{"id":390,"date":"2004-03-31T23:55:38","date_gmt":"2004-04-01T04:55:38","guid":{"rendered":"http:\/\/blogs.law.harvard.edu\/hoanga\/2004\/03\/31\/microsoft-iis-urlscan-inflexiblities\/"},"modified":"2004-03-31T23:55:38","modified_gmt":"2004-04-01T04:55:38","slug":"microsoft-iis-urlscan-inflexiblities","status":"publish","type":"post","link":"https:\/\/archive.blogs.harvard.edu\/hoanga\/2004\/03\/31\/microsoft-iis-urlscan-inflexiblities\/","title":{"rendered":"Microsoft IIS URLScan inflexiblities"},"content":{"rendered":"<p><a name='a349'><\/a><\/p>\n<p>\n Well this certainly sucks.  I&#8217;ve been working with IIS a little bit and<br \/>\n have installed URLScan and locked down the IIS server the best that I know<br \/>\n of with all the tools available from M$ to help lock this stuff down.<br \/>\n (The Microsoft Baseline Auditor Tool works well for this).\n <\/p>\n<p>\n So here I am happy with a somewhat secure lockdown for my purposes and<br \/>\n I figure why not serve up files from the web server such as some nice<br \/>\n freeware utilities I found.  Well, it seems URLScan bans all files ending in<br \/>\n <em>.exe<\/em> unless you unconfigure it.   Suck.  I want just a set of files<br \/>\n in one directory banned not ALL of them.\n <\/p>\n<p>\n Kudos to this web archive (and <a href=\"http:\/\/www.derkeiler.com\">Der Keiler<br \/>\n <\/a>of the microsoft.public.intetserver.iis.security newsgroup:<br \/>\n <br \/>\n <em><br \/>\n From: (Jeff Cochran)<br \/>\n Date: Fri, 01 Nov 2002 13:45:40 GMT<br \/>\n &gt;Does anybody know if I can allow a specific .exe file and not ALL .exe <br \/>\n &gt;files? <\/p>\n<p>\n Not in URLScan. <\/p>\n<p> Jeff<br \/>\n <\/em>\n <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Well this certainly sucks. I&#8217;ve been working with IIS a little bit and have installed URLScan and locked down the IIS server the best that I know of with all the tools available from M$ to help lock this stuff down. (The Microsoft Baseline Auditor Tool works well for this). So here I am happy [&hellip;]<\/p>\n","protected":false},"author":704,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1212],"tags":[],"class_list":["post-390","post","type-post","status-publish","format-standard","hentry","category-tagme"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/archive.blogs.harvard.edu\/hoanga\/wp-json\/wp\/v2\/posts\/390","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/archive.blogs.harvard.edu\/hoanga\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/archive.blogs.harvard.edu\/hoanga\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/hoanga\/wp-json\/wp\/v2\/users\/704"}],"replies":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/hoanga\/wp-json\/wp\/v2\/comments?post=390"}],"version-history":[{"count":0,"href":"https:\/\/archive.blogs.harvard.edu\/hoanga\/wp-json\/wp\/v2\/posts\/390\/revisions"}],"wp:attachment":[{"href":"https:\/\/archive.blogs.harvard.edu\/hoanga\/wp-json\/wp\/v2\/media?parent=390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/hoanga\/wp-json\/wp\/v2\/categories?post=390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/hoanga\/wp-json\/wp\/v2\/tags?post=390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}