0

I'm interested in setting up a full-blown local user to run my ASP.NET web sites under in IIS 7.5 (Windows Server 2008 R2).

(The long and boring rationale has to do with System.IO.Packaging's use of Isolated Storage. Running the offending code under another AppDomain using MarshalByRef or serialization isn't really an option.)

I've always used the user defaults for IIS (AppPoolIdentity, Network Service, IUSR, etc.), so I'm looking for advice in how to properly set up a regular user for IIS.

What pitfalls should I look out for, especially around permissions and security?

1 Answer 1

1

In IIS7.5, When you create a separate Application Pool for your website a separate User is created automatically. It means different websites have completely different users, so I'm wondering why you may need to assign a regular user? I don't think if it's possible because of many security risks. A regular user has lots of permissions in system and as a result, attacker can do many system calls through your website.

2
  • The question already states why this is needed. This isn't a hosting farm. I was able to easily switch my app pool to the new user, I'm just looking to be sure the default user permissions aren't a problem. Obviously, this user doesn't have remote login privileges or access to unnecessary files. Oct 24, 2012 at 19:48
  • I think they don't recommend this because by the way it gives more power to hackers (at least regular user can read HDD) and if there is a security issue in IIS or Windows, hacker can do system calls through port 80, although user doesn't have remote login privilege.
    – Mehdi
    Oct 24, 2012 at 20:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .