0
votes
0answers
11 views

How to create a very low-level Application Pool account?

I want to create a very low-level application pool account which only allows to run some code, specifically RazorEngine. I don't want user can read/write files and use some dangerious code to down the ...
0
votes
1answer
54 views

Grant NON-administrator privileges to IIS 7

We are implementing a pseudo-Platform as a Service environment. It's a fairly simple set up that parallels Infrastructure as a Service: basically our clients will each have a access to their own ...
3
votes
1answer
39 views

What SPNs are needed for an intranet web service that reads remote registries

Imagine a website that shows the value of a remote registry key, live, such as the version of the anti-virus definitions on a remote PC. To be clear, there are 3 computers involved, the web server ...
0
votes
1answer
43 views

Blocking Access to Certain Sites

I have a weird setup on a server we host: the site hosts both live and test versions of its sites, set up in two different folders, D:\Live Sites, and D:\Test Sites. What would be the best way to ...
16
votes
5answers
958 views

What are the “to-do” on protecting Windows server facing the web?

I currently begin to deploy Windows servers facing the web. And I would like to know what are you way of protecting your servers ? What softwares are you using ? On Linux, i'm using Fail2ban to ...
0
votes
1answer
69 views

How should I set up a new local user for IIS to run under?

I'm interested in setting up a full-blown local user to run my ASP.NET web sites under in IIS 7.5 (Windows Server 2008 R2). (The long and boring rationale has to do with System.IO.Packaging's use of ...
1
vote
1answer
289 views

Security issues/risks connecting from IIS7.5 to SQL Server 2008+ using Machine Account (DOMAIN\MACHINENAME$)

I'm working with a group of engineers doing .NET 4 / MVC 3 development, using Windows 7 Enterprise and IIS 7.5 locally, and connecting to MSSQL 2008+ dev/testing databases. The databases are remote ...
5
votes
1answer
7k views

IIS 7 What does Physical path credentials logon type mean?

I am trying to understand an aspect of IIS security that I can't figure out. I have an internal (not on the internet) application that runs under IIS. This specific application has an app pool ...
13
votes
2answers
19k views

Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5?

I know that there are thousands of reports of people having trouble getting Integrated Windows Authentication to work with IIS, but they all seem to lead to web pages that don't apply or solutions ...
0
votes
1answer
359 views

How to configure IIS 7.5 to host multiple websites with the correct F/S permissions

So, heres my scenario: Dedicated server running Windows 2008 R2 IIS 7.5 Multiple sites using PHP / .NET 4 / Perl / Python Need to do: Ensure that the sites are not able to write/create/read ...
1
vote
2answers
310 views

Is it possible to setup each IIS7.5 website with a different user account?

I'm running a server with 60+ sites on it. Right now all those sites are running under the IUSR account. Looking at the folder security the IIS_IUSRS group has access to all the site's folders. This ...
3
votes
3answers
5k views

DOS attack “slow post” : How to prevent in IIS

I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability. Have tried reducing the httpruntime ...
1
vote
2answers
74 views

Basic IIS7 permissions question

We have a website, with a file: www.example.com/apis/httpapi.asp This file is used by the site internally to make requests joining two systems on the website together (one is Classic ASP, the other ...
0
votes
1answer
3k views

authorization: application pool identity cannot access path

I have two very similar ASP Classic apps that both use Windows Authentication and run on the same development PC (Windows 7/IIS 7.5). They've been around for years, and have 'travelled' with me as ...
1
vote
1answer
4k views

Anonymous Authentication <anonymousAuthentication> / 403 - Forbidden: Access is denied

I am using windows server 2008 R2 and IIS 7.5 I deployed my app to that server for the first time and I got the following error; 403 - Forbidden: Access is denied. You do not have permission ...
1
vote
2answers
806 views

Default document not working after installing SP1 on Windows 2008 R2 x64

We have a web site that should only be available for authorized users. So we deny anonymous access for the site. However we do allow anonymous access to the default page and the login page. When we ...
1
vote
1answer
46 views

Securing access to a website on IIS

I've got a website running on IIS7.5. I want to ask for credentials (fixed user/password) on access to the website. I don't need to do anything with those credentials - just to make sure the user ...
0
votes
2answers
253 views

Best solution for development IIS to reach files via UNC share

What is the best way to configure security with IIS to allow developers local IIS instances reach a UNC share for documents that are in our deployed website but not a part of the development source?
0
votes
2answers
686 views

win2008 r2 IIS7.5 - setting up a custom user for an application pool, and trust issues

Scenario: blank win2008 r2 install the goal was to have a couple of sites running with isolated pool and dedicated users A new folder for a new website - c:\web\siteA\wwwroot, with the app (asp.net) ...
1
vote
3answers
878 views

Why is it good to have website content files on a separate drive other than system (OS) drive?

I am wondering what benefits will give me to move all website content files from the default inetpub directory (C:) to something like D:\wwwroot. By default IIS creates separate application pool for ...