Re: Hosting multiple sites/ASP.NET security
From: Chip Andrews (chipandrews@usa.net)Date: 09/19/02
- Previous message: Dominick Baier: "AW: Hosting multiple sites/ASP.NET security"
- In reply to: Rado Stoyanov: "Hosting multiple sites/ASP.NET security"
- Next in thread: Wyant, Wade: "RE: Hosting multiple sites/ASP.NET security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Chip Andrews" <chipandrews@usa.net> To: "Rado Stoyanov" <radostoyanov@softhome.net>, <focus-ms@securityfocus.com> Date: Thu, 19 Sep 2002 15:38:14 -0400
Rado,
Check your machine.config file (or specify in your web.config files for more
granular control) to impersonate identity. By default impersonation is
turned off with the process model set to "machine". This results in all
applications running as ASPNET.
To change impersonation status:
<!--
identity Attributes:
impersonate="[true|false]" - Impersonate Windows User
userName="Windows user account to impersonate" | empty string
implies impersonate the LOGON user specified by IIS
password="password of above specified account" | empty string
-->
As you can see - leaving the username and password blank will result is
impersonating the IIS configured user (the old ASP behavior you are used
to).
To change process model credentials see the "processModel" key in MSDN or
see the description inside machine.config.
Chip Andrews
www.sqlsecurity.com
----- Original Message -----
From: "Rado Stoyanov" <radostoyanov@softhome.net>
To: <focus-ms@securityfocus.com>
Sent: Thursday, September 19, 2002 8:56 AM
Subject: Hosting multiple sites/ASP.NET security
> Hello,
>
> I host several web sites that I own on a single web server (Windows
> 2000). It's possible to choose a separate Anonymous web user account for
> each of the sites in IIS 5, and ASP applications run in the context of
> own anonymous users. This is wise, because each of the anon users is
> permitted to access only corresponding web site's directories, and not
> other web site's directories.
>
> Unfortunately, when I am migrating to ASP.NET, I have faced the problem
> that there's a single account called ASPNET and all web applications run
> under this account, no matter of which is the current IIS web's
> anonymous user.
>
> My question is: is there any method to achieve the same with ASP.NET, or
> are there any alternative considerations that can be taken, in order to
> have a secure multi-hosting environment.
>
> Thanks,
> Rado
>
- Previous message: Dominick Baier: "AW: Hosting multiple sites/ASP.NET security"
- In reply to: Rado Stoyanov: "Hosting multiple sites/ASP.NET security"
- Next in thread: Wyant, Wade: "RE: Hosting multiple sites/ASP.NET security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
