iis服务器安全设置

# 启用SSL证书
New-Item -Path "C:\inetpub\wwwroot\MySite" -ItemType Directory
New-SelfSignedCertificate -DnsName "example.com" -CertStoreLocation "cert:\LocalMachine\My"
$bindings = @{protocol="https";bindingInformation="*:443:example.com"}
New-WebBinding -Name "MySite" -IP "*" -Port 443 -Protocol https -SslFlags 0 -HostHeader example.com
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -eq "CN=example.com"}
Set-WebConfigurationProperty -Filter /system.webServer/security/access -Name sslFlags -Value 0 -PSPath IIS:\ -Location "MySite"
Set-WebConfigurationProperty -Filter /system.webServer/security/access -Name sslFlags -Value 0 -PSPath IIS:\ -Location "MySite" -Value @{sslFlags=0}

# 设置日志文件权限
$acl = Get-Acl "C:\inetpub\logs\LogFiles\W3SVC1"
$permission = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators","FullControl","Allow")
$acl.SetAccessRule($permission)
Set-Acl "C:\inetpub\logs\LogFiles\W3SVC1" $acl

# 配置应用程序池身份验证
Import-Module WebAdministration
$pool = Get-Item IIS:\AppPools\MyAppPool
$pool.processModel.identityType = 3 # 设置为NetworkService
$pool | Set-Item