We keep getting hit with moderate security risks on our internal and external penetration tests on our SSRS servers. The main reason for this is that the scanner is attempting to use http(s)://reports.whatever.com.
As far as I could tell in my investigation of SSRS' webservices, this 'base url' is never used. It's only the Web Service URL and the Web Portal URL.
It also appears that in this configuration of SSRS, the webserver being used is the internal http.sys webserver, not IIS. Is it possible to disable this base listener so that only the web service URL and web portal URL send responds to a client?
I have experimented with removing some of the urlacl's in netsh http show urlacl, but to no avail.
