NormalizeUrlBeforeScan = 0 - Impact in SSL environment -- iis security

Richard
12/4/2004 1:19:02 PM

Thanks Mike.

I have looked at all forums and MS articles articles before I posted this
msg about 'if its safe to turn off normalization in SSL environments'.

There is no way I can turn off "+" in 'denyurlsequences' without Turning off
normalizebeforeurlscan. its because urlscan looks at 'denyurlsequences' AFTER
it normalizes. So i want some input to see if I can turn off normalization
particularly in SSL environments where its comparatively safer and no
attacker logins without SSL authentication.

The article you mentioned has only 'allowverbs' section of urlscan.ini for
exchange owa.

I tried all the templates that has 'denyurlsequences' looks like:
[DenyUrlSequences]
... ; Do not permit directory traversals.
../ ; Do not permit trailing dot on a directory name.
\ ; Do not permit backslashes in URL.
% ; Do not permit escaping after normalization.
& ; Do not permit multiple Common Gateway Interface processes to run on a
single request.

BUT believe this doesNOT help me ALLOW "+" characters so long normalization
turned off.

It seems there is no solution to unblock + character. :-(

[quoted text, click to view]

Miha Pihler
12/4/2004 9:14:46 PM

Hi Richard,

Microsoft has few articles on applying URLScan to Exchange server that
should help you out.

Fine-tuning and known issues when you use the Urlscan utility in an Exchange
2003 environment
http://support.microsoft.com/default.aspx?scid=kb;en-us;823175 (this article
includes sample of URLScan.ini file that works with OWA)

The URLScan tool may cause problems in Outlook Web Access
http://support.microsoft.com/kb/325965

I hope this helps,

Mike

[quoted text, click to view]

Miha Pihler
12/5/2004 8:50:43 AM

Microsoft is quite specific when it comes to + sign:

**************************************
; NOTE: Customers with Exchange 2003 running on Windows Server 2003 with
URLScan installed may need to modify the "VerifyNormalization=1"
; option in this template to be "VerifyNormalization=0" if they encounter a
"404" error when attempting to open messages or items that contain
; the "+" symbol in the subject or name.
**************************************

Mike

[quoted text, click to view]

Richard
12/5/2004 2:31:04 PM

Mike,

I appreciate you narrowing down to exactly what I need.
I didnt' quite understand though what Microsoft is quite specific on, when
it comes to + (do you have any article)?

Also I need the webpage or MS article number where you took "NOTE" excerpts
from, to show my managers to get approval to put "VerifyNormalization" as 0

Thank again for your help!

[quoted text, click to view]

Miha Pihler
12/5/2004 11:44:42 PM

http://support.microsoft.com/default.aspx?scid=kb;en-us;823175

Mike

[quoted text, click to view]

Wade A. Hilmo [MS]
12/6/2004 8:30:55 AM

Hi Mike and Richard,

I'd just like to add one thing here and point out that you should not ever
set NormalizeUrlBeforeScan=0 on a production web server.

To see the reason why, you can see my post from April 29, 2003 at 10:47am
from the following post. Note that Google is currently making some changes
to their usenet archives, so you may need to search through the page to find
the specific post that I made.

http://groups-beta.google.com/group/microsoft.public.inetserver.iis.security/browse_thread/thread/65c5ba04090210b4/80dcec944fcc2c0c?q=hilmo+verifynormalization&_done=%2Fgroups%3Fq%3Dhilmo+verifynormalization%26hl%3Den%26btnG%3DGoogle+Search%26&_doneTitle=Back+to+Search&&d#80dcec944fcc2c0c

Thank you,
-Wade A. Hilmo,
-Microsoft

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about iis security

iis security : NormalizeUrlBeforeScan = 0 - Impact in SSL environment