I'm trying to setup a highly available IIS for public facing websites, and I'm having a hard time finding information on the best and most secure method of setting up the permissions, correctly configuring IIS, and verifying that my setup plan is optimal.
After much research, I've settled on this setup:
- 2x IIS servers, using shared config.
- Both IIS servers connect to the same Windows Failover Cluster SMB File Share for application website data.
- The File Server uses Starwind vSAN.
- IIS servers will receive requests from a NLB/ARR cluster.
- Servers are VMs on two Hyper-V hosts
- Mysql will run on two Linux VMs with MariaDB Galera Cluster.
The general consensus I found was to not use SOFS for IIS, so it is a standard File Server setup as an SMB Share - Application. Starwind was used because there is no single point of failure on the two node system, and replication is synchronous. Data will have regular backups and shadow copies, and VMs will have replicas on another host.
My problems currently come from understanding the permissions and users needed for setting up shared IIS data.
Currently data is local to the server and has permissions for built-in users, system, administrators, trustedinstaller, and IUSR is set for write permissions on certain folders. ApplicationPoolIdentiy is used with pass-through authentication. Anonymous Authentication is set to IUSR.
For shared data, I have only gotten my websites to work after setting the application pool to use a domain user, and setting the Anonymous Authentication to use ApplicationPoolIdentity. I've added the domain user to have full permissions on the SMB share. I've also seen some recommendations of adding the computer account to permissions and keeping with local system accounts for Application pools, except IUSR still must be changed to appidentity for anon authentication. Is one method preferred? What NTFS and SMB permissions are necessary, and who needs write access when IUSR was previously used?
Also, are there any concerns with having shared files in IIS? Can logs, caching and php session folders be shared? I'm currently having write permission errors on logs and caching despite giving full permissions.
Any help, thoughts, and opinions would be greatly appreciated!