Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have FrontPage Extensions installed on my Server 2008 box. I'm also using Plesk to manage the domain hosting we are doing there. In an effort to get some third party CGI scripts working I modified some permissions on the files in the httpdocs directory for a domain, call it abc.com.

Now, when I open abc.com in Expression Web using the "open website" option I am not prompted for a password and can edit the files on the server. (This domain isn't live yet, so it's a a bad problem, but not a critical emergency yet) Other domains on the server do not have this problem and require an appropriate passwword so I belive it's a problem limited to this one domain and not a server wide configuration issue.

In the FrontPage admin screen for this domain I've checked that the anonymous user has only "browser" access, and the browser role has only rights to view files. I have also tried the Repair options on the "check server health" screen of the FrontPage admin pannel, but that didn't change anything.

I know that I can fix this by deleting the domain and recreating it throught the Plesk pannel or through the IIS control pannel, but I would rather not have to reconfigure the site from scratch if I can avoid it.

Any ideas of what else to check on so I can close this huge security hole?

share|improve this question
    
My advice is abandon FPSE. They're no longer supported by Microsoft (albeit a third party has taken over maintenance of the code and they're now charging for FPSE - rtr.com/fpse/Win2008R2). The security model FPSE uses to secure folders is shockingly fragile and the slightest slip when configuring will leave your site wide open to all and sundry. As a web hoster we're glad to see the back of the blasted thing :) –  Kev Dec 11 '11 at 23:30
    
@Kev, I feel the same way! If it were up to me I wouldn't use them, but I'm doing this on contract and this is a requirement that the client has. I'm going to work with them to move away from FPSE over time, but for now we have to get things up and running as is. I was able to to fix the security issue by recreating the vhost and adding the extensions back to it. –  Al Crowley Dec 13 '11 at 0:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.