Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I ensure website isolation in a shared environment on IIS 7 ?

basically I host multiple websites and I do not want one getting hacked, ending up in all getting hacked.

anyways I can ensure this?

share|improve this question
add comment

2 Answers

Web site isolation in a shared hosting environment is consistent with all general security isolation recommendations for Internet Information Services 7 (IIS7). In particular, it is recommended to:

  • Use one application pool per Web site.
  • Use a dedicated user account as an identity for the application pool.
  • Configure anonymous user identity to use the application pool identity.
  • Ensure that FastCGI impersonation is enabled in the Php.ini file.
share|improve this answer
add comment

This article talks about setting up isolated application pools, which will do what you want. The best way to protect multiple websites is to run each website under a different identity with the lowest required privileges (IE: same privileges as the Network Service account). That way you can use standard file permissions and group policy to restrict access for each user individually. Many hosting control panels such as Plesk and cPanel will use this sort of permissions model to make sure the system is secure.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.