Detections
Analytics

IIST-SV-000200 - The IIS 10.0 websites MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.

Information

Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service (DoS) attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).

Solution

Access the IIS 10.0 IIS Manager.

Click the IIS 10.0 server.

Select 'Configuration Editor' under the 'Management' section.

From the 'Section:' drop-down list at the top of the configuration editor, locate 'system.applicationHost/sites'.

Expand 'siteDefaults'.
Expand 'limits'.

Set the 'maxconnections' parameter to a value greater than zero.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_IIS_10-0_Y26M07_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-10, CAT|II, CCI|CCI-000054, Rule-ID|SV-218826r960735_rule, STIG-ID|IIST-SV-000200, STIG-Legacy|SV-109291, STIG-Legacy|V-100187, Vuln-ID|V-218826

Plugin: Windows

Control ID: 4c444bb14a2ddac3f369dc3e25384373207bb2cc86025d036b86a7b8f3bcb224