DIY之Windows网站服务器安全快捷管理【未完结】

前言

那是10年前，我还在一高校的信息中心就职，学校里网站有很多，Web服务基本都基于Windows IIS，个别PHP的战点也直接搭在IIS上，毕竟性能啥的也不是很高要求，能访问就好，每台Web服务器上都挂了好几十个网站。为了安全、便捷管理这些网站应用，从服务器安全配置到网站管理，整理出一下方案。虽然是差不多10年前的思路了，目前也主要用Linux系统，但是毕竟是花了好多脑细胞整出来的，值得记录和分享。

Windows 2008 环境配置

1. 服务器版本
   
   注：所有操作都基于Windows 2008，不支持Windows 2003。
2. 安全配置

IIS建站思路

关于FTP服务器

IIS站点管理脚本

新建站点

脚本文件：newsite.bat

@echo off
SetLocal EnableDelayedExpansion
Set Alpha1=abcdefghijklmnopqrstuvwxyz
Set Alpha2=ABCDEFGHIJKLMNOPQRSTUVWXYZ
Set Number=0123456789
REM d,l,u is a flag to make sure the generated password contains number, lowcase and upcase.
Set d=0
Set l=0
set u=0

:WHILE
if "%d%%l%%u%" == "111" GoTo :WEND
Set PSWRD=
For /L %%j in (1,1,8) Do Call :PSW
GoTo :WHILE
:WEND
REM ================================================
REM begin to creat a new site
set SITE=Simon和Shakie的博客
set DOMAIN_NAME=simsha.domain.com
set NAME=%DOMAIN_NAME:.domain.com=%
set USER_COMMENT=柯名昊
set PASSWORD=%PSWRD%
mkdir d:\%NAME%
net user %NAME% "%PASSWORD%" /ADD /active:yes /comment:"%USER_COMMENT%" /fullname:"%SITE%" /passwordchg:no /expires:never
net localgroup users %NAME% /delete
net localgroup ftpusers %NAME% /add
net localgroup vhost %NAME% /add
icacls d:\%NAME% /t /grant %NAME%:(OI)(CI)F
c:\windows\system32\inetsrv\appcmd add apppool /name:"%SITE%" -processModel.identityType:SpecificUser -processModel.userName:%NAME% -processModel.password:"%PASSWORD%"
c:\windows\system32\inetsrv\appcmd add site /name:"%SITE%" /bindings:http/*:80:%DOMAIN_NAME%,ftp/*:21:%DOMAIN_NAME% /physicalpath:"d:\%NAME%" /serverautostart:true -applicationDefaults.path:"/" -applicationDefaults.applicationPool:"%SITE%" -virtualDirectoryDefaults.path:"/" -virtualDirectoryDefaults.physicalPath:"D:\%NAME%" -virtualDirectoryDefaults.userName:%NAME% -virtualDirectoryDefaults.password:"%PASSWORD%" -ftpServer.serverAutoStart:true -ftpServer.allowUTF8:true -ftpServer.security.ssl.controlChannelPolicy:"SslAllow" -ftpServer.security.ssl.dataChannelPolicy:"SslAllow" -ftpServer.security.authentication.basicAuthentication.enabled:true
c:\windows\system32\inetsrv\appcmd set config "%SITE%" -section:system.ftpServer/security/authorization /+"[accessType='Allow',roles='%NAME%',permissions='Read, Write']" /commit:apphost

echo 网站"%SITE%"配置完毕，密码为 [%PSWRD%]
EndLocal
GoTo :EOF

:PSW
set /a choice = %random%
set /a choice = %choice% - (%choice%/3*3)
If !choice! gtr 3 Set choice=3
If "%choice%" NEQ "2" Goto :ALPHA
Set d=1
set /a i = %random%
set /a i = %i% - (%i%/10*10)
If !i! gtr 9 Set choice=9
set PSWRD=%PSWRD%!Number:~%i%,1!
GoTo :EOF

:ALPHA
If "%choice%" NEQ "0" Goto :UPPERALPHA
Set l=1
set /a i = %random%
set /a i = %i% - (%i%/26*26)
If !i! gtr 25 Set i=25
Set PSWRD=%PSWRD%!Alpha1:~%i%,1!
GoTo :EOF

:UPPERALPHA
Set u=1
set /a i = %random%
set /a i = %i% - (%i%/26*26)
If !i! gtr 25 Set i=25
Set PSWRD=%PSWRD%!Alpha2:~%i%,1!
GoTo :EOF

修改站点密码

脚本文件：changepwd.bat

@echo off
SetLocal EnableDelayedExpansion

set SITE=Simon和Shakie的博客
set DOMAIN_NAME=simsha.domain.com
set NAME=%DOMAIN_NAME:.domain.com=%

Set Alpha1=abcdefghijklmnopqrstuvwxyz
Set Alpha2=ABCDEFGHIJKLMNOPQRSTUVWXYZ
Set Number=0123456789
REM d,l,u is a flag to make sure the generated password contains number, lowcase and upcase.
Set d=0
Set l=0
set u=0

:WHILE
if "%d%%l%%u%" == "111" GoTo :WEND
Set PSWRD=
For /L %%j in (1,1,8) Do Call :PSW
GoTo :WHILE
:WEND
net user %NAME% %PSWRD%
c:\windows\system32\inetsrv\appcmd set apppool "%SITE%" -processModel.password:"%PSWRD%"
c:\windows\system32\inetsrv\appcmd set site "%SITE%" -virtualDirectoryDefaults.password:"%PSWRD%"
REM c:\windows\system32\inetsrv\appcmd stop apppool "%SITE%"
REM c:\windows\system32\inetsrv\appcmd start apppool "%SITE%"
REM c:\windows\system32\inetsrv\appcmd stop site "%SITE%"
REM c:\windows\system32\inetsrv\appcmd start site "%SITE%"
echo The new password for "%SITE%" is [%12345%]
EndLocal
GoTo :EOF

:PSW
set /a choice = %random%
set /a choice = %choice% - (%choice%/3*3)
If !choice! gtr 3 Set choice=3
If "%choice%" NEQ "2" Goto :ALPHA
Set d=1
set /a i = %random%
set /a i = %i% - (%i%/10*10)
If !i! gtr 9 Set choice=9
set PSWRD=%PSWRD%!Number:~%i%,1!
GoTo :EOF

:ALPHA
If "%choice%" NEQ "0" Goto :UPPERALPHA
Set l=1
set /a i = %random%
set /a i = %i% - (%i%/26*26)
If !i! gtr 25 Set i=25
Set PSWRD=%PSWRD%!Alpha1:~%i%,1!
GoTo :EOF

:UPPERALPHA
Set u=1
set /a i = %random%
set /a i = %i% - (%i%/26*26)
If !i! gtr 25 Set i=25
Set PSWRD=%PSWRD%!Alpha2:~%i%,1!
GoTo :EOF

删除站点脚本

脚本文件：dropsite.bat

@echo off
set SITE=Simon和Shakie的博客
set DOMAIN_NAME=simsha.domain.com
set NAME=%DOMAIN_NAME:.domain.com=%
c:\windows\system32\inetsrv\appcmd delete site "%SITE%"
c:\windows\system32\inetsrv\appcmd delete apppool "%SITE%"
net user %NAME% /delete
rmdir /s /q d:\%NAME%

结束语