Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a departmental web server running Server 2003, IIS 6, and SQL Server Express. IIS is configured for Windows Authentication only and all the App Pools are configured to use the Network Service account. We run several ASP.NET apps, most of which access SQL Server DBs. In the web.config (or other places) within those apps, we have the required connection strings to access the DBs.

I recently realized that anyone could browse the share holding the web server files ("Authenticated Users" have Read permission), as it's underneath another directory on the server that's shared for various reasons.

I tried to remove that "world-read" access permission, but then users could no longer run the apps (they couldn't read the fileshare, which was the intended behavior, but this prevented them from running the apps too). I could still run the apps, as I'm part of the admin group that still had Full Control over the apps folder.

My question (finally) is: what combination of Windows permissions and IIS settings could I use in order to meet these needs:

  1. We need to know which users are using the app, and to determine what roles/permissions the current user has in each app.
  2. We need/desire to keep the DB connection strings in the web.config or other app files (too much work to move all them somewhere else).
  3. We need to prevent users from browsing the fileshare and reading things like connection strings inside the apps. (We'd like to NOT have to move the apps to a new share!)

I've been struggling with this for a while, and would appreciate any suggestions!

share|improve this question

1 Answer 1

up vote 0 down vote accepted

You need to move those files out from the share. That's the only way. Anything else will either break Windows Auth or will allow those files to be readable on the share. IIS and SMB both evaluate the same NTFS permissions, so there's no way to have them apply to one without having them apply to the other.

share|improve this answer
    
Thanks, I did this. I'm still not sure it's the only way, though. I made a new folder, stored away from this public share. But, I forgot to give Authenticated Users read access to the new folder, and IIS was still able to serve up all the content just fine. The only difference was the new folder granted permission to the "System" group (the original folder did not). Could the System group have give IIS the ability to read the folder, while still running the apps under the identity of the logged in user? –  jimtut Jun 10 '11 at 16:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.