CYA Securing IIS 6. 0

by Peiris; Schaefer; Cheah

• ISBN13: 9781931836258
• ISBN10: 1931836256
• Format: Paperback
• Copyright: 2004-06-09
• Publisher: Elsevier Science
• More Book Details
• Purchase Benefits

Summary

Don't lose your job over an ugly and porous Internet Information Server (IIS) 6.0 installation. Read this book and cover your a** today! It contains easy-to-access coverage of just about every documented IIS 6.0 security setting. The following features ensure that you know exactly what you are reading at all times.

Table of Contents

About the Book	xvii
Chapter 1 Introducing IIS 6.0	1	(20)
In this Chapter	1	(1)
IIS 6.0 Enhancements:	2	(8)
Increased Reliability and Availability	2	(1)
Manageability Improvements	3	(2)
Scalability and Performance Improvements	5	(2)
Increased Security	7	(3)
Understanding IIS 6.0 Architecture	10	(9)
Services Provided by IIS 6.9	10	(2)
HTTP.SYS Kernel Mode Driver	12	(1)
Inetinfo.exe Process and the IISAdmin Service	12	(2)
The World Wide Web (WWW) Publishing Service	14	(1)
Application Processing Modes	14	(5)
IIS 6.0 Worker Process Isolation Mode	14	(3)
IIS 5.0 Isolation Mode	17	(2)
Your A** is Covered if You...	19	(2)
Chapter 2 Hardening Windows Server 2003	21	(18)
In this Chapter
Get Secure and Stay Secure	22	(13)
Networking Environment	23	(2)
Patches and Updates	25	(3)
Windows Services	28	(1)
User Accounts and Groups	29	(1)
File System	30	(2)
Auditing and Logging	32	(2)
Staying Secure	34	(1)
Secure IIS Checklist	35	(2)
A Final Word on Security	37	(1)
Knowing the Enemy and What They Want	38	(1)
Your A** is Covered if You...	38	(1)
Chapter 3 Installing Internet Information Services (IIS) 6.0	39	(26)
In this Chapter	39	(1)
Installing IIS 6.0 Using the Configure Your Server Wizard	40	(4)
Installing or Modifying IIS 6.0 Using the Add/Remove Programs Control Panel	44	(5)
Installing IIS 6.0 Using Automated Installation (Unattended Setup)	49	(6)
Installing IIS 6.0 During the Windows 2003 Server Setup	50	(4)
Installing IIS 6.0 After the Windows 2003 Server Setup	54	(1)
Upgrading IIS 5.0 to IIS 6.0	55	(4)
Post-Installation Information	56	(3)
After Installation: Locating the Administrative Tools	59	(5)
IIS Manager	60	(1)
Application Server MMC	61	(1)
The Remote Administration Website	62	(1)
Sharepoint Administration Website	62	(2)
Your A** is Covered if You...	64	(1)
Chapter 4 Configuring Basic Web Server Security	65	(50)
In this Chapter	65	(1)
Enabling and Disabling Web Service Extensions	66	(4)
Configuring Multipurpose Internet Mail Exchange
Types	70	(5)
Configuring IP Address Restrictions	75	(6)
Setting Website Permissions	81	(6)
Securing Web Resources	87	(11)
Enabling and Securing Web Access Log Files	98	(16)
Your A** is Covered if You...	114	(1)
Chapter 5 Advanced Web Server Security Configuration	115	(80)
In this Chapter	115	(1)
Configuring Authentication	116	(19)
The Authentication Process	117	(1)
Configuring Anonymous Authentication	118	(2)
Configuring Basic Authentication	120	(2)
Configuring Digest Authentication	122	(3)
Configuring Advanced Digest Authentication	125	(1)
Configuring Integrated Windows Authentication	126	(5)
Configuring UNC Authentication	131	(1)
Passport Authentication	132	(1)
Configuring SubAuthentication	132	(1)
Configuring Delegation	133	(2)
Configuring IIS User Accounts	135	(7)
IIS 6.0 Running in Worker Process Mode	136	(3)
Changing the Process Identity of a Web Application Pool	138	(1)
Other User Accounts - IUSR_[machinename] 139
IIS 6.0 Running in IIS5 Isolation Mode	139	(3)
IWAM_[computername] Account 141
ASPNET Account	142	(1)
IUSR [machinename] 142
Configuring URLScan	142	(8)
Configuring URLScan.ini	143	(7)
Other Sections	148	(2)
Configuring Your Server to Use SSL	150	(13)
Generating a Certificate Request	153	(3)
Submitting a Certificate Request	156	(2)
Installing an Issued Certificate	158	(2)
Managing your Website Certificates	160	(1)
Configuring IIS SSL Options	161	(2)
Configuring URL Authorization with the Authorization Manager	163	(12)
Creating the Authorization Store	164	(2)
Configuring Access to the Authorization Store	166	(1)
Creating a New Application	166	(1)
Creating an Operation	167	(1)
Creating a Scope	168	(1)
Creating a Role	169	(3)
Configuring IIS 6.0	172	(3)
Testing the Authorization Store	175	(1)
Configuring Custom Error Messages	175	(9)
The Default ASP Error Message	176	(2)
Configuring a Basic ASP Error Message	178	(1)
Configuring a Custom ASP Error Message	179	(3)
Configuring a Custom ASP.NET Error Message	182	(2)
Securing Include Files	184	(3)
Disabling Parent Paths	187	(2)
Configuring IP Address, TCP Port and Host-Header combinations	189	(3)
Your A** is Covered if You...	192	(3)
Chapter 6 Securing Application Pools	195	(16)
In this Chapter	195	(1)
Application Pools	196	(7)
Creating Application Pools	198	(1)
Configuring Application Pools	198	(11)
Configuring Application Pool Identities	200	(3)
Isolating Web Applications	203	(4)
Understanding User Impersonation	207	(2)
Your A** is Covered if You...	209	(2)
Chapter 7 Securing FTP Sites	211	(28)
In this Chapter	211	(1)
Configuring FTP Sites	212	(4)
Relocate the Default FTP Root Path	213	(1)
Configure FTP Messages	214	(2)
Configure the FTP Directory Output Style	216	(1)
Securing FTP Resources	216	(5)
Configuring FTP User Isolation	221	(6)
Do Not Isolate Users	222	(1)
Isolate Users	223	(1)
Isolate Users Using Active Directory	224	(3)
Securing the FTP Connection	227	(5)
Enabling and Securing the FTP Access Log File	232	(6)
Your A** is Covered if You...	238	(1)
Chapter 8 Securing SMTP and POP3 Services	239	(30)
In This Chapter	239	(1)
Configuring SMTP Virtual Servers	240	(12)
Creating Additional SMTP Servers	241	(1)
Configuring Additional Domains	242	(2)
Configuring SMTP Server Folders	244	(2)
Enable Logging	246	(3)
Other Configuration Options	249	(3)
SMTP Virtual Server Security	252	(8)
Configuring Authentication	253	(1)
Configuring Connection Controls	254	(2)
Configuring Transport Layer Security	256	(1)
Configuring Relay Controls	257	(3)
Configuring and Securing the POP3 Server	260	(7)
Initial Configuration	262	(3)
Configuring Mailboxes	265	(2)
Your A** is Covered if You...	267	(2)
Chapter 9 Securing NNTP Virtual Servers	269	(34)
In this Chapter	269	(1)
Configuring NNTP Virtual Servers	270	(9)
Managing NNTP Newsgroups	279	(8)
Securing NNTP Newsgroups	287	(9)
Enabling and Securing NNTP Access Log Files	296	(6)
Your A** is Covered if You...	302	(1)
Chapter 10 Securing Certificate Services	303	(24)
In this Chapter	303	(1)
Understanding Certificate Services	304	(4)
Certificate Authority and its Structure	306	(2)
Configuring Certificate Services	308	(9)
Configuring Your Certificate Authority	308	(9)
Securing Certificate Services Web Enrollment Support	317	(6)
Web Enrollment Virtual Directory Permissions	318	(1)
Authenticating Web Enrollment	319	(1)
Restricting Access to Protect your Web Enrollment	320	(3)
Monitoring Certificate Services Web Enrollment Access	323	(1)
Your A** is Covered if You...	324	(3)
Chapter 11 Securing Web Publishing	327	(20)
In This Chapter	327	(1)
Configuring and Securing WebDAV Publishing	328	(7)
Installing and Enabling WebDAV	328	(2)
Configuring and Securing WebDAV	330	(5)
Configuring and Security FrontPage Server Extensions	335	(12)
Installing FrontPage Server Extensions	336	(2)
Enabling FPSE Authoring	338	(4)
Securing your FPSE Virtual Host	342	(5)
Your A** Is Covered If You...	347	(1)
Chapter 12 Securing Internet Printing	347	(14)
In this Chapter	347	(1)
Configuring Internet Printing	348	(6)
Securing Internet Printing	354	(3)
Monitoring Internet Printing Access	357	(2)
Your A** is Covered if You...	359	(2)
Chapter 13 Monitoring Internet Information Services (IIS) 6.0	361	(24)
In this Chapter	361	(1)
Monitoring Site Activities Logging	362	(5)
Monitoring Event Viewer Logging	367	(6)
Monitoring HTTP API Error Logging	373	(7)
Monitoring URLScan Logging	380	(4)
Your A** is Covered if You...	384	(1)
Index	385