]$f.cookieless -ne 'UseCookies') }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }- Beklenen çıktı
compliant
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST/<site>' -Filter system.web/authentication/forms -Name cookieless -Value UseCookies
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- iisauthentication
- Referans
- CIS Microsoft IIS 10 Benchmark v1.2.1 - 2.4 Ensure 'forms authentication' is set to use cookies
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
shell
tmaegis scan --target iis --level 2