Re: II6.0 ISAPI & MIME types

Hi Ken,

About your point # (a);

Yes this is achieved. Permission are set. Having said that further the web
site uses forms authentication mode, that means username/password are looked
up in a database. No windows authentication is done.

About your point # (b)

The system uses a authentication mechanishm through forms authentication.
Unauthroized access is prevented whenever Asp page are accessed, but when a
document is accessed throught the URL directly then I need to authenticate
forceful browsing too?

Thanks in advance.




"Ken Schaefer" wrote:

You can either:
a) use NTFS permissions. The user needs a valid username/password to read
the file

b) write your own authN mechanism. Store the PDFs outside the webroot (so
they are not accessible directly). Instead you have an ASP.NET page (or ASP,
or PHP, or whatever) that authenticates/authorizes the user. If the user is
allowed to access the file, you read it off the disk (e.g. using the
FileSystemObject) and stream it to the user

Cheers
Ken

"Ibrahim." <Ibrahim@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:0FE76551-E317-4DCE-9B5F-3CA48FD7DA25@xxxxxxxxxxxxxxxx
Hello Ken,

The problem I'm facing is that I'm able to secure the directories but not
the documents (*.pdf). This is basically a upload folder in virtual
directory
which has read/write permission set.

If the attacker is aware of the file name, he can directly access the file
without even loggin in to the sytem by specifying the path in the URL.

I would appreciate if you can guide me in how to secure basic entities
that
are not supposed to be accessed by the outside world.

Thanks in advance.

Ibrahim.




"Ken Schaefer" wrote:

"Ibrahim." <Ibrahim@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:743AEC0F-7F55-4E6A-90C8-5F6C50BB4C27@xxxxxxxxxxxxxxxx
Hello,

following are my questions with regard to ASP.NET 2.0, II6.0 & Win2003
server running a Internet Application.;

1. What is the difference between MIME types & ISAPI filter.

A MIME type is a header that the server sends back to the client to tell
the
client (e.g. browser) what type of file is coming.

ISAPI is an extensibility API for IIS, which allows you to write code
that
extends the functionality of IIS


2. How can I restrict a file (*.pdf) from being accessed directly from
the
URL through ISAPI filter.

You need to write an ISAPI filter that does that. You can use something
like
URLScan (which is an ISAPI filter from Microsoft) to prevent direct
requests
for .pdf files.


3. How can i secure directories & files in II6.0

There are lots of ways. You need to tell us what "secure" means in your
case.

Cheers
Ken






.

Relevant Pages

  • Re: How to display the "Access Denied" page directly without the a
    ... authentication on whatever the link is pointing to. ... say "it is Shareponit's default behavior to pop up that login box ... whenever user tries to access the sharepoint page to which he/she does ... not the permission", I am referring to the Sharepoint access ...
    (microsoft.public.sharepoint.portalserver)
  • Re: Web Authentication
    ... Please use such programs only if you have a permission from the ... make a brute force attack to htaccess? ... but i dont know any other ways of authentication. ... scripts in those directories are wirted in PHP Perl and CGI scripting. ...
    (Security-Basics)
  • Re: How to display the "Access Denied" page directly without the annoying Sharepoint login box?
    ... What is your default permission on the site in IIS? ... My tip is still that you concentrate on authentication to your website ... This actually sounds like a network login box from the way you ... Sharepoint site. ...
    (microsoft.public.sharepoint.portalserver)
  • Re: Now no access to two folders
    ... I'd have to say I'm using Guest authentication, ... access to two of the user accounts on the laptop. ... You might not have permission to ...
    (microsoft.public.windowsxp.network_web)
  • Can IIS perform SSO for Java webapp?
    ... request header and have that resulting request be proxied ... Windows Authentication will populate REMOTE_USER ... which you then remap with the ISAPI Filter ...
    (microsoft.public.inetserver.iis)