M100691: How to: Configure URLScan for ManageSoft

This article explains how to configure URLScan for IIS so that ManageSoft can download and upload requests through HTTP.

URLScan is a Microsoft Security tool which restricts the type of HTTP requests that IIS will process. URLScan is used primarily to help prevent harmful and dangerous requests from reaching a server and is available as part of the IISLockdown.exe. URLScan consists of 2 basic files - URLScan.dll and URLScan.ini and is installed into directory%windir%\system32\inetsrv\urlscan.

How can you tell if URLScan is in use?

On viewing the IIS logs on your web server you may see a message like this:

2005-06-141 00:56:54 10.1.1.208 - W3SVC1 COBALT 10.1.1.156 80 GET /<Rejected-By-UrlScan>~/ManageSoftDL/Policies/Merged/test.mgsft.com_domain/Machine/ZINC.npl 404 123 HTTP/1.0 cobalt.test.mgsft.com ManageSoft/6.9+(Windows+NT4/2000/XP)

When URLScan is in use the IIS log files will always have a message <Rejected-By-UrlScan> if there is any HTTP request which violates the URLScan configuration.

URLScan.ini

URLScan.ini can be modified to suit a particular environment. The file contains the following sections:

• [Options] - This section describes general URLScan options
• [RequestLimits] - Imposes limits on the length of allowed parts of requests reaching the server
• [AllowVerbs] and [DenyVerbs] - These sections define the verbs (also known as HTTP methods) that URLScan permits
• [DenyHeaders] - This section lists HTTP headers that are not permitted in an HTTP request. If a HTTP request contains one of the HTTP headers that are listed in this section, URLScan rejects the request.
• [AllowExtensions] and [DenyExtensions] - These sections define the file name extensions that URLScan permits or denies
• [DenyURLSequences] - This section lists strings that are not permitted in an HTTP request. URLScan rejects HTTP requests that contain a string that appears in this section.