0

So, heres my scenario:

  • Dedicated server running Windows 2008 R2
  • IIS 7.5
  • Multiple sites using PHP / .NET 4 / Perl / Python

Need to do:

  • Ensure that the sites are not able to write/create/read files unless expressly given permission to do so.
  • Have ability to expressly make directories/files writable by Application Pool identities.
  • Have ability to expressly allow websites (apps) to be able to create and write to files given the right permission.

How should I go about this?

What I had done in my last iteration/attempt:

  • Created individual local user accounts for each App Pool / Website
  • Setup each website to use the app pool identity and gave write permission when required

What was lacking:

  • The apps could create files without me having to give that permission.
  • The apps could read files in other apps because of the implicit read permission.
Improve this question
5
  • Is this for one (or two) servers, or a larger number? What kind of access (remote desktop, just ship an msi, something in-between)?
    – Richard
    Dec 12, 2011 at 8:25
  • Are all of the websites in the \inetpub\wwwroot directory or are you creating them in a directory tree outside of the \inetpub path?
    – Top__Hat
    Dec 12, 2011 at 16:35
  • Its for a single server. Remote desktop to be used for configuration.
    – kidoman
    Dec 15, 2011 at 9:22
  • @Top__Hat This is something I am undecided about? Which is the recommended approach?
    – kidoman
    Dec 15, 2011 at 9:22
  • My personal preference is to move the websites out of wwwroot unless they are part of the default website and use the default settings. Moving them to a separate directory and configuring the AppPool under a non-default account gives you lots of control.
    – Top__Hat
    Dec 19, 2011 at 15:48

1 Answer 1

Reset to default
0

You can address each of these two items by removing NTFS permission inheritance on the folders containing the websites. If they're all separated into individual folders.

The apps could create files without me having to give that permission.

This issue goes away if you remove inheritance. If it doesn't, you may need to be more specific about what permissions you're allowing. Make sure you're looking at actual NTFS permissions, not just read/write/etc. You should see options for "Create Folders/Append Data", etc.

The apps could read files in other apps because of the implicit read permission.

You're using separate accounts for each app pool, right? Again, I don't see why this wouldn't work. Remember also that you have the ability to deny certain permissions as well, but you really shouldn't have to do that if you've got an ACL that's not inherited from above.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .