E Ravi

Accounts

1.   Unused accounts are removed from the server.
2.   Windows Guest account is disabled.
3.   Administrator account is renamed and has a strong password..
4.   IUSR_MACHINE account is disabled if it is not used by the application.
     If your applications require anonymous access, a custom least-privileged anonymous account is created.
5.   The anonymous account does not have write access to Web content directories and cannot execute command-line tools.
6.   ASP.NET process account is configured for least privilege. (This only applies if you are not using the default ASPNET account, which is a least-privileged account.)
7.   Strong account and password policies are enforced for the server.
     Remote logons are restricted. (The "Access this computer from the network" user-right is removed from the Everyone group.)
8.   Accounts are not shared among administrators.
9.   Null sessions (anonymous logons) are disabled.
10.   Approval is required for account delegation.
11.   Users and administrators do not share accounts.
12.   No more than two accounts exist in the Administrators group.
13.   Administrators are required to log on locally OR the remote administration solution is secure.

Files and Directories

1.   Files and directories are contained on NTFS volumes.
2.   Web site content is located on a non-system NTFS volume.
3.   Log files are located on a non-system NTFS volume and not on the same volume where the Web site content resides.
4.   The Everyone group is restricted (no access to \WINNT\system32 or Web directories).
5.   Web site root directory has deny write ACE for anonymous Internet accounts.
6.  Content directories have deny write ACE for anonymous Internet accounts.
7.   Remote IIS administration application is removed (\WINNT\System32\Inetsrv\IISAdmin).
8.   Resource kit tools, utilities, and SDKs are removed.
9.   Sample applications are removed (\WINNT\Help\IISHelp, \Inetpub\IISSamples).

Shares

1. All unnecessary shares are removed (including default administration shares).
2. Access to required shares is restricted (the Everyone group does not have access).
3. Administrative shares (C$ and Admin$) are removed if they are not required (Microsoft Management Server (SMS) and Microsoft Operations Manager (MOM) require these shares).

Ports

1. Internet-facing interfaces are restricted to port 80 (and 443 if SSL is used).
2.   Intranet traffic is encrypted (for example, with SSL) or restricted if you do not have a secure data center infrastructure.

Registry

1. Remote registry access is restricted.
2. SAM is secured (HKLM\System\CurrentControlSet\Control\LSA\NoLMHash). This applies only to standalone servers.

Auditing and Logging

1. Failed logon attempts are audited.
2. IIS log files are relocated and secured.
3. Log files are configured with an appropriate size depending on the application security requirement.
4. Log files are regularly archived and analyzed.
5. Access to the Metabase.bin file is audited.
6. IIS is configured for W3C Extended log file format auditing.

Sites and Virtual Directories

1. Web sites are located on a non-system partition.
2. "Parent paths" setting is disabled.
3. Potentially dangerous virtual directories, including IISSamples, IISAdmin, IISHelp, and Scripts virtual directories, are removed.
     MSADC virtual directory (RDS) is removed or secured.
     Include directories do not have Read Web permission.
4. Virtual directories that allow anonymous access restrict Write and Execute Web permissions for the anonymous account.
5. There is script source access only on folders that support content authoring.
6. There is write access only on folders that support content authoring and these folder are configured for authentication (and SSL encryption, if required).
7. FrontPage Server Extensions (FPSE) are removed if not used. If they are used, they are updated and access to FPSE is restricted.
   Script Mappings
   Check Description
     Extensions not used by the application are mapped to 404.dll (.idq, .htw, .ida, .shtml, .shtm, .stm, idc, .htr, .printer).
8. Unnecessary ASP.NET file type extensions are mapped to "HttpForbiddenHandler" in Machine.config.

ISAPI Filters

1. Unnecessary or unused ISAPI filters are removed from the server.
   IIS Metabase
   Check Description
2. Access to the metabase is restricted by using NTFS permissions (%systemroot%\system32\inetsrv\metabase.bin).
3. IIS banner information is restricted (IP address in content location disabled).

Server Certificates

1.  Certificate date ranges are valid.
2. Certificates are used for their intended purpose (for example, the server certificate is not used for e-mail).
3. The certificate's public key is valid, all the way to a trusted root authority.
4. The certificate has not been revoked.

Machine.config

1. Protected resources are mapped to HttpForbiddenHandler.
     Unused HttpModules are removed. 
2. Tracing is disabled <trace enable="false"/>
3. Debug compiles are turned off.
    Copy Code <compilation debug="false" explicit="true" defaultLanguage="vb">

Code Access Security

1. Code access security is enabled on the server.
2. All permissions have been removed from the local intranet zone.
3. All permissions have been removed from the Internet zone.
   

Other Check Points

1. IISLockdown tool has been run on the server.
2. HTTP requests are filtered. URLScan is installed and configured.
3. Remote administration of the server is secured and configured for encryption, low session time-outs, and account lockouts.

Dos and Don'ts

1. Do use a dedicated machine as a Web server.
2. Do physically protect the Web server machine in a secure machine room.
3. Do configure a separate anonymous user account for each application, if you host multiple Web applications,
4. Do not install the IIS server on a domain controller.
5. Do not connect an IIS Server to the Internet until it is fully hardened.
6. Do not allow anyone to locally log on to the machine except for the administrator

E.Ravi