Adobe 38043740 Lockdown Guide - Page 17

Anonymous Access Identity, 2.2.8 Setup Request Filtering

Get Adobe 38043740 - ColdFusion Standard - Mac PDF manuals and user guides
UPC - 883919135168
View all Adobe 38043740 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 17 highlights

Remove any Application Pools that are defined and not in use, such as the DefaultAppPool 2.2.7 Anonymous Access Identity By default IIS7 is setup to use the built-in Windows user account called IUSR for anonymous request authentication. This means that when a request is made to your web site without authenticating with the web server will use IUSR for the NTFS file permissions. The IUSR account is setup to be a low privilege account, but there may be cases where you want to change this to another account, for example if you want to isolate between multiple web sites or applications. The IUSR account is inherently a member of the Users group which may allow for additional unnecessary access to files. 2.2.8 Setup Request Filtering Make sure that you have the Request Filtering Role Service for IIS installed. Under the IIS root (applicable for all web sites) click on Request Filtering. Select the URL tab and click Deny Sequence. When a string is added to the Deny Sequence if it is matched in the url IIS will return a 404 Not Found response, and the request will not reach the ColdFusion server. 17

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
17
Remove any Application Pools that are defined and not in use, such as the
DefaultAppPool
2.2.7 Anonymous Access Identity
By default IIS7 is setup to use the built-in Windows user account called
IUSR
for anonymous request
authentication. This means that when a request is made to your web site without authenticating with the web
server will use IUSR for the NTFS file permissions.
The IUSR account is setup to be a low privilege account, but there may be cases where you want to change
this to another account, for example if you want to isolate between multiple web sites or applications. The
IUSR account is inherently a member of the Users group which may allow for additional unnecessary access to
files.
2.2.8 Setup Request Filtering
Make sure that you have the Request Filtering Role Service for IIS installed. Under the IIS root (applicable for
all web sites) click on Request Filtering. Select the URL tab and click Deny Sequence.
When a string is added to the Deny Sequence if it is matched in the url IIS will return a 404 Not Found
response, and the request will not reach the ColdFusion server.