Re: IIS Anonymous Security Issue
- From: David Wang <w3.4you@xxxxxxxxx>
- Date: Tue, 11 Sep 2007 13:04:18 -0000
On Sep 11, 2:52 am, Reda Zeid <RedaZ...@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:
Hi,
We're using content editor (as a backend) to update our website frontend
contents (WYSIWYG). The problem is that when we try to update the contents
through this backend, the server is denied and gives us the following message:
" r.a.d.editor5.6.0 Another process is using the resource (ascx/aspx file)
you are trying to update or the ASPNET user (IIS5) / NETWORK SERVICE account
(IIS6) has no write privileges for this file. The changes were not applied"
When we contacted the hosting company, they replied that we have to give
write privileges to the IIS Anonymous user on our server so we can solve this
issue, but this will cause another problem, is that this action will effect
negatively on the server security, and therefore the hackers can hacking our
website easier. They said that this is a Windows Server bug and no solution
for it yet. Kindly, reply to me with what we should do and are the above info
are correct that it can't be solved in right way?
We're using Windows Server 2003 Standard Edition and the page that we're
trying to update through the content editor is an ASPX.
Regards,
This is hardly a Windows Server bug. It is a security bug in the
application attempting to modify files on the server. It fails to
correctly authenticate to the server to perform privileged operations
like write files to it, so it relies on the anonymous user, which
requires no authentication, to perform the operation.
Does that sound like a Windows Server security issue, or general
laziness in the application to not authenticate correctly?
Now, the security concern is real. The assignment of blame is
incorrect.
Unfortunately, the correct solution, which is to make the content-
editor authenticate to your website front-end, is likely not trivial
(or else the hosting company would have figured it out already), so
you are pretty much stuck with their pathetic lie.
You either stick with this company and lower your security (which is
their fault, not Microsoft nor Windows Server issue), or you go with
someone else who has a better sense of security and comparable feature
package.
It is certainly possible to secure edit and upload content to Windows
Server 2003 with IIS6.
If you can disclose -- what company told you that this issue is a
Windows Server security bug with no solution yet? I'd like to know so
that I can warn anyone else about such unscrupulous dishonesty.
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
.
- Prev by Date: Re: IIS Anonymous Security Issue
- Next by Date: Re: IIS Anonymous Security Issue
- Previous by thread: Re: IIS Anonymous Security Issue
- Next by thread: Re: IIS Anonymous Security Issue
- Index(es):
Relevant Pages
|
