is IIS 5.0 safe?
David Neff
my home Windows XP Pro machine to do some work from home. I'm concerned
that I'm potentially opening up my home pc to who know what kinds of
attacks. I have a software firewall, but I don't trust that it is enough.
Is there a way to configure IIS to make it only work on the machine its
installed on in a localhost type mode or something. I basically want to cut
it off from the outside world.
Thanks!
David Wang [Msft]
IIS 5.1 comes with XP Pro and only supports one website and 10 connections.
1. It is possible to set up IP Restriction on the website such that it will
only process localhost/127.0.0.1 requests (I don't remember if this feature
is enabled in the UI or not).
2. You can also setup the Microsoft Loopback Adapter and configure the
website to only listen on that network interface, so it then becomes
impossible for IIS to even respond to non local requests while your own PC
is perfectly able to access IIS.
3. Run the software firewall and make sure that port 80 is not open.
Finally, realize that when you run server software, you become responsible
for configuring/securing it. Security is best achieved through knowledge
and configuration.
--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"David Neff" <neff...@hotmail.com> wrote in message
news:%23pe%23Kj6FE...@TK2MSFTNGP11.phx.gbl...
Paul Lynch
<som...@online.microsoft.com> wrote:
>Several options.
>
>IIS 5.1 comes with XP Pro and only supports one website and 10 connections.
>1. It is possible to set up IP Restriction on the website such that it will
>only process localhost/127.0.0.1 requests (I don't remember if this feature
>is enabled in the UI or not).
>2. You can also setup the Microsoft Loopback Adapter and configure the
>website to only listen on that network interface, so it then becomes
>impossible for IIS to even respond to non local requests while your own PC
>is perfectly able to access IIS.
>3. Run the software firewall and make sure that port 80 is not open.
>
>Finally, realize that when you run server software, you become responsible
>for configuring/securing it. Security is best achieved through knowledge
>and configuration.
David,
You can't set IP restrictions on the 'desktop' versions of IIS.
Items in the ISM Are Missing or Appear Dimmed on Windows
http://support.microsoft.com/?id=263857
Regards,
Paul Lynch
MCSE
Jeff Cochran
<som...@online.microsoft.com> wrote:
>Several options.
>
>IIS 5.1 comes with XP Pro and only supports one website and 10 connections.
>1. It is possible to set up IP Restriction on the website such that it will
>only process localhost/127.0.0.1 requests (I don't remember if this feature
>is enabled in the UI or not).
>2. You can also setup the Microsoft Loopback Adapter and configure the
>website to only listen on that network interface, so it then becomes
>impossible for IIS to even respond to non local requests while your own PC
>is perfectly able to access IIS.
>3. Run the software firewall and make sure that port 80 is not open.
And 4) Unplug you connection from the internet and start IIS
manually. :)
Jeff
David Neff
I've developed, does that eliminate any risk?
PS- Thanks for all of your other advice. I really appreciate it.
"David Wang [Msft]" <som...@online.microsoft.com> wrote in message
news:erFl8D8F...@TK2MSFTNGP10.phx.gbl...
David Wang [Msft]
To stop IIS and prevent it from being "accidentally" started,
1. Configure IISADMIN service to be disabled
2. Stop the IISADMIN service.
Via the commandline:
SC CONFIG IISADMIN start= disabled
NET STOP /y IISADMIN
To restart IIS,
1. Configure IISADMIN service to be started manually
2. Start the WWW Publishing Service
Via the commandline:
SC CONFIG IISADMIN start= demand
NET START W3SVC
If you remove admin privileges from yourself on the machine and do the above
only via a secured admin shell (via RUNAS, for example), it will not be
possible for you to even accidentally enable or run IIS. This is how I run
my machines from a security standpoint.
--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"David Neff" <neff...@hotmail.com> wrote in message
news:OPPXFFHG...@TK2MSFTNGP09.phx.gbl...
Jeff Cochran
wrote:
>If I stop the website using the IIS snap in when I'm not testing whatever
>I've developed, does that eliminate any risk?
Not the snap in. The *service*. The snap in is just a method of
configuring IIS.
Jeff