iis/nt/fp web security

[Ostuni]

we have a fp web (2k extensions) on a nt 4(6a) box with iis 4... the box is OUTSIDE our firewall... until i can move that behind our firewall (lots of issues), can anyone recommend a kind of basic security review/checklist to make that box not so easy to hack/deface? lucky so far, but i suspect it's a fat, easy target... have very limited nt/iis knowhow, so please speak babytalk? mtia,

 

[scottcm]

Check out these pages (some only have IIS 5 but a lot of the settings are the same):

http://www.sans.org/top20.htm

http://rr.sans.org/web/web_list.php

http://www.microsoft.com/security

Microsoft used to have a security checklist for IIS 4 but I didn't see it at first glance.

My recommendation: rebuild the server before attempting to secure it. If it's NT4/IIS4 sitting exposed on the Internet then I doubt you've been lucky.

 

[Ostuni]

those were great references... cheers.