So, heres my scenario:
- Dedicated server running Windows 2008 R2
- IIS 7.5
- Multiple sites using PHP / .NET 4 / Perl / Python
Need to do:
- Ensure that the sites are not able to write/create/read files unless expressly given permission to do so.
- Have ability to expressly make directories/files writable by Application Pool identities.
- Have ability to expressly allow websites (apps) to be able to create and write to files given the right permission.
How should I go about this?
What I had done in my last iteration/attempt:
- Created individual local user accounts for each App Pool / Website
- Setup each website to use the app pool identity and gave write permission when required
What was lacking:
- The apps could create files without me having to give that permission.
- The apps could read files in other apps because of the implicit read permission.