1

I am unable to upload files to website hosted under IIS7. I have already given write permissions to "IUSR_websitename" and set the property in web.config also.

I am able to upload files with out log in to application at the time of user registration. But once log in to application, if I upload files, it is giving "Access denied" error.

Please help me.

2
  • I have just set the <identity impersonate="true" /> in web.config.
    – krish
    Aug 8, 2009 at 18:40
  • IUSR_ServerName you mean?
    – Sev
    Aug 8, 2009 at 18:50

2 Answers 2

3

It's your app pool identity user that is used for most things on disk. That's Network Service by default. Grant Network Service write permissions to your website path, or change the identity and grant the new user permissions if you want to lock the server down further.

In IIS7, as long as you have 1 site per app pool, in {Site} -> Authentication -> Anonymous, I recommend changing that to use the worker process identity. Then you don't need to worry about the IUSR account anymore.

0

The logged-in user is being impersonated, so that identity will be the one doing the file creation and writing. The ISR_xxx account is being used when anonymous, so that is why that upload is successful.

I'd recommend creating a "File Uploaders" security group and then adding all users that are allowed to upload into it. Give that group create and write permissions to the upload directory and any existing files. And the Creator/Owner may need to have Change/Delete too.

The IUSR_xxx account (or the IUSRS group) may need Read on all uploaded files if they're going to be served to anonymous users.

1
  • I'd like to add that it is an extremely bad idea (security wise) to give anonymous web users (IUSR_MachineName) write access to anything on the web server. There is no need to hack your site if you leave your keys dangling from the doorknob.
    – JohnFx
    Aug 9, 2009 at 6:55

You must log in to answer this question.