all groups > iis security > may 2007
IIS METABASE EVENTS
Posted by OutlawJJ at 5/30/2007 2:34:35 PM
Hello. I'm looking for some help on deciphering IIS Metabase Event messages
4500 thru 4512. I was hoping to get some detailed definitions for each of
these. The info I got from the Microsoft site is very generalized. We are
trying to find out what event triggers these messages so we can know who ... more >>
Site Hacked
Posted by Andrea at 5/30/2007 1:54:12 PM
Hi,
some haker has hakered my site in my windows 2003 std with IIS.
The haker has copy 5 pages in each folder of my IIS sites.
The files are:
default.htm
default.html
index.asp
index.html
index.php
I've a hardware firewall that's protects my server (SonicWALL PRO with IPS)
Only the port ... more >>
Domain Account Access with anonymous access enabled
Posted by JavierBolivia at 5/25/2007 3:38:00 PM
Hello IIS gurus,
Never mind the reason, but I need to configure a virtual directory with
anonymous access enabled (it's accesed by both domain users and non-domain
users in an intranet), but the users that do belong to the domain must access
the site with their domain account, instead of "... more >>
IIS 6 Permissions for IIS admins
Posted by Rulo at 5/25/2007 11:46:01 AM
Hello,
We have many servers with IIS 6 (windows 2003) installed. THere is another
department that manage the IIS. In the past, they have been added to the
local administrators group, but we do not want to grant them this
permissions. Is there any way to delegate permissions or grant IIS adm... more >>
Grant/Deny access to a group of computers
Posted by Olafub at 5/23/2007 6:13:02 PM
I am trying to limit access to only a few computers.
Win 2003 IIS 6
I followed Article 166003
http://support.microsoft.com/default.aspx/kb/166003
Example:
(Class C Address with custom subnet mask)
Network ID: 200.200.200.128
Subnet Mask: 255.255.255.192
IP Addresses Effected: 200.200.20... more >>
Server Setting to allow/disallow Uploads
Posted by Vinnie L at 5/22/2007 8:57:02 AM
I would've thought that someone from the FrontPage Client or FrontPage Server
Extens forum would be able to answer this because of the tight relationship
between the technologies but apparantly not.
Can someone in this forum address this?
BTW I tried the adjust the NTFS permissions of the anon... more >>
Is this normal behavior or an attack?
Posted by JNeilWix at 5/21/2007 10:53:01 AM
Please see the Security Log event below. It appears that I get a similar
entry in the Security log periodically. This example involves
C:\WINDOWS\system32\drivers\etc\protocol Sometimes it involves other files as
well. Namely c:\windows\system32\msdart.dll,
C:\WINDOWS\system32\msjetoledb4... more >>
Malicious user
Posted by maverick at 5/18/2007 3:39:01 PM
Not sure if its the right place..but need help cracking this...Just
inherited a bad place........
Users access a certain share point site and browse a directory for a host of
folders.This afternoon one of the folders was deleted which has loads of
subfolders(as it is a sharepoint server)..... more >>
Don't see what you're looking for? Search DevelopmentNow.com.
VB.NET (2.0) impersonate not working
Posted by NathanC at 5/17/2007 1:33:01 PM
I have a web project that is running this code: (generalized for security)
refWMIService = GetObject("winmgmts:\\computer_name")
colcomputers = refWMIService.ExecQuery("Select * From
Win32_OperatingSystem")
For Each refComputer In colcomputers
If refComputer.reboo... more >>
IIS 6.0 Windows Authentication 401 Every Request
Posted by cgambino at 5/17/2007 10:12:03 AM
Hello,
After reading a lot of articles, I was finally able to get Kerberos and NTLM
both working for an internal server.
I'm not sure if this is supposed to work this way, but it seems that on
every request to a page, it'll throw a 401, and then the next request
authorize the same page.
... more >>
Intranet Security
Posted by Spechty at 5/17/2007 8:14:02 AM
I have a test intranet site set up. I have IIS set for Integrated Security.
IIS server is in a domain. and only domain PCs will access the intranet.
the URL is http:\\Intranet.
