A web server must not be co-hosted with other services

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6577	WG204 IIS6	SV-38196r1_rule	DCPA-1	Medium

Description
A detailed web server installation and configuration plan should be followed to provide standardization during the installation process. The installation and configuration plan should not support the co-hosting of multiple services such as Domain Name Service (DNS), e-mail, databases, search engines, indexing, or streaming media on the same server providing the web publishing service. Disallowed or restricted services in the context of this vulnerability apply to services not directly associated with the delivery of web content. An operating system that supports a web server will not provide other services (e.g., domain controller, e-mail server, database server, etc.). Only those services necessary to support the web server and its hosted sites are specifically allowed and may include, but are not limited to, operating system, logging, anti-virus, host intrusion detection, administrative maintenance, or network requirements. Any unnecessary services or protocols should be removed.

Description

A detailed web server installation and configuration plan should be followed to provide standardization during the installation process. The installation and configuration plan should not support the co-hosting of multiple services such as Domain Name Service (DNS), e-mail, databases, search engines, indexing, or streaming media on the same server providing the web publishing service. Disallowed or restricted services in the context of this vulnerability apply to services not directly associated with the delivery of web content. An operating system that supports a web server will not provide other services (e.g., domain controller, e-mail server, database server, etc.). Only those services necessary to support the web server and its hosted sites are specifically allowed and may include, but are not limited to, operating system, logging, anti-virus, host intrusion detection, administrative maintenance, or network requirements. Any unnecessary services or protocols should be removed.

STIG	Date
IIS6 Server	2011-09-26

Details

Check Text ( C-37654r1_chk )
Request a copy of and review the web server’s installation and configuration plan. Ensure the server is in compliance with this plan. If the server is not in compliance with the plan, this is a finding. Query the SA to ascertain if and where the additional services are installed. Confirm the additional service or application is not installed on the same partition as the operating systems root directory or the web document root. If it is, this is a finding.

Check Text ( C-37654r1_chk )

Request a copy of and review the web server’s installation and configuration plan.

Ensure the server is in compliance with this plan. If the server is not in compliance with the plan, this is a finding.

Query the SA to ascertain if and where the additional services are installed.

Confirm the additional service or application is not installed on the same partition as the operating systems root directory or the web document root. If it is, this is a finding.

Fix Text (F-32895r1_fix)
Move or install additional services and applications to partitions that are not the operating system root or the web document root.