Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 261
  • Last Modified:

Hiding IIS with an Apache reverse proxy

Based on the recent bugs in IIS I am looking at hiding IIS behind an Apache reverse proxy.  Will this work or with the current problem will it just pass the request unaltered to the IIS box?  If it does work are there any configuration issues that I should know?
0
NBBCTest01
Asked:
NBBCTest01
1 Solution
 
Rich RumbleSecurity SamuraiCommented:
From reading up on Apache's RP, looks like it's transparent, all request will be passed- meaning if you look at the headers you get back, they will say IIS verXX. There are filters that can be applied on the apache porxy that may deny certain exploits, but your best bet is to lock it(iis) down with IIS-Lockdown, and UrlScan... keep up with patches, and run AV on the servers if possible. Or move to Apache altogether... always block all ports except the most necessary ones.

http://www.microsoft.com/windows2000/downloads/recommended/iislockdown/default.asp
http://www.microsoft.com/technet/security/tools/urlscan.mspx

-rich
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now