Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am installing the latest version of PHP onto IIS 7.5 via FastCGI, and all of the instructions say that FastCGI should impersonate the calling client by setting

 fastcgi.impersonate = 1

If my website will have this configuration

  • dedicated application pool
  • application pool identity of ApplicationPoolIdentity
  • anonymous authentication only (as IUSR)

why do I want to impersonate?

I come from an ASP.NET background, where the IUSR gets read-only permissions and the application pool identity gets any write permissions. Giving write access to the IUSR usually opens the door for WebDAV vulnerabilities. So I hesitate to let PHP run as the IUSR.

I can't find many people asking this question (1 | 2) so I think I must be missing something. Can someone clarify this for me?

share|improve this question

2 Answers 2

up vote 9 down vote accepted

13 months later, I wanted to revisit my own question. In that time I have transferred a half dozen websites from IIS 6 to IIS 7.5 and configured them with my preferred method. All I can say is that the websites work, they haven't had any security issues (not that these are popular sites), and in my opinion the setup is more secure than what learn.iis.net recommends.

For posterity, here are the relevant settings. In the PHP INI:

cgi.force_redirect = 0
cgi.fix_pathinfo=1
fastcgi.impersonate = 0

In IIS:

  • Application Pool > Identity > ApplicationPoolIdentity
  • Website > Authentication > Anonymous Authentication > Specific User: IUSR

The NTFS permissions and where to apply them:

  • IUSR - Grant Read, Deny Write
    • The root directory of the IIS website. For example, in a Zend Framework project this would be the /public directory.
    • If your application uploads files and saves them in a public directory, you need to apply this permission to the temporary upload directory. This is because move_uploaded_file will preserve the permissions of the upload directory. This is the biggest drawback of this permissions setup that I've found.
  • ApplicationPoolIdentity (IISAPPPOOL\YourApplicationPoolName) - Grant Read & List
    • The root of your PHP application. For example, in a Zend Framework project this would be the entire project.
    • Any external libraries (Zend, Doctrine, etc.) included by your application that are not in the application folder.
  • ApplicationPoolIdentity - Grant Modify
    • Any location where your application will write such as upload_tmp_dir, session.save_path, and error_log.
    • Sometimes I need to add this permission to the root of the PHP application in my development environment to support things like Doctrine's auto-generation of proxies.
  • ApplicationPoolIdentity - Grant List
    • If your application is in a virtual directory, you will need to add this permission to the root of the website. This allows your application to read its parent web.config. For example, if your application root is http://example.com/MyPHPApp, set this permission on the example.com web directory. Specifically you only need to apply to "This folder and files", "within this container only".

I hope this helps anyone else who decides that the learn.iis.net instructions are not ideal.

share|improve this answer
    
Thanks a lot for this! Added a batch script to automate. Works fine for my installation. –  Sire Feb 26 '13 at 10:03
    
You should enable impersanation and set Authentication > Anonymous Access > Edit to Application Pool Identity. Then only set file system permissions using IIS APPPOOL\<Application Pool Name>. –  Locutus Sep 2 '13 at 12:07
    
@Kurian Yes, that approach is simpler and per the learn.iis.net instructions. Does it offer any other benefits? I chose the system outlined above because it separates the application's permissions from the web user's permissions. –  AKeller Sep 2 '13 at 15:48
    
It prevents multiple applications from accessing each other's data. Without ApplicationPoolIdentity if one application is hacked, it can be used to hack other applications on that server. Secondly it allows you to treat FastCGI the same was as ASP.NET as far as permissions are concerned. –  Locutus Sep 3 '13 at 2:38
    
I agree with the first part. ApplicationPoolIdentity is great for sandboxing applications which is why I also use it above. To your second point, I guess we manage our ASP.NET sites differently. When I setup an ASP.NET site, I use IUSR for the anonymous user and ApplicationPoolIdentity for the application pool, and the permissions look very similar as what I outlined above. –  AKeller Sep 3 '13 at 11:19

See: http://www.php.net/manual/en/install.windows.iis6.php

Impersonation and file system access

It is recommended to enable FastCGI impersonation in PHP when using IIS. This is controlled by the fastcgi.impersonate directive in php.ini file. When impersonation is enabled, PHP will perform all the file system operations on behalf of the user account that has been determinedby IIS authentication.

Per documentation, it simply permits fastcgi to act on behalf of the client using all same permissions (in your case to be what looks like the IUSR account). In other words, to perform all actions normally allowed to the client's (or anon's) own credentials. No more, no less. Without this set, I imagine poor fastcgi would be left crippled.

share|improve this answer
    
That being the case in his situation it'd be accessing based on the guest account or something. –  Matt Jun 23 '11 at 4:42
    
Thanks for your answers Matt and Bob! I was starting to think no one would take a stab. –  AKeller Jun 23 '11 at 20:20
1  
When PHP is run without impersonation, it runs as the application pool identity. This lets me give read-only rights to the anon user and give write access to the app identity. So PHP is not helpless without impersonation. I created a test that might clarify. IUSR (anon): granted read, denied write. app identity: granted read/write. With impersonation off, I can still write files via code. With impersonation on, I can't. But I don't want the IUSR to have write access. I think I will ask some questions in other forums and return here when I know more. –  AKeller Jun 23 '11 at 20:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.