The IIS 8.5 websites MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.

From IIS 8.5 Site Security Technical Implementation Guide

Associated with: CCI-000054

SV-91469r1_rule The IIS 8.5 websites MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.

Vulnerability discussion

Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).

Check content

Access the IIS 8.5 IIS Manager. Click the IIS 8.5 server. Select "Configuration Editor" under the "Management" section. From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites". Expand "siteDefaults". Expand "limits". Review the results and verify the value is greater than zero for the "maxconnections" parameter. If the maxconnections parameter is set to zero, this is a finding.

Fix text

Access the IIS 8.5 IIS Manager. Click the IIS 8.5 server. Select "Configuration Editor" under the "Management" section. From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites". Expand "siteDefaults". Expand "limits". Set the "maxconnections" parameter to a value greater than zero.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.