RE: Securing IIS/5 with ASP

From: Chris Neppes (cneppes@port80software.com)
Date: 01/24/03

  • Next message: Jeremy Drake: "Re: Win2k log management" 
    Date: Fri, 24 Jan 2003 13:30:09 -0800
From: "Chris Neppes" <cneppes@port80software.com>
To: "Ralph Los" <RLos@enteredge.com>, <focus-ms@securityfocus.com>

    Check out this article on server anonymization for IIS Web servers at

    www.port80software.com/support/art_maskyourwebserver

    Best,
    Chris

    -----Original Message-----
    From: Ralph Los [mailto:RLos@enteredge.com]
    Sent: Friday, January 24, 2003 9:56 AM
    To: 'focus-ms@securityfocus.com'
    Subject: Securing IIS/5 with ASP
    Sensitivity: Confidential

    Hello,
            I have a document I've built over the years about securing
    IIS/5,
    with regards to permissions, etc right down to the file level. This
    often
    works, except when I get that pesky ASP engine involved. I'm sick of
    HTTP/500 errors! I know for a fact the error is with file permissions,
    but
    I can't pin-point which file(s) are causing it. I've had the
    dllhost.exe
    keep getting "ACCESS DENIED" (Using NTFileMon from sysinternals.com) on
    C:\winnt\system32\<some_file> but...the permissions on that
    file/folder/whatever are IUSR/IWAM/SYSTEM (RWX).

            Bottom line, does anyone have a definitive "baseline IIS/5
    w/ASP"
    security document done I could look over? Just curious - dying to know
    what
    I'm missing.

    ?Ralph

    Relevant Pages

    • Re: FolderExists and UNC path
      ... Traditionally ASP uses the IUSR_account so try mapping a drive using that username and password or assigning permissions to that account or changing to a different one if you don't know or can't change the password. ... When I ran this command from the server logged with my user it ...
      (microsoft.public.scripting.vbscript)
    • RE: Running vbs from WSH in ASP page
      ... I see a whole bunch of problems with the code sample you show (using wscript ... mapping, permissions, etc.) and I'm not the least bit proficient in ASP. ... > When I run the vbs from the command line all is well. ...
      (microsoft.public.scripting.wsh)
    • Re: Access97 DB locks up the asp code at times
      ... of these users created the query off the asp and that's the problem. ... but I could never see the employee.ldb on the folder ... I'll chat with our IT group about setting the proper permissions. ... All database users, including the IUSR_MachineName account, need ...
      (microsoft.public.inetserver.asp.general)
    • Re: EFS and IIS
      ... > NTFS permissions should be as secure as EFS for this purpose, ... > Neither NTFS nor EFS necessarily protect against remote attacks such as ... > permissions, if System is required to have permissions to those files. ... > as showcode.asp, save your include files as .ASP instead of .INC, etc. ...
      (microsoft.public.inetserver.iis.security)
    • AW: ASP Dot Net Security Guidelines
      ... Betreff: Re: ASP Dot Net Security Guidelines ... Basically you'll treat an asp.net application server as you would an asp ... > to set the permissions as it brings up access denied errors on the ...
      (Focus-Microsoft)