Groups | Blog | Home
all groups > iis security > september 2004 >

iis security : IIS & Frontpage permissions?


Dave
9/7/2004 8:36:59 AM
Hi I am having a problem with my host at the moment and
wondered if anyone could help.

I am trying to use a script that uploads an image to a
directory. I need to allow the directory to allow write
permissions. I have done this fine with my last host but
having major probs with this one. I attach an email with
details of the discussion, and if someone can tell me if
it is rubbish or not it would be greatly appreciated!


START OF MESSAGE

Sys Admin:
We could give the anonymous user higher level of access by
default - this would however pose a security risk to his
site. There are a lot of exploits out there which will
sweep for anonymous upload access - I doubt it would be to
longer before the site got defaced.

Sales:
How has this worked for him before, what is it that other
hosts are doing that we aren't?

Sys Admin:
The other hosts don't have a security policy as tight as
ours.

You can just make the whole server anonymous, and nobody
would have to remember their password but would it make
it "better"???

Sales:
Ok right, so I understand it as well, the whole point we
do it this way is because of security concerns?

Sys Admin:
Basically our Windows 2003 system is extremely tight Each
site has individual IUSR's, everything anonymous is
switched (uploading via HTTP & FTP). IUSR's have limited
access to the servers, everything but supported file
extensions and technologies are switched off.

Sales:
But the customer has other sites with us with the config
but he hasn't come across this problem.

Sys Admin:
We do however (because of the security of the individual
IUSR's), allow read/write/modify permission across the
customers "\www\" directory.
However FrontPage switches the permissions to "read
only" .... This is the actual NTFS disk permissions.. What
the customer requires us to do is turn on what would allow
anonymous uploading as well as uploading from scripts -
which can be a problem...

Like I mentioned before said, we can change the disk
permissions which should allow your customer to upload -
but they will be reset back to "Read" if we run a "server
health check", which is usually what is done when someone
reports a FP problem (and FP always need maintenance at
some point or another)..
anonymous NO[at]SPAM discussions.microsoft.com
9/7/2004 9:08:45 AM
The reason that I am doing it using an ASP script is
because it is part of a content management system, and the
user is not FTP savvy!

Thanks

[quoted text, click to view]
Joe
9/7/2004 5:46:32 PM
Here are two options

Option 1)
First FPSE is a pain in A**
next the solution is this

Create a new page on your website and use the Frontpage
form from the Insert menu in the toolbar.

once you insert this form it will ask you where do you
want the files to uploaded to. Select the folder you want.
I use "upload" of course you will have to create the
folder first. Now right click on this folder >>>
properties >> and select allow anonymous upload to this
directory.

Now go to your browser and type in the URL of your upload
page you can now upload anything you want upto 2MB Maybe 4
I don't remeber?

Well anyhow...

This page will be exposed to anyone and FP will not
restrict uploads of file extensions. But you can protect
the page I will show you how later. Just tell me if it
works from here.

Option 2)

You can use a commercial asp upload program such as
aspsmartupload or aspupload.

Go here and see if this is what you are looking for

www.animocracy.com

also the FP upload
is located here

www.tech1solutions.com
enter the site and then see on the left the menu that says
submit files

Username >>> submit
Password >>> file

You will see a confirmation form after

w00t!
Joe




[quoted text, click to view]
Miha Pihler
9/7/2004 6:01:28 PM
Hi Dave,

If I understand this correctly, you could use FTP to upload the image. FTP
upload is "scriptable". E.g.

************
ftp
open 10.10.10.10
username
password
binary
cd directory
put "file.jpg"
bye
************

open 10.10.10.10 tells the script to open FTP connection on 10.10.10.10
"username" is username used to logon to this FTP
"password" is password for "username" used to logon to this FTP
binary sets binary transfer mode (instead if ASCII)
cd directory changes folder to "directory"
put "file.jpg" upload file.jpg to FTP server
bye will end connection with FTP server.

Most important thing about this script is that it is stored in secured
folder where only authorized users have access to. Password in batch file is
in clear text and anyone with access could read it...

I hope this helps,

Mike

[quoted text, click to view]

jeff.nospam NO[at]SPAM zina.com
9/7/2004 6:45:10 PM
On Tue, 7 Sep 2004 08:36:59 -0700, "Dave"
[quoted text, click to view]

Not rubbish. Have your host uninstall FrontPage extensions and never
use FP to manage your server. It configures its own settings that may
break other changes you wish made.

Dave
9/8/2004 3:02:34 AM
Thanks Joe,

I am already using aspUpload, and that is where you need
the write permissions on the folder.

I have already tried the FP solution of right clicking the
folder, but get a "Server Error: Not permitted..."

Grrrrrrr....

[quoted text, click to view]
Joe
9/8/2004 5:33:46 AM
If your host cannot give you the correct permissions then
it is most difficult to fix. Because it is out of your
hands.

I have already tried the FP solution of right clicking the
folder, but get a "Server Error: Not permitted..."

All this is is the server not allowing anonymous access in
FPSE and the IIS not set correctly. FPSE wants to control
everything.

In the FPSE the host will need to give the browser
anonymous access and also allow Authoring. 9this is done
in the (Sharepoint Administration) then go to the Page you
created to upload in the IIS manager.
Once you are there right click the page >>> properties >>
Directory security>> edit, remove the check mark on
Windows integrated Authentication and use the Send in
clear text method. This will protect the page and once you
get in you should be able to upload if the host will
cooperate. Where is the URL of this page now Dave?

AS I read in your email they were worried about anonymous
sweeping well this fixes that.The web remains anonymouse
to the browser and then protected by the IIS
Authentication method. Just that one page also I have IIS
6.0 so it will work I do it all the time
Joe
[quoted text, click to view]
Joe
9/8/2004 6:05:49 AM
Dave the same method can be used with ASpupload

Just tell them how to do it.

Keep the page open(anonymous) and with write permissions
and then put it on a sever HTTPS URL and then Use the IIS
Authentication method password sent in clear text.
If they need to see it in action send them to
www.animocracy.com and select it from the second drop down
box. I just added it to help you out.


Thay may understand this much easier.

Good luck
Joe
[quoted text, click to view]
Phil Borod
9/8/2004 6:32:53 AM
Dave,
Check the IIS versions of the working & non-working hosts. My guess is the
working hosts are running IIS-5 and the non-working ones are running IIS-6
(or IIS-5.1 with XP-SP2). If this is correct, then the newer, tighter
security policies are what's causing this issue. (Don't know the solution
but will monitor this group to see how this turns out).
Phil
[quoted text, click to view]

AddThis Social Bookmark Button