The IIS 10.0 websites MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.
An XCCDF Rule
Description
Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service (DoS) attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).
- ID
- SV-218826r960735_rule
- Version
- IIST-SV-000200
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Access the IIS 10.0 IIS Manager.
Click the IIS 10.0 server.
Select "Configuration Editor" under the "Management" section.