Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>When you choose an authentication other than Anonymous, you certainly can be subject to password hacking. However, the account that is uses is subject to the standard account lockout policies set in Local Security Policy and your Domain's security policy.</p> <p>For example, if you have a local account "FRED" and the account lockout policy is set to 5 invalid attempts within 30 minutes, then this effectively prevents account password guessing, at the risk of a denial of service attack. However, setting the reset window to a value (15 minutes?) effectively limits the DOS.</p> <ul> <li><p>Basic Authentication is not recommeded for a non-SSL connection since the password will travel in plain text. </p></li> <li><p>Digest Authentication requires passwords to be stored on the server using a reversible encryption, so while better than Basic, Digest has its flaws.</p></li> <li><p>Windows Integrated Authentication includes NTLM and Kerberos. </p> <ul> <li><p>The IIS Server should be configured via Group Policy or Local Security settings to disable LM authentication ( Network security: LAN Manager authentication level set to "Send NTLMv2 response only" or higher, preferred is "Send NTLMv2 response only\refuse LM &amp; NTLM") to prevent trivial LM hash cracking and to prevent NTLM man in the middle proxy attacks.</p></li> <li><p>Kerberos can be used, however it only works if both machines are members of the same domain and the DC's can be reached. Since this doesn't typically happen over the internet, you can ignore Kerberos.</p></li> </ul></li> </ul> <p>So the end result is, yes, disabling anonymous does open you up for password cracking attempts and DOS attacks, but these can be prevented and mitigated.</p>
    singulars
    1. This table or related slice is empty.
    1. PODoes disabling anonymous access in IIS create a security risk?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. This table or related slice is empty.
    1. USChristopher G. Lewis
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PODoes disabling anonymous access in IIS create a security risk?
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTBountyClose
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTAcceptedByOriginator
    1. COThanks very much. Just to clarify, is it the case that such a password guessing opportunity does not exist when Anonymous authentication is in place, i.e. by sending directly whatever request headers the password dialogue sends, and still receiving some kind of informative response?
      singulars
      1. PO
      1. USstovroz
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload