How to prevent the attack on the IIS server

The IIS server has been used by many people, but we are here to explain some of the small experiences summarized over the years to help you better use the IIS server. Below, we will explain how to prevent a few small points from being attacked.

1. Delete unnecessary virtual directories

After the IIS server is installed, some directories are generated by default under wwwroot, including IISHelp, IISAdmin, IISamples, MSADC, etc. These directories have nothing practical. The role can be removed directly.

2. Removing dangerous IIS server components

Some IIS server components after default installation may pose security threats such as Internet Service Manager (HTML), SMTP Service, and NNTP Service, samples Pages and scripts, you can decide whether to delete them according to your needs.

3. Set permissions for file classification in IIS server

In addition to setting the necessary permissions for the IIS server files in the operating system, set them in IIS Server Manager. Permissions. A good setup strategy is to create directories for different types of files on your Web site and then assign them the appropriate permissions. For example, the static file folder allows reading and rejecting writes, the ASP script folder allows execution, denial of writing and reading, and executable programs such as EXE allow execution and denial of reading and writing.

4. Remove unnecessary application mappings

There are many application mappings in ISS by default. Except for ASP's program mapping, other files are rarely used on websites.

In the "Internet Service Manager", right click on the website directory and select "Properties". In the "Home Directory" page of the Website Directory Properties dialog box, click the [Configure] button. , pop-up "Application Configuration" dialog box, in the "Application Mapping" page, delete useless program mapping.

If you need this type of file, you must install the latest system patch, and select the corresponding program map, then click the [Edit] button, in the "Add /Edit Application Extension Mapping" dialog Check the box to check if the file exists & rdquo; option.

When the client requests such a file, the IIS server will first check whether the file exists. After the file exists, it will call the dynamic link library defined in the program map for parsing.