Web server system files must conform to minimum file permission requirements.

Part of WG300

SV-32332r2_rule Web server system files must conform to minimum file permission requirements.

Vulnerability discussion

This check verifies the key web server system configuration files are owned by the SA or the web administrator controlled account. These same files that control the configuration of the web server, and thus its behavior, must also be accessible by the account running the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.

Check content

1. Open Explorer and navigate to the inetpub directory. 2. Right-click inetpub and select Properties. 3. Click the Security tab. 4. Verify the permissions for the following users; if the permissions are less restrictive, this is a finding. System: Full control Administrators: Full control TrustedInstaller: Full control Users: Read & execute, list folder contents Creator/Owner: Special permissions to subkeys

Fix text

1. Open Explorer and navigate to the inetpub directory. 2. Right-click inetpub and select Properties. 3. Click the Security tab. 4. Set the following permissions: System: Full control Administrators: Full control TrustedInstaller: Full control Users: Read & execute, list folder contents Creator/Owner: special permissions to subkeys

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.