CIS-CAT IIS hardening - Fixing the default allowed web extension-Disable directory browsing
Add these configurations under the <system.webServer>
in
Web.Config of the IIS website, on which the IRC and the CM
application is hosted, located at install path of IIS website on which the IRC and the CM
application is hosted\wwwroot.
<security>
<requestFiltering>
<fileExtensions allowUnlisted="false">
<remove fileExtension=".browser" />
<remove fileExtension=".skin" />
<remove fileExtension=".asax" />
<remove fileExtension=".ascx" />
<remove fileExtension=".config" />
<remove fileExtension=".master" />
<remove fileExtension=".resources" />
<remove fileExtension=".resx" />
<remove fileExtension=".sitemap" />
<add fileExtension=".zip" allowed="true" />
<add fileExtension=".xslt" allowed="true" />
<add fileExtension=".xsd" allowed="true" />
<add fileExtension=".xml" allowed="true" />
<add fileExtension=".sitemap" allowed="true" />
<add fileExtension=".resx" allowed="true" />
<add fileExtension=".resources" allowed="true" />
<add fileExtension=".master" allowed="true" />
<add fileExtension=".js" allowed="true" />
<add fileExtension=".html" allowed="true" />
<add fileExtension=".htm" allowed="true" />
<add fileExtension=".csv" allowed="true" />
<add fileExtension=".css" allowed="true" />
<add fileExtension=".config" allowed="true" />
<add fileExtension=".bin" allowed="true" />
<add fileExtension=".bez" allowed="true" />
<add fileExtension=".beu" allowed="true" />
<add fileExtension=".aspx" allowed="true" />
<add fileExtension=".asmx" allowed="true" />
<add fileExtension=".asax" allowed="true" />
<add fileExtension=".ascx" allowed="true" />
<add fileExtension=".skin" allowed="true" />
<add fileExtension=".axd" allowed="true" />
<add fileExtension=".png" allowed="true" />
<add fileExtension=".jpeg" allowed="true" />
<add fileExtension=".ico" allowed="true" />
<add fileExtension=".gif" allowed="true" />
<add fileExtension=".swf" allowed="true" />
<add fileExtension=".settings" allowed="true" />
<add fileExtension=".jpg" allowed="true" />
<add fileExtension=".pdf" allowed="true" />
<add fileExtension=".xls" allowed="true" />
<add fileExtension=".xlsx" allowed="true" />
<add fileExtension=".doc" allowed="true" />
<add fileExtension=".docx" allowed="true" />
<add fileExtension=".tff" allowed="true" />
<add fileExtension=".browser" allowed="true" />
<add fileExtension=".ashx" allowed="true" />
<add fileExtension=".rdl" allowed="true" />
<add fileExtension=".txt" allowed="true" />
<add fileExtension=".svc" allowed="true" />
</fileExtensions> </requestFiltering>
</security>