Re: IIS log entries

From: Karl Levinson [x y] mvp (levinson_k@excite.com)
Date: 11/26/02 

From: "Karl Levinson [x y] mvp" <levinson_k@excite.com>
Date: Tue, 26 Nov 2002 17:12:20 -0500

"Sam Critchley" <Sam.Critchley@dial.pipex.nospam.com> wrote in message
news:3de3d9d5$0$806$4d4ebb8e@news.nl.uu.net...
>
> Hi,
>
> Probably an obvious and basic question, but I've got IIS running on W2K
> server, SP3. I've got the log entries below showing up (see below) -
> seems like my machine is being probed (it's coming from various IP
> addresses over the last few days since I brought up IIS and opened port
> 80 inbound on my router).
>
> I have a couple of questions:
>
> 1. Do these logs show anything serious happening or is it just someone
> checking out the server for vulnerabilities?

I agree with the other post... looks like just worms and/or script kiddies.
However, if your web server isn't completely secured and ready for prime
time [and I suspect it isn't], close that port now. Also, just because
these logs show you weren't hacked doesn't mean you weren't previously
hacked elsewhere.

> 2. If it is something serious, how do I fix it without stopping the
service?

If it's something serious, your machine has already been hacked. When this
happens, you may want to seriously consider formatting and reinstalling
windows and everything else, after doing forensic investigation to determine
how it was hacked and what data or other systems were compromised.

> 3. I'm running certificate services so users can download certificates
> using their browsers? Does this require script execution? If not, can I
> turn off script permissions on the web server?

I doubt it has to do with script execution. Execute permissions should be
removed from all folders not containing executable script, by following the
securing IIS checklists from Microsoft which can be found at:

http://securityadmin.info/faq.htm#11.12
http://securityadmin.info/faq.htm#harden

[and while you're there, follow the other recommendations in that list to
secure your server]

> 4. Can anyone point me to a site which gives a thorough explanation of
> IIS log entries?

I haven't found a good comprehensive site, but here's a start:

http://securityadmin.info/faq.htm#iislogs2
http://securityadmin.info/faq.htm#iislogs
www.iisfaq.com [answers to lots of your IIS questions]
www.google.com
www.google.com/advanced_group_search

> 2002-11-26 01:37:49 62.212.107.69 - AAA.BBB.CCC.DDD 80 HEAD
> /iisstart.asp - 200 -

This shows me that your iisstart.asp file is still on your server,
advertising to the world that you're running an unsecured Windows / IIS
server. This can increase the number of scans run on your system. I'm also
guessing you haven't also deleted the other vulnerable sample scripts that
come with IIS. More info in the securing checklists at the URL listed
above. If you don't have it yet, you also need IISlockdown which includes
URLScan, which blocks most of these scans.

Above all, note that security is not just patches... it's other things,
including proper configuration, and file permissions, and third party tools
to add additional security features. For example, check out the File
Integrity Checker which is free from www.gfi.com

For more information about HTTP error / status codes:

http://www.bigblock.com/support/wri_http.htm

Relevant Pages

  • Re: IIS Hosting Webservice which accesses a COM server
    ... I've create a COM server in VFP which I try to access from a Webservice ... If you want to run executables on IIS from a script (i.e. an ASP, ASP.Net, ... well as Web Service Extension for the appropriate Script Engine. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Questions about W2K and IIS Server Security
    ... A side effect of "Windows File Protection" which watches over Windows files ... note that deleting iishelp is physically removing all IIS help ... when setting up this server. ... I have followed many guides to securing this server such as "From ...
    (microsoft.public.inetserver.iis)
  • Re: Bug in .NET Framework compiling C# scripts?
    ... worked fine when copied to the server and then accessed from my ... most likely in IIS 5.1 because it uses .NET Framework 1.1 instead ... But I concede that you are right about ending the script with: ... Juan T. Llibre, asp.net MVP ...
    (microsoft.public.dotnet.framework.aspnet)
  • IIS & ASP security advice
    ... I have a user who has requested special permissions on my IIS 5.0 server. ... that they do but IIS does not allow this to happen unless an ASP script is ...
    (microsoft.public.inetserver.iis.security)
  • Re: Validation Summary
    ... the default Web properties to use Visual Studio Development Server to run the ... IIS server configuration, which seems to be the case since it doesn't work ... url embeded in the <script> tag. ...
    (microsoft.public.dotnet.framework.aspnet)