Securing Internet Information Server (IIS) 6 for DMZ Placement

The first step in any secure configuration is planning. The list below is basic considerations for planning a secure server installation.

• Physically secure the server. A server that can be physically accessed by everyone is a risk to the security and availability of the system(s).
• Always use NTFS formatted partitions. The NTFS file system allows for granular control over system access through implementation of Access Control Lists (ACLS).
• IIS should not be installed on a Domain Controller (DC). In the event that an IIS server on a DC was compromised the attacker would be able to access the user account database.
• IIS should not be installed on its own server.
• Do not install development tools on a production server.
• Plan the disk configuration so that the operating system, application, and IIS logs can be placed on separate volumes.
• Ensure that the server is not exposed to the Internet during the installation and if possible not available on the network.
• Unless necessary do not install Front Page Server Extensions or the HTML Admin.
• On a multi-homed server, IP routing should not allow a web server to bridge disparate networks or subnets.
• Anti-virus software should be installed and configured to only scan inbound files to the server.
• Once the operating system is installed ensure that all service packs and hotfixes have been applied to the server.