1

We had a major server compromise over the christmas period when a comprimised FTP account was used to upload a .net back door which gave it access to the entire asp.net machine account and comprised dozens of e commerce stores.

We disabled the comprimise and cleaned up the mess, but I want to put a stop to this. Doing my research, it appears that limiting .net applications to medium (not full trust) will ensure applications keep themselves to themselves and cannot interact under normal circumstances.

However since our application is classic ASP and .NET, there's little use securing .net unless I can secure the ASP too.

Does anyone know what additional security I might need to implement in order to secure ASP in a similar fashion?

1 Answer 1

0

Sorry to hear about your intrusion.

AFAIK you will likely need to look at application pools. I'm no expert on that, but from what I understand you can set the ASP worker process (w3wp.exe) to run in an application pool under a user that you specify (rather than the regular SYSTEM or IUSR account). Then in Windows you can lock that user down pretty heavily. For instance you would only provide them with access to the wwroot/{yourwebsitename} folder, possibly only read access to that folder - unless you do some filesystemobject writing (for caching or other reasons).

By setting each of your websites into different application pools (with appropriately different users), a breach in one website should not affect other sites in the wwwroot.

Like I said you'll have to do more reading yourself, but this is a starting point for your research.

Also make sure you go through the ASP settings in IIS and disable things like remote debugging, and sending errors to the client. A general tutorial/book on securing IIS would probably be a better resource than something specific to ASP. Have you considered upgrading the server to IIS7? I'm sure there are many exploits, bug fixes, and such - and it's usually recommended to keep up to date (although this is OS dependent, so you might have your hands tied there).

1
  • Thanks for the suggestions. I should have been explicit, I am aware you can deal with this issue with different accounts per application pool so there's no overlap, that addresses both ASP and .net issues. However there is a relatively high level of maintenance associated with that approach, creating scores of accounts and assigning them to application pools, not to mention the fact we share application pools where possible to save server resource. This is why I'm after language/iis lock down options for IIS for a one off, permanent fix
    – Deku-shrub
    Jan 26, 2012 at 11:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .