Groups | Blog | Home
all groups > iis security > december 2003 >

iis security : IIS-Rechteproblem


Timo Erbach
12/27/2003 6:36:15 PM
Hallo Liste,

habe einen Win2003-Server mit IIS.

Auf einem Verzeichnis habe ich die Integrierte Ameldung für einen
Unterordner ausgeschaltet und Basis Anmeldung aktiviert.

Im Dateiverzeichnis habe nur einem von mir angelegten User Zugriff auf
diesen Unterordner erteilt.
Das funktioniert soweit auch.

Aber ich werde nun auch für Parent-Verzeichnisse nach einem User und
Passwort gefragt, obwohl diese die Integrierte Authentifizierung
und einen User für den IIS unterstützen.

Das Seltsame daran ist, dass wenn ich dreimal einen falschen User eingegeben
habe oder die Anmeldung mit ESC abbreche,
trotzdem meine Seite angezeigt bekomme. Jetzt kommt aber bei jedem weiteren
Link auf den ich klicke wieder das Anmeldefenster.

Was ist hier schief gelaufen?

Grüße
Timo Erbach

a-chaun NO[at]SPAM NOSPAMmicrosoft.com
12/29/2003 7:10:08 PM


I believe he is saying that he unchecked "integrated authentication" and
checked "basic authentication" on a site or a virtual directory.
Being basic authentication, he enters his credentials when prompted but he
keeps getting prompted.

If I've surmised the translation adequately, it sounds to me like there is
an NTFS permissions issue on the content. IIS is probably authenticating
the user just fine but the user is getting access denied at the file level.

If the content (*.htm, *.asp, *.jpg, *.gif, etc.) is in
c:\inetpub\wwwroot\, for instance, then the wwwroot folder will need to
have RX/L/R permissions for the user that is being authenticated. That
user may also need to be given "log on locally" rights in the local
security policy.

If you're not sure where the "Access Denied" is happening, I highly
recommend using NTFilemon from www.sysinternals.com. Start the capture
with NTFilemon, reproduce your problem, stop the capture in Filemon, and
search the results column for the words "Access Denied."


271071 HOW TO: Set Basic NTFS Permissions for IIS 5.0
http://support.microsoft.com/?id=271071

812614 INFO: Default Permissions and User Rights for IIS 6.0
http://support.microsoft.com/?id=812614

187506 INFO: Basic NTFS Permissions for IIS 4.0
http://support.microsoft.com/?id=187506


I hope that helps!

Chris - IIS Team
Timo Erbach
12/29/2003 9:42:51 PM
hi christoph,

it helpe not really yet.
i used ntfilemon. it says access denied on dir "www" which is the root of
the webapplication.

i added a new user for running an anonymous user in iis.
he has access rights on the ntfs filesystem and iis.

in a subdirectory i actived basic auth. and deactivated anonymous. this
works fine.

but in the parent where anonymous is activated, i get prompted for login.
pressing esc show the website without errror. but clicking a link, prompts
again the auth.box.

another webapp on the server with the same user runs fine.
the only different is, there is no subdir with basic authentication.

best regards
timo erbach

"Christopher Haun" <a-chaun@NOSPAMmicrosoft.com> schrieb im Newsbeitrag
news:Dkdhv9jzDHA.1476@cpmsftngxa07.phx.gbl...
[quoted text, click to view]

a-chaun NO[at]SPAM NOSPAMmicrosoft.com
12/30/2003 3:05:02 AM

Hi Timo!

This sounds like a tough issue.

That Access Denied on the root directory that the webapp is in may still be
a very good clue.

I trust Iusr has Read&Execute/List/Read permissions there? And the user
that will log on also has RX/L/R perms too? Perhaps also add the IIS_WPG
group.
Perhaps temporarily give everyone full control as a test???

Also, perhaps try setting the Default Application Pool from "Network
Service" account to "Local System" account. See if that improves things.
If it does, it may be further confirmation that there is a permissions
issue.

Good luck!

Chris
Timo Erbach
12/30/2003 5:51:13 PM
hi Christopher,

sorry but nothing helped.
I don´t use Iusr. Therefore I take the user added from me!
He has RX/L/R perms for all directories und subdirectories of this webapp.

I alway get AccessDenied on the root directory of this webapp which is under
inetpub.

Timo

"Christopher Haun" <a-chaun@NOSPAMmicrosoft.com> schrieb im Newsbeitrag
news:saI2%23GozDHA.3532@cpmsftngxa07.phx.gbl...
[quoted text, click to view]

a-chaun NO[at]SPAM NOSPAMmicrosoft.com
1/6/2004 9:24:10 PM

So it does not work when its application pool is running under "local
system account"?

Since you're using a user other than Iusr, perhaps try switching
temporarily to a domain admin account or local admin account as a test.
(Be sure to cut off all traffic to the webserver before testing like this,
however.)

I hope that helps!

Chris



[Standard disclaimer: These suggestions given without warranty, guarantee,
and/or the conveyance of any rights.]
Timo Erbach
1/13/2004 7:19:47 PM
hello christopher,

my configuration for iis was good.

i used a dir for security which hold some javaClasses that where used on
each request.

thanks for for all you help!

regards timo

"Christopher Haun" <a-chaun@NOSPAMmicrosoft.com> schrieb im Newsbeitrag
news:bSsr2tJ1DHA.3068@cpmsftngxa07.phx.gbl...
[quoted text, click to view]

AddThis Social Bookmark Button