Re: Disable TRACE??

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: John Alderson (jalderson^at^adelphia^dot^net)
Date: 04/02/04 

Date: Thu, 1 Apr 2004 20:40:30 -0500

"Billy S" <anonymous@discussions.microsoft.com> wrote in message
news:24F0CF38-0064-4B8C-8EEC-85E14ADAD106@microsoft.com...
> OK How do I disable the HTTP TRACE from IIS without running the lockdown
tool? When we run it, it kills 80% of the programs we run but yet the
stupid security people moan about some HTTP TRACE... Any suggestions?
>
> Billy S.

Hmm.... the security people are stupid but you can't figure out how to make
your applications work with the solid configuration that Lockdown provides?
You might want to rethink your philosophy...

In addition to what David said in using URLScan (which should be the
preferred approach), you can also disable the TRACE or DEBUG verb for
particular ISAPI mappings (such as for ASP). For production systems, I
would use this as a second layer of defense.

For IIS 5.0, open the Internet Services Manager and select Properties on the
Server object. Choose Edit for the WWW Properties.
Select the Home Directory tab and then the Configuration button. Under
application mappings, select Edit. Mappings should be using the "Limit To"
set of HTTP verbs. Delete TRACE or DEBUG (in the case of IIS 6.0) and save
the mapping. You'll want to do that for each mapping.

John Alderson

Relevant Pages

  • Re: TRACE Request: how to disable in IIS5
    ... Trace is a HTTP verb (like get and post and etc. ... together from a http request. ... all Web servers have TRACE ...
    (microsoft.public.inetserver.iis.security)
  • Re: http TRACE option
    ... Here's the HTTP TRACE discussion from the 2nd edition of my book ... If the TRACE method is supported and the web server is running a poorly written application that is vulnerable to cross-site scripting, a cross-site tracing attack can be launched to compromise user cookie and session information. ... If the web server is running a static site with no server-side application or processing of user data, the impact of TRACE support is significantly reduced. ... XST is an attack class developed by Jeremiah Grossman in 2003 that allows authentication details presented in HTTP headers to be compromised using a combination of XSS, client-side weaknesses, and support for the HTTP TRACE method server-side. ...
    (Pen-Test)
  • Re: HTTP://1.1 500 Server Error
    ... as to why this is the case, no log messages, no stack traces, nothing. ... The IIS ... error log simply logs that the request was a 500. ... detailed--or any for that matter--error or stack trace. ...
    (microsoft.public.inetserver.iis)
  • mod_rewrite and disabling HTTP TRACE - no worky
    ... Does Apache 2.0.54 have mod_rewrite non-compiled in, ... TRACE already disabled? ... No virutual server config'd, but I still wanted to disable the HTTP ...
    (comp.infosystems.www.servers.unix)
  • Re: Unable to authenticate with digest authentication...
    ... using some kind of a packet sniffer to trace the HTTP traffic is a ... I have verified through network traces that it is using Digest ... And it's going over http, ...
    (microsoft.public.dotnet.security)