Ensure 'maxURL request filter' is configured

低等級 2自動化iis

說明

The maxURL attribute of the <requestLimits> property is the maximum length (in Bytes) in which a requested URL can be (excluding query string) in order for IIS to accept. Configuring this Request Filter enables administrators to restrict the length of the requests that the server will accept. It is recommended that a limit be put on the length of URL. requestLimits maxUrl must be 4096 or lower at server level and for every site (default 4096). PowerShell 5.1 with the WebAdministration module; run elevated.

檢查方式

稽核方法: Shell 指令

shell

Import-Module WebAdministration -ErrorAction Stop; $paths = @('MACHINE/WEBROOT/APPHOST') + @(Get-Website | ForEach-Object { "IIS:\Sites\$($_.Name)" }); $bad = @($paths | Where-Object { $c = Get-WebConfiguration -Filter 'system.webServer/security/requestFiltering/requestLimits' -PSPath $_; [long]$c.maxUrl -gt 4096 }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.webServer/security/requestFiltering/requestLimits -Name maxUrl -Value 4096

屬性

作業系統: 不限
標籤: iisrequest-filtering
參考資料: CIS Microsoft IIS 10 Benchmark v1.2.1 - 4.2 Ensure 'maxURL request filter' is configured

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target iis --level 2