Re: security at home running iis

From: Rob Hughes (not@this.com)
Date: 02/26/03


From: "Rob Hughes" <not@this.com>
Date: Wed, 26 Feb 2003 21:47:32 GMT


Follow-up question...

On the directory security tab, the frame for "IP address and domain name
restrictions" is disabled. Do you know why? (I should probably I'm not using
NTFS at this time. I know, I know...)

Thanks again for the tips. I ran the IIS lockdown tool and the MS security
analyzer gives me a passing grade now. (For whatever that's worth!)

"x y, mvp" <levinson_k@despammed.com> wrote in message
news:evbg0Xb3CHA.2332@TK2MSFTNGP10.phx.gbl...
> Check out www.iisfaq.com Basically I would right-click on the web server
> root in the IIS MMC and in the tab for Security, set up an IP address
> restriction so that only permitted IP addresses can view the site. A
> firewall is another good idea to block this [briefly block anyone not
having
> an approved IP address from addressing a packet to TCP port 80 on your web
> server... although a good firewall shoudl be blocking a lot more than that
> anyways].
>
> I would still really consider hardening windows and IIS on your computer
> fully using the URL below. An unhardened windows computer, especially one
> running IIS with the default settings, can be hacked 15 minutes after
being
> put on the internet. There are plenty of posts here from people who
thought
> they didn't need to harden a computer because it was just a test server,
but
> then something really bad happened that sapped all their internet
bandwidth,
> prevented them from being able to log into the computer, etc. etc.
>
> http://securityadmin.info/faq.htm#harden
>
>
> "Rob Hughes" <not@this.com> wrote in message
> news:Kl57a.51890$If5.2638113@twister.southeast.rr.com...
> > Hello, I'm doing some web development at home and I have IIS setup
(Win2K)
> > to test my sites. How can I set up IIS so that I can browse the sites
> > locally but no one can get in from the outside? (I'm on a cable modem.)
> >
> > Thanks.
> >
> >
>
>