Web sites must limit the number of simultaneous requests.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2240	WG110 IIS7	SV-32323r1_rule	ECSC-1	Medium

Description
Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web-site, facilitating a Denial of Service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).

Description

Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web-site, facilitating a Denial of Service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).

STIG	Date
IIS 7.0 WEB SITE STIG	2011-08-19

Details

Check Text ( C-32730r1_chk )
1. Open an administrator command prompt and enter the following command: appcmd list config -section:system.applicationHost/sites 2. Review the results and verify each web site has a value greater than zero listed for maxconnections. If not, this is a finding.

Fix Text (F-29195r1_fix)
For the site under review, determine the maximum number of connections needed and use the following command to set: section:system.applicationHost/sites "/[name='SITENAME'].limits.maxConnections:X" /commit:apphost Replace SITENAME with the site under review and X with the maximum number of connections allowable.