1

I have some security concerns about my IIS websites.
From PHP-files (FastCGI) on our server the scripts are able to read my system's root directory (c:\), but even list the content of c:\windows. What is more troublesome that I can even create directories in the root like this: mkdir('c:\asdasd');, and it works without any problems; I can even read the other websites' directories (so actually maybe I could map the whole system's directory tree from a PHP script). I think that's a huge security problem. Noone should be able to read or write c:\, or other hosted website's content.

I know there's the open_basedir directive in PHP, but I think setting this directive doesn't solve the problem as I could also use any other server languages to access the same mentioned directories.

The directory tree of my websites look like this:

c:\net\web\php\
   |- website1
      |- other
      |- htdocs
   |- website2
      |- other
      |- htdocs
   |- website3
      |- other
      |- htdocs
   |- ...

The websites' source files are in the htdocs directory, so this is the "root" directory of these websites.
I just want to enable read/write permissions to the first parent directory of the website, like for example c:\net\web\php\website1 (so e.g. "c:\net\web\php\website1\other" could be written, but c:\net\web\php\ should not be).

How can I restrict the access this way?

Thanks!

Improve this question

1 Answer 1

Reset to default
0

Run the programs concerned under a very restricted account - one that does not have write or execute permissions outside your web content location.

Improve this answer
2
  • OK, thanks, but should I create different user accounts for every AppPools? I want to restrict every websites to their own root and first parent directory, not to be able to read each other's content. Is creating different user accounts for each websites the only solution? And how would I set an app. pool to "be logged in" as a given account? Thanks!
    – Sk8erPeter
    Dec 5, 2011 at 10:27
  • You can run an appool under the credentials you specify; if each web site needs to be isolated from every other, then different accounts is indeed the only way.
    – adaptr
    Dec 5, 2011 at 10:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .