RE: Newbie security frustration

From: Shawn Farkas (shawnfa_at_online.microsoft.com)
Date: 04/23/04


Date: Thu, 22 Apr 2004 23:33:52 GMT

Are you using impersonation? If you are, does the impersonated user have access to the path below? You might also be able to find more help
on the microsoft.public.dotnet.aspnet.security newsgroup

-Shawn
http://blogs.msdn.com/shawnfa

-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
Note:  For the benefit of the community-at-large, all responses to this message are best directed to the newsgroup/thread from which they 
originated.  
--------------------
>Thread-Topic: Newbie security frustration
>thread-index: AcQovbgNgil7T+r3TN+LcZSJ9EU/UA==
>X-WN-Post: microsoft.public.dotnet.security
>From: =?Utf-8?B?QmVybmll?= <anonymous@discussions.microsoft.com>
>Subject: Newbie security frustration
>Date: Thu, 22 Apr 2004 16:01:17 -0700
>Lines: 14
>Message-ID: <658E5812-226A-45FB-9810-E040C6FF7BB7@microsoft.com>
>MIME-Version: 1.0
>Content-Type: text/plain;
>	charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
>Newsgroups: microsoft.public.dotnet.security
>Path: cpmsftngxa10.phx.gbl
>Xref: cpmsftngxa10.phx.gbl microsoft.public.dotnet.security:5825
>NNTP-Posting-Host: tk2msftcmty1.phx.gbl 10.40.1.180
>X-Tomcat-NG: microsoft.public.dotnet.security
>
>I'm familiar with IIS (not an expert) and write ASP coding a bunch.  I understand anonymous usernames and the basics behind IIS 6.0 
impersonation, but, I'm now trying to get an .net app to run on a Windows 2k3 server.  It appears that it is much more complicated than it used to be.  
So here we go...
I've added the files that make up the app to the IIS 6.0 wesite.  I attempt to run it from a browser and get an error that I see many others getting:
Error Msg:
*********************
Exception Details: System.UnauthorizedAccessException: Access to the path "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary 
ASP.NET Files\ilearn\ef80c615\45266ffc\hash.web" is denied. 
**********************
Based on what I've read, this has to do with the configuration in the machine.config file, specifically the impersonate= and settings in the <process 
model> key.  But I'm stuck there and can't disect what is going on with my coinfig in order to fix it.  In other words, how do I figure out exactly what 
account the system is using?  I've tried to use the ASPNET account and even added that to the administrators group but that doesn't work (I 
removed it now). Blah, blah, blah.
It appears that .Net is trying to make copies of the files.  Why?  If it is going to try to do this by default, why aren't the default security settings ready 
to go?  Additionally,  I'm having a very difficulty time finding a resouce that spells out the concepts behind what is going on, and how to fix it.  Can 
anyone point me in the right direction?
Thanks
B
>


Relevant Pages

  • Re: IIS 6.0 cgi process not running as same user as worker process?
    ... It warns that it's inteneded for IIS 4 &5... ... > elevate privileges (through impersonation), but any other code can only ... it is configurable to have IIS launch CGI as either ... This will make your CGIs launch as app pool identity. ...
    (microsoft.public.inetserver.iis)
  • Re: IIS 6.0 cgi process not running as same user as worker process?
    ... It warns that it's inteneded for IIS 4 &5... ... > elevate privileges (through impersonation), but any other code can only ... it is configurable to have IIS launch CGI as either ... This will make your CGIs launch as app pool identity. ...
    (microsoft.public.inetserver.iis.security)
  • Re: IIS6 - How? Force Anonymous and impersonation
    ... >I'm not sure what settings you are talking about, but IIS ... >much just like IIS 5 with regard to impersonation. ... >> possible to force all Users to authenticate as ... >> the User with a specified User account which is not ...
    (microsoft.public.inetserver.iis.security)
  • Re: IIS6 - How? Force Anonymous and impersonation
    ... I'm not sure what settings you are talking about, but IIS 6 works pretty ... much just like IIS 5 with regard to impersonation. ... > possible to force all Users to authenticate as anonymous. ... > belonging to the impersonation account. ...
    (microsoft.public.inetserver.iis.security)
  • Re: IIS Folder and file security. Impersonation does not work.
    ... Custom URL navigation. ... First -- what you want to do does NOT need the impersonation DLL at all. ... Second -- you are muddling HTML and IIS concepts together and hoping for the ... Now, with IIS6, we have a custom authentication sample ISAPI that should ...
    (microsoft.public.inetserver.iis)