15

i'm using IIS7 express and therefore need to unblock port 80 if I wish to hit the website locally and on the default http port. To do this, i use ..

netsh http add urlacl url=http://my.custom.locahost.domain.com:80/ user=mydomain\myusername

is it possible to say something like

netsh http add urlacl url=*:80/ user=*

so basically, anything going to port 80, by anyone, is allowed?

Improve this question

4 Answers 4

Reset to default
5

See here: http://msdn.microsoft.com/en-us/library/ms733768.aspx which shows this:

netsh http add urlacl url=http://+:80/MyUri user=DOMAIN\user

My understanding is that it will listening to anything at port 80 and if you want it linked to a specific address, you'd actually have to unbind it. That's what I have to do if I want to run IIS and Apache on the same box with both listening to port 80.

For the user, domain\domain users should be a valid domain group which includes everyone.

Improve this answer
2
  • 2
    I found that I had to use * instead of +. My binding looks like <binding protocol="http" bindingInformation="*:1421:*"/>. Why does + work for you?
    – binki
    Mar 26, 2015 at 14:44
  • 1
    @binki Both are valid with slightly different purposes. See Routing Incoming Requests for further information.
    – lauxjpn
    Dec 30, 2020 at 15:02
26 
netsh http add urlacl url=http://+:80/ user=Everyone

Note that the valid value for user actually depends on your system language (Everyone for English, Jeder for German).

Improve this answer
5
  • 4
    +1 For the localization information
    – Basic
    Mar 1, 2015 at 23:34
  • "Tout le monde" for French
    – Drakkin
    Sep 19, 2016 at 8:51
  • I think, Jeder (GER) and Everyone (ENG) and Ĉiuj (ESO) and Каждый (RUS) are ridiculous... But it is MS-approach, and who am I to judge them...
    – maxkoryukov
    Apr 18, 2018 at 1:08
  • I really thought this was a joke until the moment I saw it working.
    – Tarc
    May 28, 2018 at 23:49
  • System.Security.Principal.SecurityIdentifier sid = new System.Security.Principal.SecurityIdentifier(System.Security.Principal.WellKnownSidType.WorldSid, null); System.Security.Principal.NTAccount acct = sid.Translate(typeof(System.Security.Principal.NTAccount)) as System.Security.Principal.NTAccount ; Console.WriteLine(acct.ToString()); ...as posted by user "LucVK-T" on social.msdn
    – oo_dev
    Aug 26, 2019 at 13:50
15

Basing on @jgillich answer, I propose to do the following:

netsh http add urlacl url=http://+:80/ sddl=D:(A;;GX;;;S-1-1-0)

sddl argument will be virtually the same as user, but you don't need to think of a localized group name. So, it's more universal.

Improve this answer
10
  • 1
    Wouldn't it be better to use S-1-2-0 to only use local users?
    – Johny Skovdal
    Aug 14, 2015 at 5:38
  • 1
    @DenisV do you have any documentation what "D:(A;;GX;;;S-1-1-0)" means?
    – Peter
    Aug 22, 2016 at 9:36
  • 2
    @Peter maybe this can be an answer: itconnect.uw.edu/wares/msinf/other-help/…
    – Denis V
    Aug 22, 2016 at 18:12
  • 1
    @DenisV thanks that explains the first part but not S-1-1-0 and S-1-2-0 but it will do!
    – Peter
    Aug 23, 2016 at 6:27
  • 1
    @Peter, here you have more information
    – Sergio Basurco
    Feb 8, 2017 at 12:10
1

My best guess was to set exactly the same url you add to the listener and do:

 netsh http add urlacl url="[exact same value]" user=%USERDOMAIN%\%USERNAME%
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.