4

After a security review, I'm splitting the tiers of a Windows 2008 Server application that is currently on a single machine in the corporate domain. I want to move the IIS 7 Web UI to a new machine in the domain so users can authenticate against it using their AD accounts and leave the rest (the application tier and database server) on the current machine but moved off the domain behind a firewall.

The app tier services need to create files on various shares on domain servers. Previously the services ran as a special domain user with access to the shares. Now that won't be possible.

Is there a way of allowing access to shared folders (and resources generally) on domain servers to non-domain users/machines?

4 Answers 4

1

You can grant access to a domain resource (i.e share) to a non-domain machine... provided the service on that machine accesses the share using as remote credentials either :

  • domain user credentials OR
  • a local user's (on the domain machine) credentials

The second one is the safest way to do it (a remote attacker sitting on the app tier machine won't have access to a domain account (with access to the entire domain) but only to the domain machines it has a local account on.

BUT you won't be able to simply set such a user to run the app service under. You must have some support in your application to specify different credentials according to which server it is connecting to.

So if this is supported => say your app tier machine APPTIER is in the MSHOME workgroup and your shares are \\SERVER1\share1 and \\SERVER2\share2 in the MYDOMAIN domain :

  1. Create a local account apptieracct on SERVER1 with access to share1
  2. Create a local account apptieracct on SERVER2 with access to share2
  3. On APPTIER, configure the application to use SERVER1\aptieracct to access \\SERVER1\share1 and SERVER2\aptieracct to access \\SERVER2\share2
1
  • I agree this is is probably the best way but my app services don't support impersonation at present. I think I'm going to resort to separating the database off instead and leaving the app server in the domain. Thanks for the help!
    – Chris
    Apr 13, 2011 at 15:44
1

Someone has a similar question answered here

How can an unauthenticated user access a windows share?

The following is a cut/paste of the answer given

To do what you want you'll have to enable the "Guest" account on the computer hosting the files and then grant the "Everyone" group whatever access you want.

"Guest" is a user account, but its enabled / disabled status is interpreted by the operating system as a boolean "Allow unauthenticated users to connect?" Permissions still control the access to files, but you open things up a LOT by enabling Guest.

Don't do this on a domain controller computer, BTW, because you'll be Guest on all DCs...

1
  • Thanks for the answer Phil but that's not an option - the computers hosting the files need pretty severe access control too. I was hoping there was a way of doing it by SID or some devious magic I didn't know about!
    – Chris
    Apr 12, 2011 at 15:48
0

Adding to Phil's answer and Chris' comment that enabling the Guest account is not an option (which I second - Guest should never be enabled), I must say: no, there is no way to achieve the desired result with Microsoft Windows alone.

It might be possible to build a solution with third-party products, though. Consider the following rough idea:

Set up a SSH tunnel endpoint on a domain member. If we suppose the SSH server allows logons with username and password it can pass through that information to a DC - and voilà you can connect from non-domain computers and log on with username and password.

0

If you want anyone to be able to read the files add the EVERYONE entry to folder and SHARE permissions (always do both). That way anyone will be able to read the files. Of course you could have them just always authenticate as it isn't necessary for the client machine to be on the same domain or even a domain to access a share that requires authentication.

Since you need extra security on the file server enable the windows firewall and only all CIFS/SMB access from IP addresses that are "trusted".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .