Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to setup a website that can't execute any server side code (asp, asp.net, etc.).

I've tried using an application pool that has "No Managed Code" as the .NET Framework version, but classic asp code still executes.

I tried removing all ISAPI Filters but that didn't help.

Removing the ".asp" Handler Mapping worked. Should I remove all *.[ext] handlers to lock it down further?

I still need to run code on some sites, but I'd like to be able to offer vanilla web hosting on sites as needed.

share|improve this question

2 Answers 2

You can select which features of IIS are installed and available in the server; if you remove all application development features, the web server will not process any server-side code.

http://technet.microsoft.com/en-us/library/cc753473.aspx

share|improve this answer
    
He says he needs to allow code on some sites but not others. This won't work in that scenario. –  Chris McKeown Feb 14 at 0:41
up vote 0 down vote accepted

After some more tinkering, I think I figured it out.

IIS Manager > [My Site] > Handler Mappings > Edit Feature Permissions > uncheck "Script"

This disables most of the handlers, which prevents classic asp & asp.net files from running, but still serves up html.

Not sure if this is the correct way, but it appears to work.

share|improve this answer
    
Darn, now I have a new problem. This setting adds web.config to the folder. I want to provide FTP access but not allow them to update the web.config file. –  William Jens Feb 14 at 19:04
    
Almost EVERY site-level or folder-level setting in (recent) IIS is stored in a web.config file; that's just the way it works. –  Massimo Feb 17 at 21:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.