Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a busy celebrity stock photo website and I am trying to hide the photos behind the website root, so they can't be accessed via URL, but my ASP script can read the photo and sends it to he browser in binary. I'm using Windows Server 2008 R2.

I would like to know what security settings should be on the folder that contain the photos. My website is sitting at c:\inetpub\vhosts\mydomain\httpdocs\website.asp and the photos need to be stored on the D drive here: d:\web-library-photos\thumbs\group233\24wedfsdf232eraa.jpg.

I did manage to get this working by simply clicking 'Share' in the properties of d:\web-library-photos and then giving 'Everyone' read/write permissions but I feel I'm doing something wrong.

What should I be doing to make this folder safe, but accessible for the server administrator account and my website scripts? What 'Share' properties should I be applying? Should I be sharing?

enter image description here

share|improve this question
1  
In addition to what EA said (that you shouldn't be using sharing), you might want to change the NTFS permissions as well. Normal server users would have read access by default, and it sounds like you'd not want that in case (heaven forbid) someone managed to get unauthorized access to server itself. Basic application of "least privilege" security practices in general. –  HopelessN00b Jul 20 '12 at 16:56

1 Answer 1

Your ASP application is running locally on the server computer and can access the picture files via the local drive-letter and path "D:...". The "Sharing" functionality you're looking at is used to allow client computers to access the folder via the CIFS / SMB file sharing protocol. It's not necessary to use "Sharing" in the application you're describing.

Your ASP application runs under a security context set by IIS. By default, anonymous users execute ASP applications as the IUSR_machine-name account (an account that is created during IIS installation).

It is necessary that the NTFS access control list (ACL) for the folder / files your ASP application accesses allow the ASP application to access the files. What permission needs to be set in the ACL is determined by the security context the ASP application is running under. If the application is running as an anonymous user (i.e. the remote users aren't performing a Windows authentication) then the IUSR_machine-name user account would need to have permission granted to the folder. Stock NTFS permissions typically allow "Users / Read" and that would be sufficient for the access.

Edit:

Your screenshot is showing the ACL-- that is, the permissions granted to specific users and groups-- applied to a given folder. This is not an exhaustive list of all the user accounts that the server computer "knows about". That exhaustive list would be accessible in the "Local Users and Groups" tool in the "Computer Management" tool.

Every action performed on a Windows Server machine is performed within a "security context". Every action that an application asks the operating system to perform on behalf of a user must be attributed to a given user or the computer's operating system itself (which, for all intents and purposes, also appears to be a user with the name "SYSTEM" or "LocalSystem" and a special security identifier serial number that identifies it as this particular special user).

When a user accesses your ASP script to view an image IIS executes your script and, in turn, your script asks the operating system to read files. If the user hasn't authenticated to IIS via one of the built-in authentication mechanisms in IIS then the user's access, with respect to the operating system, is assumed to be anonymous and performed using the user account IUSR_machine-name. (Your ASP application may have an authentication component built into it, however that wouldn't influence Windows' conception of "who" the remote user is-- that can only be influenced by a classic ASP application by using the built-in authentication capabilities of IIS.)

It would be far beyond the scope of your question to give you a step-by-step explanation of how the Windows security subsystem evaluates the ACL on a file or folder to determine if a user is granted or denied access. You mention that this isn't familiar to you, so I'd recommend finding a reference that explains how NTFS permissions work. You can experiment on a Windows PC with NTFS permissions and creating local user accounts to get a feel for how it works, as well.

share|improve this answer
    
That's helpful, thanks. I have one confusion, I don't see IUSR_machine-name amongst my users. I have attached a screenshot to my question for my security properties tab. –  PaparazzoKid Jul 20 '12 at 16:35
    
You're looking at the folder's ACL and the IUSR_machine-name isn't named in that ACL. That's not a list of the users configured on the computer, however. To get that list, have a look at "Local Users and Groups" in "Computer Management". –  Evan Anderson Jul 20 '12 at 16:38
    
I appreciate your valuable time, Evan, but I'm not sure I understand that. Your English is good, I just can't get my head around permissions and groups. Think one needs to get a book on Windows permissions. –  PaparazzoKid Jul 20 '12 at 16:57
    
I dropped on an edit with a more verbose statement that expands on my prior comment. –  Evan Anderson Jul 20 '12 at 17:21
    
Yeah, I definitely need to read up about this. For now I have got it working by simply giving PSAADM and PSACIN from my permissions list (attached photo) full read/write permissions. Before this, my script threw an error "access denied" to read a photo from inside that d:\directory. Now my script reads and writes to that folder successfully, so assume I have done something right. The two users that I gave permission to seem to be something to do with Plesk. Although it's working, I still need to learn if I have done the right thing. Thanks for the edit too. –  PaparazzoKid Jul 20 '12 at 17:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.