Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to lock down the web.config file as much as possible, so that as few accounts as necessary can read the file. I saw the list here http://msdn.microsoft.com/en-us/library/ms178699.aspx but allowing the Users group read permission on the web.config file seems excessive. Thanks.

share|improve this question
    
Lock it down from whom? Internal users, local access on the machine, internet users? –  GregD Sep 23 '09 at 22:30

2 Answers 2

The Users group would of course apply to the local machine. What are you worried about them reading in the web.config? If it's your connection strings, you can encrypt those.

share|improve this answer

You do have to worry about users reading web.config files. Especially, if you are allowing users access to your file system.

I've tried removing user permissions to the web.config and allowing only the anonymous IIS account and the IIS app pool process account access to the file, and the application still works.

Encrypting the files on top of that will probably help even more, as well. If anyone has an official solution on this, please let us know.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.