I have NTFS settings on the folders for the site. I have several folders
that only specific users/groups who ... more >>
IIS Subauthentication Required
Posted by David V at 5/16/2007 2:43:00 PM
I have 4 Web servers that should all be set up the same; once they are all
working we plan to load-balance them. Due to limitations in our in-house
application, the Web services are running in IIS 5.0 isolation mode. The Web
site on all four servers is configured to use the local IUSR account... more >>
Disable login prompt in IIS
Posted by fingerhut at 5/14/2007 1:08:05 PM
If I use a web browser other than IE to connect to our intranet I get
prompted for a user name and password. I understand if I type in
"http://website" in IE I will not get prompted to log in and if I type in
"http://website.domain.com" I will get prompted. Unfortunately, if I use
Firefox ... more >>
Silent Authentication
Posted by atemwende NO[at]SPAM gmail.com at 5/11/2007 1:19:24 PM
I am designing an intranet site. All content is unprotected - anybody
on the intranet should be able to see everything. There is a
requirement to provide silent authentication against corporate Active
Directory whenever possible; in other words, when a user navigates to
the home page, we want to... more >>
IIS6/Kerberos/Application Pools/Integrated Security...
Posted by kevindk at 5/10/2007 3:20:00 PM
So after some serious "fun" trying to get Kerberos to work for me I think I
have determined that my configuration is going to require NTLM. Here's the
situation. We have a load balanced server farm backed by 3 different
servers, say A, B, and C. Each of these servers is configured via host ... more >>
IIS NT Auth - How to get Domain users automatically authenticated
Posted by Steven Nagy at 5/9/2007 10:58:45 PM
Hi,
Just running a local example on my windows XP pro SP2 box, I have a
virtual directory that I turn off anonymous access for. I want people
to use their domain accounts.
As per an article I just read online, if I refer to the site as
http://localhost/site then it works, as in, it detects ... more >>
IIS Read Only Access to IIS Manager
Posted by Dale Meredith at 5/9/2007 10:46:01 AM
Is there a way to configure the server so that certain users can remote
desktop or use a custom MMC with the IIS snap in to launch the IIS Manager,
see the configuratiion settings but not make changes to any settings?
I have some web developers that I'm not keen on give admin rights to :)
... more >>
Integrated Authentication, Auto Logon, and off the network
Posted by jdbutler72 NO[at]SPAM gmail.com at 5/9/2007 5:29:02 AM
Is there a way to let IE clients auto logon when connected to an
Active Directory network and get prompted to logon when connected over
the Internet to the same site with SSL? If so what are the settings
needed on the IIS side and IE side? I get the IE error page that the
site cannot be found ... more >>
Many Connections from each Web Client
Posted by Baboon at 5/8/2007 8:26:00 PM
I was asked to take a look at an IIS Website running on Windows 2000 Server
because of reports of slowness. The site is for a small research group that
is part of the University I work for, and there typically aren't a lot of
clients connected at one time, so the server should be able to hand... more >>
Post to HTTPS from HTTP - Secure?
Posted by ethanselzer NO[at]SPAM gmail.com at 5/7/2007 11:41:51 AM
Hi,
When posting to HTTPS (action=https://domain.com/processForm.aspx)
from an HTTP page on another site (http://myOtherDomain.net/
mypage.html) is the post data secure (encrypted)?
Thanks,
Ethan
... more >>
Backup IIS
Posted by Patrick D. at 5/6/2007 10:18:00 AM
Hi,
I have read in the IIS help, that informations of IIS are both situated in
the IIS metabase and in the Windows registry.
That's why I think, that restoring the whole metabase after a server-crash
wouldn't be enough to have a working IIS-configuration with all website- and
ftp-site conf... more >>
Trying To Create An HTTPS Page From My Login Folder
Posted by pbd22 at 5/4/2007 9:01:48 AM
Hi.
I am using IIS 6.0 and Server 2003.
I want to know what is the best way to provide a secure login.
I tried to go to the Directory Security tab and create HTTPS
access on the signin folder (containing all login pages) but
now can't access the folder at all (I typed https in the browser).... more >>
Virtual Directory Access Denied
Posted by mikevanhoff at 5/2/2007 1:43:01 PM
I have IIS 6 running on a Win2k3 server. A virtual directory has been
created under the default Web Site at "C:\Reports" As an Administrator I
have no problem running the reports. A non Administrator either gets
prompted for a domain user id and password or simply "access denied" The
vir... more >>
Unable to getfolder from Virtual Directory
Posted by jbonifacejr at 5/2/2007 9:15:51 AM
I am unable to use the GetFolder method of the FileSystem object when
trying to get the folders from within a Virtual Directory. Here is my
setup...
I have a Development Box (DB) and a WebServer (WS) and a separate file
server (FS). On FS, I have a share with permission for Everyone set to
Re... more >>
IIS AD authentication on Perimeter server
Posted by templar.m NO[at]SPAM gmail.com at 5/2/2007 3:19:09 AM
I have an IIS 6 server on our DMZ. I also have a developer that
requires his application to authenticate users into Active directory
this will provide the access to a back end SQL server.
If this was purely an Intranet site I would have only a little
hesitation in allowing all the ports requir... more >>
|