Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 259
  • Last Modified:

Hiding IIS with an Apache reverse proxy

Based on the recent bugs in IIS I am looking at hiding IIS behind an Apache reverse proxy.  Will this work or with the current problem will it just pass the request unaltered to the IIS box?  If it does work are there any configuration issues that I should know?
0
NBBCTest01
Asked:
NBBCTest01
1 Solution
 
Rich RumbleSecurity SamuraiCommented:
From reading up on Apache's RP, looks like it's transparent, all request will be passed- meaning if you look at the headers you get back, they will say IIS verXX. There are filters that can be applied on the apache porxy that may deny certain exploits, but your best bet is to lock it(iis) down with IIS-Lockdown, and UrlScan... keep up with patches, and run AV on the servers if possible. Or move to Apache altogether... always block all ports except the most necessary ones.

http://www.microsoft.com/windows2000/downloads/recommended/iislockdown/default.asp
http://www.microsoft.com/technet/security/tools/urlscan.mspx

-rich
0

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now