Groups | Blog | Home
all groups > iis security > october 2003 >

iis security : Permissions Fun with CGI


Mike
10/14/2003 2:41:20 PM
What specifically must I do to enable a cgi script to
execute a process that modifies a file on the local file
system of the server (IIS 6.0)?

I've granted my iuser_account modify rights to a
directory that will house the file. When I use a perl
OPEN filehandle within the CGI it works fine...when I
remove the NTFS file permissions the OPEN filehandle
doesn't work. However, if I try something simple like
dir d:\wwwroot > d:\temp\directory.txt within the CGI
that won't work. If I return the dir command directly to
a variable then use the open filehandle to print it to a
file it'll ....so I know my permissions are ok on the
directory, I know CGI is properly enabled, I know I've
got all the necessary access to the executable I'm trying
to call...but it just doesn't work. No errors. Nothing in
the IIS log, I enabled auditing on this directory and I
don't see any problems, and Filemon doesn't show anything
either. Beyond the file permission changes I mentioned,
this is a pretty simple install of IIS 6.0

Thanks,
Mike
10/14/2003 3:47:47 PM
Well I was a bit wrong. The system commands didn't work
at all....even when they would pipe straight to a
variable. As it turns out Access was being denied on
c:\windows\system32\cmd.exe I granted my iusr_servername
account Read and Execute to cmd.exe and all problems went
away...but it prompts a bigger question, what have I
exposed myself to? This user doesn't really have any
other special permissions to the O/S. It does have full
control of the files in the wwwroot however..

hmm.... anyone have thoughts?
Thanks,
~Mike


[quoted text, click to view]
AddThis Social Bookmark Button