IIS 5.0 Vunerable if anonymous disabled?

[vexxed]

Hi, I am trying to secure IIS 5.0 on windows 2000 professionl for some developers.
My goal is to have IIS (

http://www and

ftp) running on a workstation and not be vunerable to virus/trojan attacks from future weaknesses in IIS.
If I disable anonymous logons to the websites/services in IIS and restrict the IP that can connect to the websites to the only the localhost(127.0.0.1) and the local IP address, will the system be protected from future attacks?
Essentially the developer using the desktop is the only one that can use IIS services.

 

[Shift838]

If you restrict it that way , then you will be only allowing that user in. It would be much harder but possible to get in, but as I said harder. So yes that would make you system only vulnerable to that user that you are allowing to connect.

However experience hackers can hijack a ip address if they know you are only allowing that IP in. But as I said that is harder to do, and usually not worth the time for a hacker to get into a system unless they can profit from it.