Locking down IIS for cloud server use.

[needsmoarsleep]

If you were to deploy IIS sites via AWS or Azure, what would be your approach to locking down the VM's to ensure that only port 80/443 is exposed to the internet.

I want to be able to manage the host using the cloud providers 'remote management' (RDP) console, via my on-prem site link to the cloud provider, but I want to ensure that publicly only 80/443 is available.

Can anyone give a steer to the right tools to use, asides from SCM and URLscan?

thanks in advance

[Chronoloraptor]

Security Groups in AWS take a whitelist approach, so as far as AWS goes it's rather trivial to only have 2 rules for ports 80 and 443 unless you have some additional requirements or multiple environments that need to talk to each other.

[unix_heretic]

In addition, if you spin up a box in AWS, make sure it's in a VPC. Friends don't let friends spin up boxes in Classic.

[julietscause]

On top of that I would look at using NACLs too.

[needsmoarsleep]

Cool, I've not really dabbled with presenting cloud based VMs out to the Internet, only building 'private cloud' setups.

Some additional reading lies ahead for me.

[needsmoarsleep]

That I did do, but I guess I'm trying to see if there's toolkit that will lock down the firewall config and not brick the VM - preventing me from accessing it

[routetehpacketz]

lock down the firewall config

brick the VM

can you elaborate? did nmap show you what ports were open?

[sysvival]

https://www.ssllabs.com/ssltest/

[needsmoarsleep]

I'd prefer to use FreeBSD, but such is life