UCF STIG Viewer Logo

Web sites must limit the number of simultaneous requests.


Overview

Finding ID Version Rule ID IA Controls Severity
V-2240 WG110 IIS7 SV-32323r6_rule Medium
Description
Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web-site, facilitating a Denial of Service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).
STIG Date
IIS 7.0 WEB SITE STIG 2017-12-21

Details

Check Text ( C-32730r4_chk )
1. Open an administrator command prompt.
2. CD \Windows\system32\inetsrv
3. Enter the command:
appcmd list config /section:system.applicationHost/sites > out.txt (opens output in Notepad).
4. Review the results and verify each website has a value greater than zero listed for maxconnections parameter.

If not, this is a finding.

If nothing is listed, this is also a finding.
Fix Text (F-29195r6_fix)
For the site under review, determine the maximum number of connections needed.

1. Open an administrator command prompt.
2. CD \Windows\system32\inetserv
3. Enter the command:
appcmd set config -section:system.applicationHost/sites "/[name='Default Web Site'].limits.maxConnections:X" /commit:apphost

Note: Replace SITENAME with the site under review and X with the maximum number of connections allowable.

4. Enter the command to verify changes:
appcmd list config –section:system.applicationHost/sites>out.txt (opens output in Notepad).