Securing IIS 5

Basic Security Checklist

• Do (at least) Microsofts baseline security checklist for Windows which can be found here: Windows Security. This includes
  • disabling the guest account
  • use strong passwords
  • rename the administrator account
  • set account lockout
  • enable logging of failed and successful logon attempts
  • Install latest patches and updates

Advanced Security Checklist

• Disable Socket pooling: IIS 5 - IIS 6

Other Security Checklists

• Microsoft - IIS 5.0 Baseline Security Checklist
• Microsoft - Secure Internet Information Services 5 Checklist
• Microsoft - Internet Information Server 4 Baseline Security Checklist
• Microsoft - Internet Information Server 4.0 Security Checklist

Web sites about IIS

• IIS Administrator
• IIS FAQ

Microsoft IIS Security Tools

• AQTRONIX WebKnight (application firewall for securing the HTTP service)
• AQTRONIX MailKnight (application firewall for securing the SMTP service)
• URLScan Security Tool
• IIS Lockdown Tool
• Windows 2000 IIS 5.0 Hotfix Checking Tool
• Windows 2000 IIS Configuration Tool for IIS5

Other tools

• Log Parser 2.0
• Log Parser 2.1 (for IIS 6.0)