IIS Lockdown

IIS Lockdown's undo operation also reapplies the backup copy of the metabase the tool created before it performed the lockdown operation. Thus, any changes you make to IIS between lockdown and undo will be lost. However, the undo process makes another metabase backup before applying the previous backup, so you can recreate lost changes, if necessary.

IIS Lockdown Unattended
Using unattended mode for IIS Lockdown is fairly straightforward. Open iislockd.ini in Notepad and modify two keys in the [Info] group so that they read as follows:

Unattended=TRUE
UnattendedServerType=
  <ServerType>

For ServerType, choose a value from those listed in the ServerTypesNT4 and ServerTypes keys, also in the [Info] group.

IIS Lockdown 2.1 doesn't support command-line options, so modifying iislockd.ini is the only method for automation. This limitation presents a problem when you have multiple configurations or classes of servers. To circumvent the problems, perform these steps:

1. Create a separate directory for each configuration.
2. In the iislockd.ini file in each directory, turn on unattended mode and select the desired server type.
3. Launch IIS Lockdown from the appropriate directory as required for the server class.

The final key of interest in iislockd.ini's [Info] group is Undo, which lets you undo the previous lockdown operation if set to TRUE. If Undo is TRUE, IIS Lockdown performs the undo operation; it doesn't rerun itself to install the server type that the UnattendedServerType key specifies.

Custom Server Templates
You can create custom server templates and add them to the IIS Lockdown configuration list by modifying and adding information to the iislockd.ini file. Use the following process to create a custom server template:

1. Open iislockd.ini in Notepad.
2. Review the template names in the ServerTypesNT4 and ServerTypes keys, and come up with a new name (i.e., a name that IIS Lockdown isn't already using) for your new template.
3. Copy one of the existing server templates in the .ini file, and paste it at the bottom of the .ini file.
4. Change the template name (the word in brackets []) to the name you chose in Step 2.
5. Change the label key to a description of your new template.
6. Add the new template name to ServerTypesNT4 (for an NT 4.0 server template) or ServerTypes (for a Win2K server template).
7. Edit the iislockd.ini keys as necessary to enable or disable IIS Lockdown options.

IIS Lockdown can help you create a more secure Web server, but you can't stop there. Security is an ongoing process and should always be at the top of your priority list.

End of Article

   Previous  1  2  [3]  Next