IIS Security - Week 15, 2006

IUSR Account Question

Michael Kujawa - 14 Apr 2006 11:24 PM - 6 messages

Can I have more than one IUSR_ account per site If the main site has the default account can I specify a different one for a folder in the site and still maintain the default for the rest of the site? ...

log in problem to a link

h gregorian - 14 Apr 2006 7:11 PM - 2 messages

Our apps developers created a website with a link for comments. When users click on the link to enter comments it asks them to enter username, password and domain name. I checked the settings for this page and the windows ...

Radius with IAS

randy.ling - 14 Apr 2006 2:46 AM - 2 messages

Dear Sir, Can anyone help me on this topic. 1. How secure is Internet Authentication Service (IAS) that support Remote Authentication Dial-In User Service(RADIUS)? 2. Advantage & disadvantage of IAS&RADIUS compare with DMZ? I really appreaciate your help and time ...

Certificate By Multiple names

mackdaddy315 - 13 Apr 2006 4:31 PM - 2 messages

I have a certifcate set on my one of my servers set as issued to something like myserver.local which works fine. But when I goto the site by another name it is known by (ie othername.local ) I get the ...

ftp users

Bad Beagle - 13 Apr 2006 3:13 PM - 3 messages

I have a windows 2003 stand alone iis server that has a ftp server running. I have 2 virtual directories that are on other servers. I am trying to setup an ftp user so that they can access these virtual directories. What ...

FTP Admin Attack

kpg - 13 Apr 2006 2:05 PM - 4 messages

Hi, I'm hosting an Anonymous FTP server (read only) on IIS 5.0 I often get attacks lasting about 20 minutes of a user attempting to login as Administrator. I have a strong Administrator password so it always fails, but at first, ...

IIS 6.0 SSL problem

Joshua Bright - 13 Apr 2006 1:08 PM - 5 messages

Environment: Windows 2003 SP1 Exchange 2003 SP2 Problem: I'm trying to install a SSL certificate for OWA (default site). I've used SelfSSL out of the IIS Resource Kit. I installed the certificate through the CLI, and went to edit the options under the Directory Security Tab in the ...

ftp brute force.

Henok Girma - 12 Apr 2006 12:41 PM - 2 messages

Is there a way to stop a brute force attack on IIS 5.0, my log file shows a lot of attempts to login as Admin on my FTP site.. ...

How to provide IIS to Developers

SwatSoftwareDev - 12 Apr 2006 5:29 AM - 2 messages

Hi all, I am managing local network of about 10 systems. All the system are used by ..Net Developers. They all require IIS for developing & testing web applications. What I hav to do is to give them administrator permissions. ...

PORT 80 ALWAYS IS CLOSED.

marmenboy - 11 Apr 2006 8:09 PM - 2 messages

Hello everyone, How are you? Strangely I have the problem with closed port 80,,. I read many problems about opened port 80 but not like mine port 80 always i9s closed. My web server with Win 2003 enterprise worked fine for more than 2 years and ...

Question: Security concerns enabling iisadmpwd for PWD change?

Bluehades - 11 Apr 2006 3:47 PM - 2 messages

Hello's We are in the process of evaluating whether to enable password change via IIS on our Intranet site which is accessible to the outside world after presenting valid Domain credentials. What security concerns should i be aware of by turning on the Enable ...

SSL redirects to other SSL

Ben - 11 Apr 2006 9:51 AM - 6 messages

Hi, I have a server having the HTTPS or SSL but I like to redirect it to other SSL/HTTPS in other serverS. is there a way to do it in IIS in windows 2000 server? regards, IIS help ...

IIS using old SSL Certificate

James - 10 Apr 2006 8:36 PM - 2 messages

We have requested and installed a new public certificate for this server however when a page is requested the old certificate is offered. This gives a warning pop-up that the certificate has expired. According to the IIS ...

IUSR problem

Linda - 10 Apr 2006 7:41 PM - 5 messages

We are using a Win 2003 server, running IIS 6.0. We have company blogs on this server, using Moveable Type. We are trying to restrict access to some of our Blogs by password-protecting them at the server level. ...

disabling ssl v2.0

mike - 10 Apr 2006 7:30 PM - 2 messages

I have implemented MS Article ID 187498 to do this. However, when we run open ssl against our win2003 IIS server to check that the change is made it detects 2.0 as still enabled. Has any one had this issue? IS there another ...

Self signed standalone CA gives: "Windows does not have enough information to verify this certificat

Lars Bonnesen - 10 Apr 2006 3:10 PM - 4 messages

I have set up a website with SSL on machine "A" and requested a certificate - Installed Stand alone CA on machine "B" and invoked the certifikate on this and imorted that to machina "A". It works, but clients cannot accept the certificate. They get a "Windows ...

One-way trust, Kerberos & IIS

Jim - 10 Apr 2006 8:49 AM - 4 messages

Hi, I have the following configuration Two Active Directory Domains in two separate forests. Domain A Windows 2000 Domain B Windows 2003 I have a one-way trust between them such that B trusts A I have a web application running on a Windows Server 2003 installation using ...

server security testing apps

tomrue - 9 Apr 2006 5:07 PM - 2 messages

Can anyone recommend any programs (freeware preferred, but not necessarily) for testing one's own server for security holes - particularly with respect to permissions, but also more generally? Thanks. ...