URLScan log entries (help understanding)
Web Server forum
Back To The Forum Home!Search!Private Messaging System

Web Server Talk Web Server Talk > Web Servers reviews > IIS server support > IIS Server Security > URLScan log entries (help understanding)




  Last Thread   Next Thread Next
  Show Printable Version Email this Page Subscribe to this Thread      Post New Thread    Post A Reply      

    URLScan log entries (help understanding)  
John Jones


View Ip Address Report This Message To A Moderator Edit/Delete Message


 
08-05-05 10:53 PM

Please forgive my ignorance.  Can someone please explain "what kind of
request and why such a request" is being rejected.  The following log entrie
s
are in our "urlscan" log:

[08-05-2005 - 03:45:48] Client at 80.108.88.170: Sent verb 'PUT', which 
is
not specifically allowed. Request will be rejected.
[08-05-2005 - 05:29:40] Client at 136.234.47.108: Sent verb 'OPTIONS', w
hich
is not specifically allowed. Request will be rejected.
[08-05-2005 - 09:06:05] Client at 65.173.140.105: Sent verb 'LOCK', whic
h is
not specifically allowed. Request will be rejected.
[08-05-2005 - 09:06:21] Client at 65.173.140.105: Sent verb 'PROPFIND',
which is not specifically allowed. Request will be rejected.
[08-05-2005 - 09:13:03] Client at 80.108.88.170: Sent verb 'PUT', which 
is
not specifically allowed. Request will be rejected.





[ Post a follow-up to this message ]



    Re: URLScan log entries (help understanding)  
Dave


View Ip Address Report This Message To A Moderator Edit/Delete Message


 
08-05-05 10:53 PM

well, the PUT OPTIONS LOCK PROPFIND verbs are all locked out by default...
read the text info on urlscan and check the ini file sections [allowverb
s]
and [denyverbs].

"John Jones" <John Jones@discussions.microsoft.com> wrote in message
news:6327CA2D-9EA5-4510-B9E1-74840B2AD108@microsoft.com...
> Please forgive my ignorance.  Can someone please explain "what kind of
> request and why such a request" is being rejected.  The following log
> entries
> are in our "urlscan" log:
>
> [08-05-2005 - 03:45:48] Client at 80.108.88.170: Sent verb 'PUT', whic
h is
> not specifically allowed. Request will be rejected.
> [08-05-2005 - 05:29:40] Client at 136.234.47.108: Sent verb 'OPTIONS',
> which
> is not specifically allowed. Request will be rejected.
> [08-05-2005 - 09:06:05] Client at 65.173.140.105: Sent verb 'LOCK', wh
ich
> is
> not specifically allowed. Request will be rejected.
> [08-05-2005 - 09:06:21] Client at 65.173.140.105: Sent verb 'PROPFIND'
,
> which is not specifically allowed. Request will be rejected.
> [08-05-2005 - 09:13:03] Client at 80.108.88.170: Sent verb 'PUT', whic
h is
> not specifically allowed. Request will be rejected.







[ Post a follow-up to this message ]



    Re: URLScan log entries (help understanding)  
David Wang [Msft]


View Ip Address Report This Message To A Moderator Edit/Delete Message


 
08-06-05 07:48 AM

1. Read the documentation file that comes with URLScan installer itself.
2. Read the extra online documentation (
http://www.microsoft.com/technet/se...ls/urlscan.mspx )
3. Read urlscan.ini for comments

Depending on the UseAllowVerbs configuration, you either have:
0 = any verb in [DenyVerbs] section are denied. All else is allowed.
1 = only verbs in [AllowVerbs] section are allowed. All else is denied

Your log file suggests that UrlScan.ini contains UseAllowVerbs=1, so verbs
other than GET, HEAD, and POST are being rejected (the language of the
verbose log entry basically says this).

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"John Jones" <John Jones@discussions.microsoft.com> wrote in message
news:6327CA2D-9EA5-4510-B9E1-74840B2AD108@microsoft.com...
Please forgive my ignorance.  Can someone please explain "what kind of
request and why such a request" is being rejected.  The following log
entries
are in our "urlscan" log:

[08-05-2005 - 03:45:48] Client at 80.108.88.170: Sent verb 'PUT', which 
is
not specifically allowed. Request will be rejected.
[08-05-2005 - 05:29:40] Client at 136.234.47.108: Sent verb 'OPTIONS', w
hich
is not specifically allowed. Request will be rejected.
[08-05-2005 - 09:06:05] Client at 65.173.140.105: Sent verb 'LOCK', whic
h is
not specifically allowed. Request will be rejected.
[08-05-2005 - 09:06:21] Client at 65.173.140.105: Sent verb 'PROPFIND',
which is not specifically allowed. Request will be rejected.
[08-05-2005 - 09:13:03] Client at 80.108.88.170: Sent verb 'PUT', which 
is
not specifically allowed. Request will be rejected.







[ Post a follow-up to this message ]



    Sponsored Links  




 





   All times are GMT. The time now is 02:39 AM.      Post New Thread    Post A Reply      
  Last Thread   Next Thread Next


Most Popular forums 

Forum Jump:
Rate This Thread:

Forum Rules:
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is OFF
vB code is ON
Smilies are ON
[IMG] code is OFF
 
Medical and Health forum | Computer Games Reviews | Graphics design forum

Back To The Top
Home | Usercp | Faq | Register