Re: Please help, directory level protection needed.

From: Fred Hebert (fhebert_at_hotmail.com)
Date: 05/09/05 

Date: Mon, 09 May 2005 12:30:17 -0700

"David Wang [Msft]" <someone@online.microsoft.com> wrote in
news:OUAd40gUFHA.1044@TK2MSFTNGP10.phx.gbl:

> Actually, neither Apache nor IIS natively implement the feature you
> are talking about.
>
> Apache uses addon modules to implement the functionality and the
> configuration is in .htaccess. The author of those modules happen to
> just give away the source code for free, so it frequently comes
> bundled with Apache.
>

The bottom line is that Apache/php easily does what I want for free.

> Many 3rd party vendors have also implemented addon modules for IIS to
> implement the functionality with various configuration choices. Their
> modules need to be purchased.
>
> I have not found a freely available module to do this on IIS. On IIS6,
> we have sample code illustrating other concepts that do about 90% of
> the work, but no one has released a free add on module to lookup
> username/password securely from a database/file. Even after I posted
> sample code modification showing how to lookup username/password from
> a file with exact lines of code to change/insert.
>

The bottom line it's going to cost me.

>
> FYI: the protection mechanism you are asking for is not terribly
> secure. Namely, there is no real user-identity in the underlying OS;
> you rely on the Web Server to implement a check to control access. If
> anyone else happens to compromise the Web Server, they instantly have
> access to the resources you are trying to protect
>
> Meanwhile, using real user identities in the filesystem (something IIS
> natively supports), you rely on someone actually authenticating
> correctly to control access. If anyone else happens to compromise the
> Web Server, they do not have access to this protected content since
> they did not compromise the real user identity -- only the web
> server's identity. On a server like IIS6 where the web server's
> identity is unprivileged, the server remains secured even if a worker
> process gets compromised.
>
> This is the fundamental difference between the two approaches.
>

So you think we should add 40,000+ non-employee user accounts? How much
would that licensing cost us? And of course letting sales people and the
web server manage these accounts is "secure", or do I need to hire an
additional administrator?

>
> Regarding your problem statement:
>> I am trying to implement a secure software update directory.
>> My application checks for and retrieves updates via http from
>> a directory on our web server. All this works fine, but there
>> is no security. I want to protect the directory so that any
>> http request will require basic authentication.
>
> Basic authentication passes username/password over the network in
> clear text, so it is not secure and is counter to your desire to
> "protect" the directory.

We have this new thing called SSL...

>
> Furthermore, I do not understand why you need authentication for a
> "secure software update directory". I presume users will be
> downloading their patches from this "secure software update
> directory". Why do users even need to authenticate? You want them to
> be able to download patches, right? Or is your program unsecured, so
> access to this "secure software update directory" is equivalent to
> free download to your (possibly licensed) software program, so you
> need to control who can access this directory.
>

Actually the app checks for updates and downloads them via ssl. The
customer does not have direct access to the updates.

Most companies, already have a customer database and it is relatively
easy to query that database to determine if a user is valid and grant
access to the files they need. The web server is doing the query through
a very restricted account and the "customer id" has no access to any of
our systems.

The mechanism is very secure. I have implemented it at other locations
with great success and NO security issues. Fortunately none of these
customers used IIS, so it only took about 10 minutes to set up.

Anyhow the short, and correct answer to my question is:

IIS can't do it, I need to BUY a 3rd party tool or roll my own.

Tip: answer the question asked, don't comment on things you are not
familiar with, feel free to offer tips, alternate solutions, point out
potential problems, or ask for clarification but don't assume...

No need to answer the above questions, I am just going to write my own
ISAPI download manager. I was just looking for a quicker and easier way.
The last time I had to deal with IIS was 6 years ago, and I see nothing
has changed...

Relevant Pages

  • Re: Please help, directory level protection needed.
    ... The last time I had to deal with IIS ... > you rely on the Web Server to implement a check to control access. ... >> I am trying to implement a secure software update directory. ... >> http request will require basic authentication. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Suggestions on creating a File Download area
    ... > I'm in the process of setting up a web site that will allow users to ... > towards having a download area that users can log in to and simlply ... are outside the directories that the web server can access. ... or you could link the cleaning to logins. ...
    (alt.php)
  • Re: Suggestions on creating a File Download area
    ... filename will be able to download the file without paying you anything. ... as the web server wouldn't go out of the /var/www/html ... A php script can read a file outside the document-root, ... use fpassthru() function, of course you can use any of the other file read ...
    (alt.php)
  • Re: OT: windoze woes and full rant mode is on
    ... If I try and download it to the client, ... EVERYTHING on the web server, then simply serve up a dynamically ... constructed page that suits the particular browser being used. ... I was really hoping Java would have taken off more than it did. ...
    (comp.lang.cobol)
  • Re: Downloading files
    ... > How can I download a file and store it on the web server. ... The files are to be stored on the web server. ... >>> How can I download a file and store it on the web server. ... >>> Shawn ...
    (microsoft.public.dotnet.framework.aspnet)