Groups | Blog | Home
all groups > iis security > april 2008 >

iis security : IIS6, IIS7 and VS2005


Paul Calderon
4/23/2008 6:34:42 PM
I'm developing an web application with DCOM interfaces.

When I run the application from VS2005 (internal Web Server), I don't have
any problem accessing to the DCOM hosted by another machine.

When I run the application from a virtual directory configured in IIS 7
(Windows Vista), I can access too without problems.

But When I run the application from a virtual directori configured in IIS6
(Windows 2003 Server), I can't access to the DCOM machine.

I try everything, same users and passwords, same workgroup, etc, but the
problem is just with IIS6.

Any suggestion
David Wang
4/24/2008 4:25:02 AM
[quoted text, click to view]


This does not look like an IIS6 problem because it does nothing
special for or against DCOM.

You need to start looking at what is different between the machines
and your requirements of DCOM.

For example, is the firewall enabled on Windows Server 2003. DCOM can
require additional inbound ports which if denied by the firewall
causes failures, and the Windows Server 2003 firewall is very
restrictive.

And on what OS are you running the VS 2005 test? Windows Server 2003
or some other OS?


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
Paul Calderon
4/24/2008 9:35:06 AM
I have 3 Machines

Machine 1 (DCom Container) Windows 2003 Server

Machine 2 (Web App Container) Windows 2003 Server

Machine 3 (Developer Machine) Windows Vista


Machine 1 have just the components we need to access from network (GIS
Components)

Machine 2 have the website over IIS6 (can't access to the Machine 1
components), but if i run from Visual Studio there, the components are
accesible.

Machine 3 have a copy of the site over IIS7 (Vista), and there is no
problem, when I run in Visual Studio, the components are accesible too

All the firewalls are disabled.

In this scenario we have 3 web servers, (IIS6, IIS7 and Visual Studio Web
Server), I think is the way how each server try to connect to machine1, I'm
using the same impesonalization from the 3 webservers, but I have problems
just with IIS6

Any other suggestion

"David Wang" <w3.4you@gmail.com> escribió en el mensaje de noticias
news:b5758e81-4633-4ea0-b43e-1b371aca5df7@j33g2000pri.googlegroups.com...
[quoted text, click to view]


This does not look like an IIS6 problem because it does nothing
special for or against DCOM.

You need to start looking at what is different between the machines
and your requirements of DCOM.

For example, is the firewall enabled on Windows Server 2003. DCOM can
require additional inbound ports which if denied by the firewall
causes failures, and the Windows Server 2003 firewall is very
restrictive.

And on what OS are you running the VS 2005 test? Windows Server 2003
or some other OS?


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
David Wang
4/24/2008 6:43:40 PM
[quoted text, click to view]


What authentication protocol are using, and are you trying to
impersonate using that user credential.

All secured protocols will not allow you to impersonate and hop off
the box.

When you run from Visual Studio, you do so as the interactive logon
user so there is no "double hop".

However, when you make a request to IIS to do the same thing, that is
double-hop. This is classic security behavior of Windows.

IIS6 and IIS7 haven't changed how the security model works, so your
configuration difference between them will give you the hint.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
Paul Calderon
4/24/2008 9:34:13 PM
I'm Impersonating from my asp.net app with the Administrator User, but I
think is the way how IIS from one machine is recongized over the DCom server

"David Wang" <w3.4you@gmail.com> escribió en el mensaje de noticias
news:0c029d5f-c4c4-49ba-beea-a4ce6af11373@q1g2000prf.googlegroups.com...
[quoted text, click to view]


What authentication protocol are using, and are you trying to
impersonate using that user credential.

All secured protocols will not allow you to impersonate and hop off
the box.

When you run from Visual Studio, you do so as the interactive logon
user so there is no "double hop".

However, when you make a request to IIS to do the same thing, that is
double-hop. This is classic security behavior of Windows.

IIS6 and IIS7 haven't changed how the security model works, so your
configuration difference between them will give you the hint.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
AddThis Social Bookmark Button