The IIS 10.0 websites MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.
An XCCDF Rule
Description
<VulnDiscussion>Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service (DoS) attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-218826r960735_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Access the IIS 10.0 IIS Manager.
Click the IIS 10.0 server.
Select "Configuration Editor" under the "Management" section.