Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an asp.net web application that runs as a Content Management system for a website.

It was originally on an IIS6 Server. However the web application was recently moved to an II7 Server. After the move, my CMS System no longer worked as I received an error message:

Access to the path 'C:\inetpub\SITEFOLDER\FILENAME' is denied.

Every time I save a page in my CMS system I need to write to an aspx file on the server as well as update the web.sitemap file on the server.

I compared the file permissions between the two servers and noticed that the old IIS6 server had Write/Modify permissions on the inetpub folder for the "Network Services" user that carried down to all the site files on the server.

The new server does not have "Network Services" with Write/Modify permissions set on the inetpub folder. Which is obviously the reason why my CMS system isn't working on the new server.

The solution is, of course, to set the Write/Modify permissions on the Inetpub folder on the new server so that ASP.NET has the proper permissions to write and modify any file within the site.

My question is, is this an exceptionable solution on a production web server. Are there any security holes I am opening up by allowing Network Services to have Write/Modify permissions on the inetpub folder? I know giving the IUSER write/modify permissions on the entire inetpub folder can lead to security issues and you have to be careful what files are given write permissions for the IUSER, I just didn't know if the same rule applied to the "Network Services" user.

share|improve this question

1 Answer 1

by default in IIS 7.5, the applicationpoolidentity (aka i_AppPoolName) is used. I would NOT grant write perms and only grant on the folder(s) needed to support your app. Network service was the default account in IIS 6 and wasn't the best account. MS made a change in 7.x.

'note the default app pool name should be changed to whatever you have. ICACLS C:\inetpub\wwwroot /grant "IIS AppPool\DefaultAppPool":(M)

You can do this from the GUI in r2/iis 7.5

The other option is to grant the IIS_IUSRS group modify, the app pool command line above is the most secure. I just wouldn't grant modify on all folders. Personally, I use the IIS_IUSRS perms architecture as my servers are not shared hosting servers.

share|improve this answer
    
Is "Network Service" user okay to use if I'm on a dedicated server? Also another strange issue, any files uploaded on the website using the ASP Uploader control will show the file as having Write access on the Network Services user automatically. Also if I use File.Copy (C# Code) the file that is copied automatically has Write/Modify permissions for the "Network Service" user as well, even though the file it was copied from did not have any network service permissions. –  matwonk May 11 '13 at 17:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.