Access to the web-site log files must be restricted.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-13689	WG255 IIS7	SV-32482r1_rule	ECTP-1	Medium

Description
A major tool in exploring the web-site use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.

STIG	Date
IIS 7.0 WEB SITE STIG	2013-02-01

Details

Check Text ( C-32797r2_chk )
Follow the procedures below for each site under review: 1. Open the IIS Manager. 2. Click the site name. 3. Click the Logging icon. 4. Click Browse. 5. Right-click the log file name to review and click Properties. 6. Click the Security tab; ensure only authorized groups are listed, if others are listed, this is a finding. NOTE: The log file should be restricted as follows: Administrators, SYSTEM, TrustedInstaller, Auditors group: Full

Check Text ( C-32797r2_chk )

Follow the procedures below for each site under review:
1. Open the IIS Manager.
2. Click the site name.
3. Click the Logging icon.
4. Click Browse.
5. Right-click the log file name to review and click Properties.
6. Click the Security tab; ensure only authorized groups are listed, if others are listed, this is a finding.

NOTE: The log file should be restricted as follows:
Administrators, SYSTEM, TrustedInstaller, Auditors group: Full

Fix Text (F-28988r1_fix)
1. Open the IIS Manager. 2. Click the site name. 3. Click the Logging icon. 4. Click Browse. 5. Right-click the log file name to review and click Properties. 6. Click the Security tab. 7. Set the log file permissions for the appropriate group.