Quá trình bước theo các bước nêu ra ở đây sử dụng một công cụ được gọi là Group Policy Management Console (GPMC), mà rất nhiều đơn giản hóa cách mà Active Directory GPO được áp dụng. Nó rất cao nên để cài đặt công cụ này cho | Publishing and Customizing Web Server Publishing Rules 391 FIGURE Examining the Traffic tab on an ISA web publishing rule. Maximum ULR Length Maximum Query Length Verify Normalization Block High Bit Characters Block Responses Containing Windows Executable Content Customizing Allowed Methods In addition to these options the filter definitions also enable specific HTTP methods such as GET and POST to be allowed in the particular rule. If specific HTTP methods are restricted a web server can be made even more secure because many of the exploits take advantage of little-used HTTP methods to gain control of a system. To restrict by a specific HTTP method perform the following steps while in the Methods tab 1. Under Specify the Action Taken for HTTP Methods use the drop-down box to specify to Allow Only Specific Methods. 2. Click the Add button. 392 CHAPTER 14 Securing Web HTTP Traffic 3. Enter a name for the HTTP method that will be allowed. For example enter GET the method is case-sensitive and click OK. 4. From the dialog box shown in Figure click OK to save the changes. FIGURE Customizing HTTP methods. Customizing Extensions The Extensions tab of the Filtering Rules setting allows only specific types of message attachments to be displayed such as .mpg files .exe files or any other ones defined in this rule. It also allows for the reverse where all attachments except for specific defined ones are. To accomplish this choose the option Block Specified Extensions Allow All Others . For additional security the box on this page can be checked to block ambiguous or ill-defined extensions which can pose a security risk to an ISA server. Blocking Headers Specific HTTP headers can be blocked on the Headers tab of the filtering options. This allows for HTTP Request headers or Response headers to be blocked which can be useful in denying certain types of HTTP headers such as User-Agent or Server which define what type of HTTP traffic is being used. Restricting .
