Re: ASPNET User Problem in Shared Hosting Environment

From: Ben Miller [MS] (benmi@online.microsoft.com)
Date: 06/27/02 

From: "Ben Miller [MS]" <benmi@online.microsoft.com>
Date: Wed, 26 Jun 2002 22:32:53 -0600

http://www.msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetse
c/html/V1securitychanges.asp?frame=true

Watch for URL wrap. This should give you an idea of what this is all about.

Ben Miller
This post is provided "AS IS" and confers no rights or warranties.

"Ely Lucas" <ely@cmconline.com> wrote in message
news:uhhpa6p7u09c2@corp.supernews.com...
> Hello,
>
> I am trying to setup a win2k server that will be used for shared hosting
> services, and am trying to figure out how asp.net is going to be able to
run
> secure on the server.
>
> In the asp days, you would give each website its own IIS_User account to
run
> under, and give that user RWXD permission to it's web root folder. You
would
> remove the Everyone group and also give the admin group full permission on
> the folder. This would keep users who are developing apps that are going
to
> be hosted on that machine from poking around in each others directories
with
> the file scripting object, include files, etc...
>
> With asp.net, it seems like everything is ran under the ASPNET user
account.
> The problem here being, the ASPNET account needs Read permission to every
> site on the server so it can monitor file changes and such for the
> framework.
>
> When a user runs an aspx page, it runs under the ASPNET account that has
> read permissions to everyone elses aspx pages. So anyone can do a <!--
> #Include File="c:\inetpub\site1\allmylovelypasswords.aspx" --> into
someone
> elses directory and get their source code. And that is just the
beginning...
>
> I have messed around the Impersonation, and set the machine.config up as
> follows:
>
> <identity impersonate="true" />
>
> And when this happens, it seems like it is working, because when I do a
>
> Response.write(WindowsIdentity.GetCurrent().Name)
>
> it returns my IIS_User for that particular site that I have setup in the
IIS
> MMC. However, this site is still able to browse through and view any
> resource on the hard drive that the ASPNET user has access to (which,
> remember, has to be all the aspx pages on the entire server, the
> Microsoft.NET folder, and more).
>
> So, I guess what I am wondering is, what is the best practice for setting
up
> asp.net in a shared hosting environment? What are all the big hosts doing
> out there? What does Microsoft have to say about this (there are no docs
at
> all in their web hoster program)?
>
> Thanks,
> Ely
>
>
>
>

Relevant Pages

  • Re: ASPNET User Problem in Shared Hosting Environment
    ... >> I am trying to setup a win2k server that will be used for shared hosting ... >> secure on the server. ... >> When a user runs an aspx page, it runs under the ASPNET account that has ... >> resource on the hard drive that the ASPNET user has access to (which, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • ASPNET User Problem in Shared Hosting Environment
    ... I am trying to setup a win2k server that will be used for shared hosting ... and give that user RWXD permission to it's web root folder. ... it seems like everything is ran under the ASPNET user account. ... the ASPNET account needs Read permission to every ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Access Network Shares from asp.net
    ... the ASPNET user to be identical for the current user of the web server PC. ... > admins" and each user folder inherits that permission, ... > full access permissions for each user based on the folder. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: ASPNET User Problem in Shared Hosting Environment
    ... each user with their own application on the server. ... and give that user RWXD permission to it's web root folder. ... the ASPNET account needs Read permission to ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • KeycodeV2.dll not found - QueryInterface for interface CrystalKeyCodeLib.IKeyDecoder failed - Crysta
    ... install CR reports for the first time on a deployment server. ... What is the version of the .Net framework on the production server ... the ASPNET account is different on the various systems! ...
    (microsoft.public.vb.crystal)