Ensure IIS HTTP detailed errors are hidden from displaying remotely

OrtaDüzey 1Otomatikiis

Açıklama

A Web site's error pages are often set to show detailed error information for troubleshooting purposes during testing or initial deployment. To prevent unauthorized users from viewing this privileged information, detailed error pages must not be seen by remote users. This setting can be modified in the errorMode attribute setting for a Web site's error pages. httpErrors errorMode must be DetailedLocalOnly or Custom at server level and for every site. PowerShell 5.1 with the WebAdministration module; run elevated.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT/APPHOST') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { $c = Get-WebConfiguration -Filter 'system.webServer/httpErrors' -PSPath $_; [string]$c.errorMode -notin @('DetailedLocalOnly', 'Custom') }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/httpErrors -Name errorMode -Value DetailedLocalOnly

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: iisinformation-disclosure
Referans: CIS Microsoft IIS 10 Benchmark v1.2.1 - 3.4 Ensure IIS HTTP detailed errors are hidden from displaying remotely

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target iis