Ensure 'global authorization rule' is set to restrict access

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Verify an authorization rule specifying no access to all users except the Administrators group: To verify using AppCmd.exe enter the following command: %systemroot%\system32\inetsrv\appcmd list config - section:system.webserver/security/authorization OR To verify using PowerShell enter the following command: Get-WebConfiguration -pspath 'IIS:\' -filter 'system.webServer/security/authorization' OR At the web site or application level, verify that the authorization rule configured has been applied: 1. Connect to Internet Information Services (IIS Manager) 2.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

To configure URL Authorization at the server level using command line utilities: Enter the following command in AppCmd.exe to configure: %systemroot%\system32\inetsrv\appcmd set config - section:system.webServer/security/authorization /- "[users='*',roles='',verbs='']" %systemroot%\system32\inetsrv\appcmd set config - section:system.webServer/security/authorization /+"[accessType='Allow',roles='Administrators']" OR Enter the following command in PowerShell to configure: Remove-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/security/authorization" -name "." -AtElement @{users='*';roles='';verbs=''} Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/security/authorization" -name "." -value @{accessType='Allow';roles='Administrators'} OR To configure URL Authorization at the server level using IIS Manager: 1.