Jeff, If both those websites run with Full Trust you will need to:
- use unique accounts for the application pools and anonymous users and,
VERY IMPORTANT, you will need to change the Metabase.xml ACLS so that
members of the IIS_WPG are not able to read and decrypt the usernames
and passwords stored in there.
- change for each site the location of the "Temporary ASP.NET files"
(since it is shared)
- be careful if you have cache enabled since this folder (the one where
the pre-cached files) will be accessible by all (and in IIS 6.0 you
can't change that)
- even after these changes, you need to hope that there are no
vulnerabilities in those applications that allow malicious asp.net pages
to be uploaded to that server, or that the developers of those apps are
not malicious. Because if they are, since you are running with Full
Trust, they can upload and execute exploits on that server (i.e. attack
your server from inside).
The best thing is to run those websites in a secure partial trust
environment.
Dinis Cruz
Owasp .Net Project
www.owasp.net [quoted text, click to view] Dominick Baier [DevelopMentor] wrote:
> use IIS6 and separate the apps in different worker processes with
> different identities - the ACL the files appropriately
>
> or use partial trust
>
> ---------------------------------------
> Dominick Baier - DevelopMentor
>
http://www.leastprivilege.com >
>> A while back I had a customer that wanted to host a Dot Net web site
>> on one of my servers. We went ahead and installed v1.1, the customer
>> was happy and didn't seem to have any problems. Then we had a second
>> customer who wanted Dot Net on their web site and we found that the
>> two users could then browse each others sites because the ASP.NET user
>> account needed access to both their folders. If we put a script in to
>> browse the hard drive, copy files, etc it was able to pull data from
>> the other site. Without Dot Net, we could prevent this in IIS/NT by
>> creating separate anonymous user accounts for the two sites and
>> restricting access via NTFS so that the anonymous users only had
>> access in the appropriate folders on the disk.
>>
>> Is there a way to restrict this now in Dot Net? I have a user that
>> wants to put an access database on a Dot Net enabled web site and
>> wants to make sure no one else can get to it - including other Dot Net
>> users on the same server. If there is a way to prevent this, where
>> should I be looking?
>>
>> Thanks,
>> -Jeff
>
