Re: Directory security

From: Michael C. Gates (support@R_E_M_O_V_E_gatesadweb.com)
Date: 03/30/03 

From: "Michael C. Gates" <support@R_E_M_O_V_E_gatesadweb.com>
Date: Sat, 29 Mar 2003 23:21:28 -0500

Thanks much, VERY useful...

Michael C. Gates 

--
Michael C. Gates
www.gatesadweb.com
"Lisa Cozzens [MSFT]" <lcozzens@online.microsoft.com> wrote in message
news:vqPvQk25CHA.2536@cpmsftngxa06...
> Hi Michael,
>
> The IWAM_webhost72 account will need to have Read and Execute access to
> \winnt\system32\dllhost.dll
>
> For more information on the permissions required to run an IIS server,
> please reference:
> 187506 List of NTFS Permissions Required for IIS Site to Work
> http://support.microsoft.com/?id=187506
>
> Hope this helps,
> Lisa
>
> --------------------
> > Content-Class: urn:content-classes:message
> > From: "Michael Gates" <support@gatesadweb.com>
> > Sender: "Michael Gates" <support@gatesadweb.com>
> > Subject: Directory security
> > Date: Mon, 10 Mar 2003 09:34:31 -0800
> > Lines: 29
> > Message-ID: <047f01c2e72b$4f047f60$3301280a@phx.gbl>
> > MIME-Version: 1.0
> > Content-Type: text/plain;
> > charset="iso-8859-1"
> > Content-Transfer-Encoding: 7bit
> > X-Newsreader: Microsoft CDO for Windows 2000
> > X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
> > Thread-Index: AcLnK08ETEYzfYivTh++AfW84fBMbQ==
> > Newsgroups: microsoft.public.inetserver.iis.security
> > NNTP-Posting-Host: TK2MSFTNGXA02 10.40.1.51
> > Path: cpmsftngxa08.phx.gbl!cpmsftngxa06
> > Xref: cpmsftngxa08.phx.gbl
microsoft.public.inetserver.iis.security:16214
> > X-Tomcat-NG: microsoft.public.inetserver.iis.security
> >
> > I host multiple sites on one server. I learned that you
> > can read just about any file on a server by using the
> > fileSystem object. I did it with someone else's server,
> > and could read anything on their harddrive.
> >
> > I set my drives security tab to let Administrators and
> > System have full control. No one else has any control, not
> > even read. I also checked the box to re-write the security
> > to all child folders/files, etc.
> >
> > Then I set up a new user for a particular web site and put
> > their directory to full control with that specific user.
> >
> > Now when I try to log into that web site, it
> > says: "Internal Server Error".
> >
> > It says the following in the system log:
> >
> > Unable to start a DCOM server "IWAM_webhost72" Access
> > denied, while starting winnt\system32\dllhost.dll
> >
> > My question is, how should I set up the regular file
> > security, and the IIS file security so they can't do
> > anything harmful with .net or ASP filesystem, etc.?
> >
> > Thank much, GREATLY APPRECIATED!!!
> >
> > Michael C. Gates
> >
> >
>
> -----
> Please do not send email directly to this alias. This is an online
> account name for newsgroup participation only.
>
> This posting is provided "AS IS" with no warranties, and confers
> no rights. You assume all risk for your use.
>
> © 2003 Microsoft Corporation. All rights reserved.
>

Relevant Pages

  • [NT] Vulnerability in Exchange Server 5.5 Outlook Web Access Could Allow Cross-Site Scripting Attack
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... * Microsoft Exchange 2000 Server ... An attacker could seek to exploit this vulnerability by having a user run ...
    (Securiteam)
  • Re: Urgent: Problem setting up web site hosting on SBS03 with ISA
    ... hosting our own web site on the SBS box will be a temporary solution. ... the owner that he understood the security risks. ... comapny that interacts with information in the local SQL Server. ... Internet Control Message Protocol ...
    (microsoft.public.windows.server.sbs)
  • Re: Urgent: Problem setting up web site hosting on SBS03 with ISA
    ... the security concerns are real and it would worry me even more ... running ASP stuff with a connection to the SQL that sits on the same box. ... The web site needs to be running locally (instead of hosted on the ISP's ... comapny that interacts with information in the local SQL Server. ...
    (microsoft.public.windows.server.sbs)
  • Re: IUSR trying to run cmd.exe... who is it?
    ... Ensure your server is up to date. ... > Event Source: Security ... > Client User Name: - ... > Any ideas on how to detect which web site is doing this?? ...
    (microsoft.public.inetserver.iis.security)
  • security-basics Digest of: get.123_145
    ... VPN to ASP a security risk? ... Re: Multiple IPSec tunnels? ... Subject: Security NT Server ... VPN to ASP a security risk? ...
    (Security-Basics)