Upload best practice help ! -- iis security

David Wang
6/14/2007 1:22:21 AM

[quoted text, click to view]

There is no "safest way". Security is relative to the environment and
functionality that you want to provide.

In general, you are concerned with:
- User Identity that has write access on the server
- Filesystem Location of the uploaded file and NTFS ACL on that
location
- Whether user has read/script/execute access to the uploaded file or
not

User identity depends on whether you are ok with the anonymous user,
specified upload user, or normal authenticated users having write
access to a Filesystem Location

Filesystem location could be under inetpub, could be outside inetpub,
or even on a UNC share - depends on your needs

Based on Website/Vdir configuration, the Filesystem location may/not
be directly accessible via HTTP or support read (i.e. download) or
script/execute (i.e. run on server) access. Depends on if you want
users to have download access or not.

Proper configuration depends on your choice of security needs.

//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

ERoss
6/14/2007 9:33:20 AM

Thanks both -

More info - there is no anonymous upload - all accounts to access the
app are database driven -

I am hoping (but I am not a developer) that the coders can restrict file
type uploads (ie no EXE files)

There is nothing financial - so I don't need to worry about "bullet
proof" - but I want to make it at least difficult for a script kiddie to
dump a binary into a directory in IIS & call it

So yes, the user Identity on the server is the key one - the basic IUSR
account is running the web site - so I guess granting it write access in
one location would be easiest to maintain -

But again, in general is this safer outside of the inetpub environment ?

In article <u5BANujrHHA.532@TK2MSFTNGP06.phx.gbl>, mvpNoSpam@asu.edu
says...
[quoted text, click to view]

Roger Abell [MVP]
6/14/2007 11:08:31 PM

It might be best to have specificed to the coders the reqs to let admins
gate an install's allowance of uploads by type and max size. Admins
should be aware that "executability" depends on more than extension.

For storage just do it where a disk-full only blocks new writes (uploads,
page content mods, etc. i.e. not an app or OS due to lack of space).

I don't comment on privilege issues/concerns as I tend toward app
pool indentites that only traverse permit thread from their root to
a piece of their partition and general user permits in the system.

--
Roger

[quoted text, click to view]

David Wang
6/15/2007 12:08:51 AM

If you want to make it difficult to dump a binary into IIS and call
it, then you either:
1. Make sure no IIS directory has script/executables permission, so no
way to execute with IIS
2. Move the resource outside of HTTP namespace

However, this assumes that you do not have HTTP-accessible script
which transitively calls resources outside of HTTP namespace. For
example, for the gross sake of outlandishness, if you have /
Management.asp?execute=C:\windows\system32\cmd.exe , it doesn't matter
if you upload the binary outside of HTTP namespace if you have an HTTP-
accessible script which transitively crosses and executes code outside
the HTTP namespace boundary.

In other words, security is really about identifying and establishing
boundaries of trust and then access-controlling entities that cross
the boundary. There is nothing inherently secure/insecure about any
particular environment like inetpub. One can make inetpub secure or
insecure. One can also make non-inetpub secure or insecure.

//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about iis security

iis security : Upload best practice help !