Created
May 24, 2012 14:02
-
-
Save fenneh/2781728 to your computer and use it in GitHub Desktop.
Install & Patch IIS7.5 Basic
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Script to configure web application servers | |
| ### Supporting functions ############################################################### | |
| function Install-Features($RolesToInstall) { | |
| $args = @("/Online") | |
| $args += "/Enable-Feature" | |
| foreach ($role in $RolesToInstall) { | |
| $args += "/FeatureName:$role" | |
| } | |
| & $env:windir\system32\dism $args | |
| } | |
| function Set-IISAlternateName { | |
| $sysinfo = Get-WmiObject -Class Win32_ComputerSystem | |
| $fqdn = "{0}.{1}" -f $sysinfo.Name, $sysinfo.Domain | |
| & $Env:WinDir\system32\inetsrv\appcmd.exe set config -section:system.webServer/serverRuntime /alternateHostName:$fqdn /commit:apphost | |
| } | |
| function Set-IISSecurityProtocols { | |
| $protopath = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols" | |
| & reg.exe add "$protopath\PCT 1.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$protopath\SSL 2.0\Server" /v Enabled /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$protopath\SSL 3.0\Server" /v Enabled /t REG_DWORD /d 00000001 /f | |
| & reg.exe add "$protopath\TLS 1.0\Server" /v Enabled /t REG_DWORD /d 00000001 /f | |
| & reg.exe add "$protopath\TLS 1.1\Server" /v Enabled /t REG_DWORD /d 00000001 /f | |
| & reg.exe add "$protopath\TLS 1.1\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$protopath\TLS 1.2\Server" /v Enabled /t REG_DWORD /d 00000001 /f | |
| & reg.exe add "$protopath\TLS 1.2\Server" /v DisabledByDefault /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$protopath\TLS 1.1\Client" /v Enabled /t REG_DWORD /d 00000001 /f | |
| & reg.exe add "$protopath\TLS 1.1\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$protopath\TLS 1.2\Client" /v Enabled /t REG_DWORD /d 00000001 /f | |
| & reg.exe add "$protopath\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 00000000 /f | |
| } | |
| function Set-IISSupportedCiphers { | |
| $cipherpath = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers" | |
| & reg.exe add "$cipherpath\NULL" /v Enabled /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$cipherpath\DES 56/56" /v Enabled /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$cipherpath\RC2 40/128" /v Enabled /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$cipherpath\RC2 56/128" /v Enabled /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$cipherpath\RC2 128/128" /v Enabled /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$cipherpath\RC4 40/128" /v Enabled /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$cipherpath\RC4 56/128" /v Enabled /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$cipherpath\RC4 64/128" /v Enabled /t REG_DWORD /d 00000000 /f | |
| & reg.exe add "$cipherpath\RC4 128/128" /v Enabled /t REG_DWORD /d 4294967295 /f | |
| & reg.exe add "$cipherpath\Triple DES 168/168" /v Enabled /t REG_DWORD /d 4294967295 /f | |
| & reg.exe add "$cipherpath\AES 128/128" /v Enabled /t REG_DWORD /d 4294967295 /f | |
| & reg.exe add "$cipherpath\AES 256/256" /v Enabled /t REG_DWORD /d 4294967295 /f | |
| } | |
| ### IIS Package Installation ######################################################## | |
| $BasicWebServerRoles = @( | |
| "IIS-WebServerRole", | |
| "IIS-WebServer", | |
| "IIS-CommonHttpFeatures", | |
| "IIS-StaticContent", | |
| "IIS-DefaultDocument", | |
| "IIS-HttpErrors", | |
| "IIS-HttpLogging", | |
| "WAS-WindowsActivationService", | |
| "WAS-ProcessModel", | |
| "WAS-ConfigurationAPI") | |
| $ManagementTools = @( | |
| "IIS-WebServerManagementTools", | |
| "IIS-ManagementConsole", | |
| "IIS-ManagementService", | |
| "IIS-ManagementScriptingTools") | |
| $SecurityOptions = @( | |
| "IIS-Security", | |
| "IIS-RequestFiltering", | |
| "IIS-IPSecurity") | |
| Write-Host -foregroundcolor green "Installing IIS Basic Web Server Role..." | |
| Install-Features $BasicWebServerRoles | |
| Write-Host -foregroundcolor green "Installing IIS Management tools..." | |
| Install-Features $ManagementTools | |
| Write-Host -foregroundcolor green "Installing IIS Security options..." | |
| Install-Features $SecurityOptions | |
| Write-Host -foregroundcolor green "Enable IIS Remote Management..." | |
| reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WebManagement\Server /v EnableRemoteManagement /t REG_DWORD /d 1 /f | |
| Write-Host -foregroundcolor green "Setting IIS Alternate Host Name..." | |
| Set-IISAlternateName | |
| Write-Host -foregroundcolor green "Setting IIS Security Protocols..." | |
| Set-IISSecurityProtocols | |
| Write-Host -foregroundcolor green "Setting IIS Supported Ciphers..." | |
| Set-IISSupportedCiphers | |
| Write-Host -foregroundcolor green "Checking Web Management Service..." | |
| sc.exe config "wmsvc" start= auto | |
| Restart-Service "wmsvc" | |
| Write-Warning "A reboot is required to apply IIS Security Protcol & Cipher changes" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
fenneh,
This is an excellent PowerShell script for hardening the security of IIS 7.5! However, I would have used the registry provider built-in to PowerShell--for example, the path name "HKLM:" accesses the "HKEY_LOCAL_MACHINE" registry hive. Also, SSLv3 and RC4 should now be disabled as well due to the cryptanalyses published as "POODLE" (a padding oracle attack) and "RC4 NOMORE" (a chosen-ciphertext attack) For more information see:
Thanks for publishing such a useful gist,
Derek Callaway