Updating IIS

[silentkevin]

I just installed IIS on my machine for a project I'm workin on, and this is the first time I've ever worked with it. With all the reports of vulnerabilities and the like in IIS, I'm guessin I should do something to update it. Is there an automatic updater for it like Windows Update, or can someone point me to a place where I can download all the updates I need?

Thanks

 

[Workin']

I hope the unpatched server's not open to the internet right now. If it is you are probably already infected with the nimda virus. It often takes less than an hour of unprotected exposure to get it. Which really sucks. One time I set up IIS and forget to close port 80 on the router and within 15 minutes the damn thing was infected with nimda. It was easier to reformat and set up the server from scratch than it would have been to remove the stupid virus.

Download this free tool from Microsoft to help figure out which patches you need. It checks Windows 2000 (and XP or NT), Internet Explorer (5, 5.5, or 6), and IIS (4 or 5) to see if the necessary patches and hotfixes have been successfully applied, and if not, gives a MS Knowledge Base article number to refer to. Run it as hfnetchk -v from a command prompt. It's a very useful tool. Unfortunately there's no "Windows Update" kind of thing for IIS.

And disconnect that server from the internet until it is all patched up!!!!!

 

[netsysadmin]

Also search the Microsoft site for the IIS lockdown Wizard...this program will lock down all the unused features of IIS...and will install Urlscan which is an ISAPI filter program that will screen all incoming requests and reject the ones that dont look legit...good luck!

 

[reicherb]

Thanks guys. This IIS newbie was ignorantly assuming that windows update was taking care of it.

 

[jimmyhaha]

IIS... ?

after reserching on the web...

I prefer Apache...

 

[reicherb]

<< IIS... ?

after reserching on the web...

I prefer Apache... >>



Sometimes you've got no choice. Sometimes somebody that knowns nothing about technology decides to buy a web app that only runs on IIS.

 

[Bleep]

<< web app that only runs on IIS >>



What web apps whould that be??

Bleep

 

[n0cmonkey]

<<

<< web app that only runs on IIS >>



What web apps whould that be??

Bleep >>



Ones that morons should be fired over

This is why the IT dept, or the SysAdmin or whoever keeps everything working should be allowed to have a legitimate say in what is purchased.

 

[reicherb]

http://www.careerplanonline.com

The pages are ASP and the database is Access.