Feeds

MS releases IIS ‘lockdown’ utility

Are they getting serious or something?

  • alert
  • submit to reddit

Security for virtualized datacentres

Microsoft has released its latest security-oriented utility, this time addressing the many vulnerabilities in Internet Information Server (IIS) with its free 'IIS Lockdown Tool'.

The purpose here is not to patch systems like the HFNetChk hotfix checker, but to configure IIS for improved security independent of patching.

The IIS utility will automatically remove script mappings, sample Web files, the scripts virtual directory, and the MSADC virtual directory. It disables active server pages (asp), the index server Web interface (ida), server-side includes, Internet printing, and distributed authoring and versioning (WebDAV). It also sets file permissions to prevent the anonymous user account from writing to Web content directories or executing system utilities.

A point and drool mode chooses all the modifications for the user, and a custom mode lets one choose which to implement. An undo function permits users to undo the most recent configuration. The tool also creates a log file named oblt-log.log to assist in troubleshooting.

There's been a bit of a stir at NTBugtraq because the tool doesn't disable SMTP and FTP services, which would clearly be good for users who may be running them without realizing it, though it's fair to note that the utility claims only to configure IIS for improved security and doesn't claim to be a comprehensive solution to on-line threats.

The tool looks like a promising prototype for some sort of 'Security Wizard' which could be integrated into any number of MS products and updated periodically by the user. We wish the company had been security conscious enough to have offered something along those lines from the beginning of the Windows Epoch, rather than wait until the mounting pressure of weekly vulnerability embarrassments finally became too much to bear.

Still, it's a positive trend, and better late than never we'll allow. ®

Related Story

MS patch-scanner for Win-NT, 2K, IIS, SQL

Providing a secure and efficient Helpdesk

More from The Register

next story
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Mathematica hits the Web
Wolfram embraces the cloud, promies private cloud cut of its number-cruncher
Mozilla shutters Labs, tells nobody it's been dead for five months
Staffer's blog reveals all as projects languish on GitHub
'People have forgotten just how late the first iPhone arrived ...'
Plus: 'Google's IDEALISM is an injudicious justification for inappropriate biz practices'
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
iOS 8 Healthkit gets a bug SO Apple KILLS it. That's real healthcare!
Not fit for purpose on day of launch, says Cupertino
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.