iis security: Hi there,

A question that probably has been here a thousand times. I'm
running IIS 6.0 and will be using it for development of dynamic content
on Professional 64-bit. I read:
http://www.microsoft.com/technet/security/tools/urlscan.mspx
but am still not sure if I should use it. Basically can anyone tell
me if it will secure my IIS more? The link didn't tell me specifically
what UrlScan has that IIS doesn't already have, except verb
control (which may be a reason to use it anyways).

THANKS

On Thu, 13 Oct 2005 23:28:13 GMT, "Eric George" <t2606178@telus.net>
[quoted text, click to view]

URLSCan is an ISAPI filter, and as such can intercet requests and act
on them. You can accept/deny specific URL sequences, including verbs,
using it. That may or may not be useful to you. Most of the default
URLScan settings are already handled in IIS6, but you can't easily
exclude your own sequences.

For example, IIS6 won't serve unknown MIME types. But if you wanted
files with an extension of .XYZ streamed as Text/HTML you can set up a
MIME type for that. But if you wanted to exclude files named ABC.XYZ
you can't easily do that and still stream the others. URLSCan could
block requests for that URL sequence if you wished.

IIS6 is secure without using URLScan.

If you need the additional features of URLScan, you can install and use it
on IIS6. That is why we gave the side-by-side comparison so that you can
make the informed decision yourself.

There is no native 64bit version of URLScan.

What you have to realize is that:
1. Yes, URLScan has additional features not in IIS6
2. However, some URLScan features are worse than IIS6

So, security is not a simple matter of just installing software to "secure
my IIS more". It is deciding on the right tradeoff between security and
functionality.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Hi there,

A question that probably has been here a thousand times. I'm
running IIS 6.0 and will be using it for development of dynamic content
on Professional 64-bit. I read:
http://www.microsoft.com/technet/security/tools/urlscan.mspx
but am still not sure if I should use it. Basically can anyone tell
me if it will secure my IIS more? The link didn't tell me specifically
what UrlScan has that IIS doesn't already have, except verb
control (which may be a reason to use it anyways).

THANKS