Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As a learning experience I'm setting up (and trying to harden) a Windows 2008R2 web server.

My web sites are stored on a separate partition and are organized as below:

/domains
    /somedomain.com
        /logs
        /wwwroot
    /anotherdomain.com
        /logs
        /wwwroot

I've removed the default permissions for the "Users" group from the "domains" directory.

Here are the permissions for /domains

D:\Domains NT AUTHORITY\SYSTEM:(OI)(CI)F 
           BUILTIN\Administrators:(OI)(CI)F 
           CREATOR OWNER:(OI)(CI)(IO)F 

Each web site is configured with a separate application pool running under AppPoolIdentity.

I've granted modify rights to the "wwwroot" for the appropriate application pool user and read permissions for the anonymous user:

D:\domains\somedomain.com\wwwroot IIS APPPOOL\somedomain.com:(OI)(CI)C 
                                    NT AUTHORITY\IUSR:(OI)(CI)R 
                                    NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F 
                                    BUILTIN\Administrators:(OI)(CI)(ID)F 
                                    CREATOR OWNER:(OI)(CI)(IO)(ID)F 

Is there anything else that I am missing regarding the directory permissions?

share|improve this question
add comment

1 Answer

I'm doing something similar, but still differently:

  1. Why do you need Modify rights granted to wwwroot folder? Read & Execute is enough and only grant Modify when required (e.g. temp, upload, cache folders -- where content will be created/changed, for example by website app (PHP/ASP.NET etc)).

    I grant "Read & Execute" to D:\domains\somedomain.com (it is enough) and Modify to a specific folders: D:\domains\somedomain.com\var. If I have an app/script that requires Modify right on web-accessible folder (for example, LiveZilla live chat software), then I grant it there, e.g. D:\domains\somedomain.com\wwwroot\livechat\banners.

  2. I do not use IUSR user -- I'm using "Application pool identity" instead:

    • "Application user (pass-trough authentication)" on "Site | Basic Settings | Connect as"
    • and "Application pool identity" on "Site | Authentication | Anonymous Authentication"
  3. I do not have "CREATOR OWNER" at all (it was causing problems when running PHP scripts -- unable to execute them at all + something else (don't remember now), so I have removed it from the whole D:\domains). I pretty much have: SYSTEM, Admins, APP_POOL_SPECIFIC_ID, SPECIFIC_FTP_USER.

The above works fine for me on 6 servers with no issues so far (Am I lucky?).

share|improve this answer
    
1. The application requires write access, but you're right I should really just allow right access to specific directories. 2. I prefer to keep the identity of my application pool (that the web site runs under) and that of my web site visitors separate. –  Ben Aug 30 '11 at 13:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.