7

I'm working on a new Sitecore 8.1 dev/uat/production infrastructure. We would like to reduce our possible attack surface and have a hardened installation from the start.

One of the Sitecore requirements is obviously IIS and the Web Server role! However I can't find any details about the features required for IIS. This either means that the defaults are necessary or perhaps it hasn't been deeply considered.

Which role services are necessary for Sitecore to operate correctly?

10

I don't have a definitive list anywhere, and without actually attempting to remove each service one at a time until it breaks, here is the list of role services we use on a "locked down" Content Delivery environment (no Sitecore shell):

[X] Web Server (IIS)                                    Web-Server
    [X] Web Server                                      Web-WebServer
        [X] Common HTTP Features                        Web-Common-Http
            [X] Default Document                        Web-Default-Doc
            [ ] Directory Browsing                      Web-Dir-Browsing
            [X] HTTP Errors                             Web-Http-Errors
            [X] Static Content                          Web-Static-Content
            [X] HTTP Redirection                        Web-Http-Redirect
            [ ] WebDAV Publishing                       Web-DAV-Publishing
        [X] Health and Diagnostics                      Web-Health
            [X] HTTP Logging                            Web-Http-Logging
            [ ] Custom Logging                          Web-Custom-Logging
            [X] Logging Tools                           Web-Log-Libraries
            [ ] ODBC Logging                            Web-ODBC-Logging
            [X] Request Monitor                         Web-Request-Monitor
            [X] Tracing                                 Web-Http-Tracing
        [X] Performance                                 Web-Performance
            [X] Static Content Compression              Web-Stat-Compression
            [X] Dynamic Content Compression             Web-Dyn-Compression
        [X] Security                                    Web-Security
            [X] Request Filtering                       Web-Filtering
            [X] Basic Authentication                    Web-Basic-Auth
            [ ] Centralized SSL Certificate Support     Web-CertProvider
            [ ] Client Certificate Mapping Authentic... Web-Client-Auth
            [ ] Digest Authentication                   Web-Digest-Auth
            [ ] IIS Client Certificate Mapping Authe... Web-Cert-Auth
            [ ] IP and Domain Restrictions              Web-IP-Security
            [ ] URL Authorization                       Web-Url-Auth
            [ ] Windows Authentication                  Web-Windows-Auth
        [X] Application Development                     Web-App-Dev
            [ ] .NET Extensibility 3.5                  Web-Net-Ext
            [X] .NET Extensibility 4.5                  Web-Net-Ext45
            [X] Application Initialization              Web-AppInit
            [ ] ASP                                     Web-ASP
            [ ] ASP.NET 3.5                             Web-Asp-Net
            [X] ASP.NET 4.5                             Web-Asp-Net45
            [ ] CGI                                     Web-CGI
            [X] ISAPI Extensions                        Web-ISAPI-Ext
            [X] ISAPI Filters                           Web-ISAPI-Filter
            [X] Server Side Includes                    Web-Includes
            [X] WebSocket Protocol                      Web-WebSockets
    [ ] FTP Server                                      Web-Ftp-Server
        [ ] FTP Service                                 Web-Ftp-Service
        [ ] FTP Extensibility                           Web-Ftp-Ext
    [X] Management Tools                                Web-Mgmt-Tools
        [X] IIS Management Console                      Web-Mgmt-Console
        [ ] IIS 6 Management Compatibility              Web-Mgmt-Compat
            [ ] IIS 6 Metabase Compatibility            Web-Metabase
            [ ] IIS 6 Management Console                Web-Lgcy-Mgmt-Console
            [ ] IIS 6 Scripting Tools                   Web-Lgcy-Scripting
            [ ] IIS 6 WMI Compatibility                 Web-WMI
        [ ] IIS Management Scripts and Tools            Web-Scripting-Tools
        [ ] Management Service                          Web-Mgmt-Service

Obviously your requirements will vary depending on your setup. If I had to guess at a minimum, I would go for the following:

[X] Web Server (IIS)                                    Web-Server
    [X] Web Server                                      Web-WebServer
        [X] Common HTTP Features                        Web-Common-Http
            [X] Default Document                        Web-Default-Doc
            [ ] Directory Browsing                      Web-Dir-Browsing
            [X] HTTP Errors                             Web-Http-Errors
            [X] Static Content                          Web-Static-Content
            [ ] HTTP Redirection                        Web-Http-Redirect
            [ ] WebDAV Publishing                       Web-DAV-Publishing
        [X] Health and Diagnostics                      Web-Health
            [X] HTTP Logging                            Web-Http-Logging
            [ ] Custom Logging                          Web-Custom-Logging
            [X] Logging Tools                           Web-Log-Libraries
            [ ] ODBC Logging                            Web-ODBC-Logging
            [ ] Request Monitor                         Web-Request-Monitor
            [ ] Tracing                                 Web-Http-Tracing
        [ ] Performance                                 Web-Performance
            [ ] Static Content Compression              Web-Stat-Compression
            [ ] Dynamic Content Compression             Web-Dyn-Compression
        [ ] Security                                    Web-Security
            [ ] Request Filtering                       Web-Filtering
            [ ] Basic Authentication                    Web-Basic-Auth
            [ ] Centralized SSL Certificate Support     Web-CertProvider
            [ ] Client Certificate Mapping Authentic... Web-Client-Auth
            [ ] Digest Authentication                   Web-Digest-Auth
            [ ] IIS Client Certificate Mapping Authe... Web-Cert-Auth
            [ ] IP and Domain Restrictions              Web-IP-Security
            [ ] URL Authorization                       Web-Url-Auth
            [ ] Windows Authentication                  Web-Windows-Auth
        [X] Application Development                     Web-App-Dev
            [ ] .NET Extensibility 3.5                  Web-Net-Ext
            [X] .NET Extensibility 4.5                  Web-Net-Ext45
            [ ] Application Initialization              Web-AppInit
            [ ] ASP                                     Web-ASP
            [ ] ASP.NET 3.5                             Web-Asp-Net
            [X] ASP.NET 4.5                             Web-Asp-Net45
            [ ] CGI                                     Web-CGI
            [ ] ISAPI Extensions                        Web-ISAPI-Ext
            [ ] ISAPI Filters                           Web-ISAPI-Filter
            [ ] Server Side Includes                    Web-Includes
            [ ] WebSocket Protocol                      Web-WebSockets
    [ ] FTP Server                                      Web-Ftp-Server
        [ ] FTP Service                                 Web-Ftp-Service
        [ ] FTP Extensibility                           Web-Ftp-Ext
    [X] Management Tools                                Web-Mgmt-Tools
        [X] IIS Management Console                      Web-Mgmt-Console
        [ ] IIS 6 Management Compatibility              Web-Mgmt-Compat
            [ ] IIS 6 Metabase Compatibility            Web-Metabase
            [ ] IIS 6 Management Console                Web-Lgcy-Mgmt-Console
            [ ] IIS 6 Scripting Tools                   Web-Lgcy-Scripting
            [ ] IIS 6 WMI Compatibility                 Web-WMI
        [ ] IIS Management Scripts and Tools            Web-Scripting-Tools
        [ ] Management Service                          Web-Mgmt-Service

PS. You can get/set these through the Get-WindowsFeature and Add-WindowsFeature PowerShell commands from an elevated prompt.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.