RE: Hosting multiple sites/ASP.NET security
From: Wyant, Wade (wwyant@itsbreakwater.com)Date: 09/19/02
- Previous message: Chip Andrews: "Re: Hosting multiple sites/ASP.NET security"
- Maybe in reply to: Rado Stoyanov: "Hosting multiple sites/ASP.NET security"
- Next in thread: Rado Stoyanov: "RE: Hosting multiple sites/ASP.NET security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 19 Sep 2002 14:34:10 -0400 From: "Wyant, Wade" <wwyant@itsbreakwater.com> To: "Rado Stoyanov" <radostoyanov@softhome.net>, <focus-ms@securityfocus.com>
I spent several months on a Microsoft project that used ASP.NET to
develop a new ecommerce web site. This was one of the many problems we
ran into with ASP.NET. It gets worse when you try to use it on a domain
level (the ASP.NET account), not just a single machine. Anyway, the bad
news is, I worked with many of the Microsoft Developers that worked on
ASP.NET, and we could not find a reasonable way of handling many of the
problems we found with this account. The only good solution I received
was that it would be worked out in the next rev. I know this doesn't
help, but it gives you an idea that you are only scratching the surface
of the problems with the ASP.NET anonymous web user account, good luck!
Wade
Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. Opinions, conclusions and other information contained in this message that do not relate to official business shall be understood as neither given nor endorsed by ITS
-----Original Message-----
From: Rado Stoyanov [mailto:radostoyanov@softhome.net]
Sent: Thursday, September 19, 2002 8:56 AM
To: focus-ms@securityfocus.com
Subject: Hosting multiple sites/ASP.NET security
Hello,
I host several web sites that I own on a single web server (Windows
2000). It's possible to choose a separate Anonymous web user account for
each of the sites in IIS 5, and ASP applications run in the context of
own anonymous users. This is wise, because each of the anon users is
permitted to access only corresponding web site's directories, and not
other web site's directories.
Unfortunately, when I am migrating to ASP.NET, I have faced the problem
that there's a single account called ASPNET and all web applications run
under this account, no matter of which is the current IIS web's
anonymous user.
My question is: is there any method to achieve the same with ASP.NET, or
are there any alternative considerations that can be taken, in order to
have a secure multi-hosting environment.
Thanks,
Rado
- Previous message: Chip Andrews: "Re: Hosting multiple sites/ASP.NET security"
- Maybe in reply to: Rado Stoyanov: "Hosting multiple sites/ASP.NET security"
- Next in thread: Rado Stoyanov: "RE: Hosting multiple sites/ASP.NET security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
