0

How do I ensure website isolation in a shared environment on IIS 7 ?

basically I host multiple websites and I do not want one getting hacked, ending up in all getting hacked.

anyways I can ensure this?

2 Answers 2

1

Web site isolation in a shared hosting environment is consistent with all general security isolation recommendations for Internet Information Services 7 (IIS7). In particular, it is recommended to:

  • Use one application pool per Web site.
  • Use a dedicated user account as an identity for the application pool.
  • Configure anonymous user identity to use the application pool identity.
  • Ensure that FastCGI impersonation is enabled in the Php.ini file.
0

This article talks about setting up isolated application pools, which will do what you want. The best way to protect multiple websites is to run each website under a different identity with the lowest required privileges (IE: same privileges as the Network Service account). That way you can use standard file permissions and group policy to restrict access for each user individually. Many hosting control panels such as Plesk and cPanel will use this sort of permissions model to make sure the system is secure.

You must log in to answer this question.