Run IIS -- iis security

Ken Schaefer
3/28/2008 4:45:06 PM

It is not supported running them as any other user. Why do you want to do
this?

Cheers
Ken

--
My IIS blog: http://adopenstatic.com/blog

[quoted text, click to view]

Don Jones
3/29/2008 6:40:01 PM

Thanks, the outside auditor's has made it a requirement for our accrediation;
If it's not supported, then I'll let them know.

Thanks.

[quoted text, click to view]

David Wang
3/30/2008 4:08:29 AM

IIS Services must run as LocalSystem. Any other setting is
unsupported. So, sure, you can change it and make sure that IIS no
longer runs, so obviously you're secured and you pass the security
accreditation! ;-) No really, in all seriousness, tell the auditor
that their requirement is bogus.

With IIS6, there is really NO reason to change the IIS Services
credentials because they are not used to execute user code. User code
are executed in Application Pools with separate w3wp.exe processes,
which you *can* control the user credentials, and those credentials
are the minimally privileged Network Service account by default.

If you are running Application Pools as LocalSystem, that is not by-
default, so the auditor has a right to complain, and you must explain
to your auditor why it is required by your application or else change
it to something else.

If you are NOT running Application Pools as LocalSystem AND your
outside auditor is complaining about the service credential of IIS6 as
LocalSystem, then it tells me the outside auditor has no idea what s/
he is talking about and is possibly just running through some script
and charging you money for it.

//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

On Mar 29, 6:40=A0pm, Don Jones <DonJo...@discussions.microsoft.com>
[quoted text, click to view]

Ken Schaefer
3/31/2008 10:37:42 AM

It sounds like the outside auditor has a checklist that's not really based
on anything substative security wise.

Inbuilt services on Windows Server 2003 ship with least privileges as is.
Shifting them to custom user accounts will probably give them more
privileges than they actually require.

As David points out - you would gain more benefit by looking at the user
privileges your web appl pools have (and your Anonymous User account). If
you want to prevent those applications from interfering with each other,
then you may wish to run those as custom user accounts (and ACL your hard
disk files accordingly)

Cheers
Ken

[quoted text, click to view]

Ross Culver
3/31/2008 4:23:25 PM

Perhaps the auditor actually meant for a specific application/site to run on
a domain-level security or an access-specific account? You can certainly
run sites and applications using different credentials.

Ross

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about iis security

iis security : Run IIS