I'm working on a new Sitecore 8.1 dev/uat/production infrastructure. We would like to reduce our possible attack surface and have a hardened installation from the start.
One of the Sitecore requirements is obviously IIS and the Web Server role! However I can't find any details about the features required for IIS. This either means that the defaults are necessary or perhaps it hasn't been deeply considered.
Which role services are necessary for Sitecore to operate correctly?
I don't have a definitive list anywhere, and without actually attempting to remove each service one at a time until it breaks, here is the list of role services we use on a "locked down" Content Delivery environment (no Sitecore shell):
[X] Web Server (IIS) Web-Server
[X] Web Server Web-WebServer
[X] Common HTTP Features Web-Common-Http
[X] Default Document Web-Default-Doc
[ ] Directory Browsing Web-Dir-Browsing
[X] HTTP Errors Web-Http-Errors
[X] Static Content Web-Static-Content
[X] HTTP Redirection Web-Http-Redirect
[ ] WebDAV Publishing Web-DAV-Publishing
[X] Health and Diagnostics Web-Health
[X] HTTP Logging Web-Http-Logging
[ ] Custom Logging Web-Custom-Logging
[X] Logging Tools Web-Log-Libraries
[ ] ODBC Logging Web-ODBC-Logging
[X] Request Monitor Web-Request-Monitor
[X] Tracing Web-Http-Tracing
[X] Performance Web-Performance
[X] Static Content Compression Web-Stat-Compression
[X] Dynamic Content Compression Web-Dyn-Compression
[X] Security Web-Security
[X] Request Filtering Web-Filtering
[X] Basic Authentication Web-Basic-Auth
[ ] Centralized SSL Certificate Support Web-CertProvider
[ ] Client Certificate Mapping Authentic... Web-Client-Auth
[ ] Digest Authentication Web-Digest-Auth
[ ] IIS Client Certificate Mapping Authe... Web-Cert-Auth
[ ] IP and Domain Restrictions Web-IP-Security
[ ] URL Authorization Web-Url-Auth
[ ] Windows Authentication Web-Windows-Auth
[X] Application Development Web-App-Dev
[ ] .NET Extensibility 3.5 Web-Net-Ext
[X] .NET Extensibility 4.5 Web-Net-Ext45
[X] Application Initialization Web-AppInit
[ ] ASP Web-ASP
[ ] ASP.NET 3.5 Web-Asp-Net
[X] ASP.NET 4.5 Web-Asp-Net45
[ ] CGI Web-CGI
[X] ISAPI Extensions Web-ISAPI-Ext
[X] ISAPI Filters Web-ISAPI-Filter
[X] Server Side Includes Web-Includes
[X] WebSocket Protocol Web-WebSockets
[ ] FTP Server Web-Ftp-Server
[ ] FTP Service Web-Ftp-Service
[ ] FTP Extensibility Web-Ftp-Ext
[X] Management Tools Web-Mgmt-Tools
[X] IIS Management Console Web-Mgmt-Console
[ ] IIS 6 Management Compatibility Web-Mgmt-Compat
[ ] IIS 6 Metabase Compatibility Web-Metabase
[ ] IIS 6 Management Console Web-Lgcy-Mgmt-Console
[ ] IIS 6 Scripting Tools Web-Lgcy-Scripting
[ ] IIS 6 WMI Compatibility Web-WMI
[ ] IIS Management Scripts and Tools Web-Scripting-Tools
[ ] Management Service Web-Mgmt-Service
Obviously your requirements will vary depending on your setup. If I had to guess at a minimum, I would go for the following:
[X] Web Server (IIS) Web-Server
[X] Web Server Web-WebServer
[X] Common HTTP Features Web-Common-Http
[X] Default Document Web-Default-Doc
[ ] Directory Browsing Web-Dir-Browsing
[X] HTTP Errors Web-Http-Errors
[X] Static Content Web-Static-Content
[ ] HTTP Redirection Web-Http-Redirect
[ ] WebDAV Publishing Web-DAV-Publishing
[X] Health and Diagnostics Web-Health
[X] HTTP Logging Web-Http-Logging
[ ] Custom Logging Web-Custom-Logging
[X] Logging Tools Web-Log-Libraries
[ ] ODBC Logging Web-ODBC-Logging
[ ] Request Monitor Web-Request-Monitor
[ ] Tracing Web-Http-Tracing
[ ] Performance Web-Performance
[ ] Static Content Compression Web-Stat-Compression
[ ] Dynamic Content Compression Web-Dyn-Compression
[ ] Security Web-Security
[ ] Request Filtering Web-Filtering
[ ] Basic Authentication Web-Basic-Auth
[ ] Centralized SSL Certificate Support Web-CertProvider
[ ] Client Certificate Mapping Authentic... Web-Client-Auth
[ ] Digest Authentication Web-Digest-Auth
[ ] IIS Client Certificate Mapping Authe... Web-Cert-Auth
[ ] IP and Domain Restrictions Web-IP-Security
[ ] URL Authorization Web-Url-Auth
[ ] Windows Authentication Web-Windows-Auth
[X] Application Development Web-App-Dev
[ ] .NET Extensibility 3.5 Web-Net-Ext
[X] .NET Extensibility 4.5 Web-Net-Ext45
[ ] Application Initialization Web-AppInit
[ ] ASP Web-ASP
[ ] ASP.NET 3.5 Web-Asp-Net
[X] ASP.NET 4.5 Web-Asp-Net45
[ ] CGI Web-CGI
[ ] ISAPI Extensions Web-ISAPI-Ext
[ ] ISAPI Filters Web-ISAPI-Filter
[ ] Server Side Includes Web-Includes
[ ] WebSocket Protocol Web-WebSockets
[ ] FTP Server Web-Ftp-Server
[ ] FTP Service Web-Ftp-Service
[ ] FTP Extensibility Web-Ftp-Ext
[X] Management Tools Web-Mgmt-Tools
[X] IIS Management Console Web-Mgmt-Console
[ ] IIS 6 Management Compatibility Web-Mgmt-Compat
[ ] IIS 6 Metabase Compatibility Web-Metabase
[ ] IIS 6 Management Console Web-Lgcy-Mgmt-Console
[ ] IIS 6 Scripting Tools Web-Lgcy-Scripting
[ ] IIS 6 WMI Compatibility Web-WMI
[ ] IIS Management Scripts and Tools Web-Scripting-Tools
[ ] Management Service Web-Mgmt-Service
PS. You can get/set these through the Get-WindowsFeature and Add-WindowsFeature PowerShell commands from an elevated prompt.
