QUOTE(arioch @ Sep 29 2003, 22:09)
QUOTE(Tazwolff @ Sep 29 2003, 20:28)
QUOTE(newalloy @ Sep 29 2003, 14:37)
yes.. unless you have Windows Xp, then you already have an http server included in your OS. (You must have WinXP Pro though) Go through add/remove windows components, inside Add/Remove Programs in the Control Panel, you'll find Internet Information Services there.
I wouldn't recomend the IIS to a new person looking for a simple user friendly server.
I wouldn't recommend Apache as a "simple" or "user-friendly" server either.
And in that regard, IIS is far easier to set up than Apache could ever hope to be.
Just install urlscan and iislockdown and you should be fine as far as exploits go.
Personal note: I primarily run Apache on a Linux box. I've successfully compromised Linux boxes through non-secure default Apache installs. My own machines have never been compromised, either through IIS on Windows or Apache on Linux.
Um...
QUOTE
Just install urlscan and iislockdown and you should be fine as far as exploits go.
...Your kidding Right?!?!?!? If that's all you did your screwed. I run 2k3/IIS6 with TS, Web, FTP, & Email services 24/7 on a static IP, I ran 2k/IIS5 before that. There are a ton if tiny little details to setting up a secure Windows server properly, they are extremely feature rich & very not simple.
Are you still using the default dir location? (that's a no-no)
Did you remove the default scripts & mappings? (the "tools" don't do all of it)
Did you remove the Directory Traversal permission for the Web User account? (many exploits start there)
Have you configured Group Policy, or even looked at it?
etc.
etc.
etc...