Detections
Analytics

2.1 Ensure 'global authorization rule' is set to restrict access

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

IIS introduced URL Authorization, which allows the addition of Authorization rules to the actual URL, instead of the underlying file system resource, as a way to protect it. Authorization rules can be configured at the server, web site, folder (including Virtual Directories), or file level. The native URL Authorization module applies to all requests, whether they are .NET managed or other types of files (e.g. static files or ASP files). It is recommended that URL Authorization be configured to only grant access to the necessary security principals.
Rationale:
Configuring a global Authorization rule that restricts access will ensure inheritance of the settings down through the hierarchy of web directories; if that content is copied elsewhere, the authorization rules flow with it. This will ensure access to current and future content is only granted to the appropriate principals, mitigating risk of accidental or unauthorized access.

Solution

To configure URL Authorization at the server level using command line utilities:
Enter the following command in AppCmd.exe to configure:
%systemroot%\system32\inetsrv\appcmd set config -section:system.webServer/security/authorization /-'[users='*',roles='',verbs='']'
%systemroot%\system32\inetsrv\appcmd set config -section:system.webServer/security/authorization /+'[accessType='Allow',roles='Administrators']'
OR
Enter the following command in PowerShell to configure:
Remove-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter 'system.webServer/security/authorization' -name '.' -AtElement @{users='*';roles='';verbs=''}
Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter 'system.webServer/security/authorization' -name '.' -value @{accessType='Allow';roles='Administrators'}
OR
To configure URL Authorization at the server level using IIS Manager:
1. Connect to Internet Information Services (IIS Manager)
2. Select the server
3. Select Authorization Rules
4. Remove the 'Allow All Users' rule
5. Click Add Allow Rule...
6. Allow access to the user(s), user groups, or roles that are authorized across all of the web sites and applications (e.g. the Administrators group)
Default Value:
The default server-level setting is to allow all users access.

See Also

https://workbench.cisecurity.org/files/2297

Item Details

References: CSCv7|18

Plugin: Windows

Control ID: af0d7c58d0f4b1a5c490abfc5a3dbc5a8a36465069e47d055d94e5c3b1581aa9