Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

So, heres my scenario:

  • Dedicated server running Windows 2008 R2
  • IIS 7.5
  • Multiple sites using PHP / .NET 4 / Perl / Python

Need to do:

  • Ensure that the sites are not able to write/create/read files unless expressly given permission to do so.
  • Have ability to expressly make directories/files writable by Application Pool identities.
  • Have ability to expressly allow websites (apps) to be able to create and write to files given the right permission.

How should I go about this?

What I had done in my last iteration/attempt:

  • Created individual local user accounts for each App Pool / Website
  • Setup each website to use the app pool identity and gave write permission when required

What was lacking:

  • The apps could create files without me having to give that permission.
  • The apps could read files in other apps because of the implicit read permission.
share|improve this question
    
Is this for one (or two) servers, or a larger number? What kind of access (remote desktop, just ship an msi, something in-between)? –  Richard Dec 12 '11 at 8:25
    
Are all of the websites in the \inetpub\wwwroot directory or are you creating them in a directory tree outside of the \inetpub path? –  Top__Hat Dec 12 '11 at 16:35
    
Its for a single server. Remote desktop to be used for configuration. –  KiD0M4N Dec 15 '11 at 9:22
    
@Top__Hat This is something I am undecided about? Which is the recommended approach? –  KiD0M4N Dec 15 '11 at 9:22
    
My personal preference is to move the websites out of wwwroot unless they are part of the default website and use the default settings. Moving them to a separate directory and configuring the AppPool under a non-default account gives you lots of control. –  Top__Hat Dec 19 '11 at 15:48

1 Answer 1

You can address each of these two items by removing NTFS permission inheritance on the folders containing the websites. If they're all separated into individual folders.

The apps could create files without me having to give that permission.

This issue goes away if you remove inheritance. If it doesn't, you may need to be more specific about what permissions you're allowing. Make sure you're looking at actual NTFS permissions, not just read/write/etc. You should see options for "Create Folders/Append Data", etc.

The apps could read files in other apps because of the implicit read permission.

You're using separate accounts for each app pool, right? Again, I don't see why this wouldn't work. Remember also that you have the ability to deny certain permissions as well, but you really shouldn't have to do that if you've got an ACL that's not inherited from above.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.