Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some security concerns about my IIS websites.
From PHP-files (FastCGI) on our server the scripts are able to read my system's root directory (c:\), but even list the content of c:\windows. What is more troublesome that I can even create directories in the root like this: mkdir('c:\asdasd');, and it works without any problems; I can even read the other websites' directories (so actually maybe I could map the whole system's directory tree from a PHP script). I think that's a huge security problem. Noone should be able to read or write c:\, or other hosted website's content.

I know there's the open_basedir directive in PHP, but I think setting this directive doesn't solve the problem as I could also use any other server languages to access the same mentioned directories.

The directory tree of my websites look like this:

   |- website1
      |- other
      |- htdocs
   |- website2
      |- other
      |- htdocs
   |- website3
      |- other
      |- htdocs
   |- ...

The websites' source files are in the htdocs directory, so this is the "root" directory of these websites.
I just want to enable read/write permissions to the first parent directory of the website, like for example c:\net\web\php\website1 (so e.g. "c:\net\web\php\website1\other" could be written, but c:\net\web\php\ should not be).

How can I restrict the access this way?


share|improve this question
up vote 0 down vote accepted

Run the programs concerned under a very restricted account - one that does not have write or execute permissions outside your web content location.

share|improve this answer
OK, thanks, but should I create different user accounts for every AppPools? I want to restrict every websites to their own root and first parent directory, not to be able to read each other's content. Is creating different user accounts for each websites the only solution? And how would I set an app. pool to "be logged in" as a given account? Thanks! – Sk8erPeter Dec 5 '11 at 10:27
You can run an appool under the credentials you specify; if each web site needs to be isolated from every other, then different accounts is indeed the only way. – adaptr Dec 5 '11 at 10:54
Thanks, and sorry for the late feedback! – Sk8erPeter Dec 1 '12 at 22:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.