Securing Internet Information Services 5.0

Securing Internet Information Services 5 Checklist
This document lists some recommendations and best practices to secure a server on the Web running Microsoft Windows 2000 and Internet Information Services (IIS) 5. The settings err on the side of security over functionality, and hence it's important that you carefully review the suggestions below and use them to derive your own corporate settings. Source: Microsoft.com (June 29, 2000)

Untangling Web Security: Getting the Most from IIS Security
This article contains detailed explanations of some of the misunderstood security features in Microsoft© Internet Information Server (IIS) 4.0, including client certificate mapping, IP address restrictions, Secure Sockets Layer (SSL) server bindings, and Web permissions. You'll not only find out how these features work, but also how to optimize their configuration. Source: MSDN Workshop

Web Security Audit Tool
Tim Huckaby shows you how to implement a code (available for download) that displays the authentication for every resource with Anonymous access. Source: Windows & .NET Magazine (April 11, 2000)

How to use the IIS "What If" Security Tool
Microsoft Knowledge Base Article: 229694 - The purpose of this article is to explain how to install, use, and uninstall the IIS Security "What If" tool. The IIS Security "What If" tool is a Dynamic HTML (DHTML) utility designed to assist in troubleshooting security issues with IIS.

HOW TO: Use the IIS Permissions Wizard 
Microsoft Knowledge Base Article: 324070 - This step-by-step article describes how to use the Permissions Wizard to create or edit a template and then apply the template to a folder. Apache uses .htaccess files and Directory directives in the main Httpd.conf configuration file. You can easily copy these files and directives around your site to set the same values across multiple folders. There is no equivalent in Internet Information Services (IIS). However, the IIS Permissions Wizard in the Windows 2000 Resource Kit can create templates that you can apply these templates to different folders. You can use this method to emulate the .htaccess functionality for multiple folders

HOW TO: Set Default Properties for Internet Information Services in Windows 2000 (Q308193) 
Microsoft Knowledge Base Article You can use the Internet Information Services (IIS) snap-in to configure settings for the WWW and FTP services at the server, individual site, folder, or file levels. When you configure properties at the server level, these values are inherited, and become the default settings for all Web or FTP sites on the server. This article describes how to set the following default properties on an IIS server

HOW TO: Set Secure NTFS Permissions on IIS 5.0 Log Files and Virtual Directories 
Microsoft Knowledge Base Article: 310361 - This step-by-step article describes how to place NTFS permissions on IIS 5.0 log files and virtual directories. Computers that are directly connected to the Internet are under a constant threat of attack. Any computer that is connected to...

HOW TO: Use NTFS Security to Protect a Web Page Running on IIS 4.0 or 5.0
Microsoft Knowledge Base Article: 299970 - This is a step-by-step guide to using Windows NTFS security to protect Web pages that are running on Internet Information Server (IIS) version 4.0 or 5.0. To protect your pages, you put the pages in a separate folder and then apply permissions.

HOW TO: Use the Permissions Wizard in Internet Information Services 
Microsoft Knowledge Base Article: 313083 - This article describes how to use the Permissions Wizard to set up basic Internet Information Services (IIS) 5.0 security for a Web site. 

Internet Information Services 5.0 Authentication Methods
Columnist Zubair Ahmad explains the various authentication methods that IIS 5.0 uses. You must understand these methods before you can configure the software properly. Source: Windows & .NET Magazine (March 27, 2000)

Protecting your IIS Server and Web applications
Internet viruses such as Code Red and Nimbda have brought down numerous IIS Web servers recently. Fortify and defend your system with this comprehensive strategy authored by 30-year industry veteran, Andrew Novick.

Security Vulnerabilities in Site Server and Index Server
In this issue of Keeping Up with IIS, learn about security vulnerabilities in Microsoft Site Server and Index Server and patches to fix them. Also, find out how to access Windows 2000 Help files online. Source: Windows & .NET Magazine  (Feb 2000)

Using Windows Security with IIS and SQL Server 2000
Discover how you can configure a Web application that accesses SQL Server 2000 to use a Windows username and password for authentication. Source: Windows & .NET Magazine (Nov 2001)