Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 431What Does the .NET Framework Install?When you install the .NET Framework on a server that hosts IIS, the .NETFramework registers ASP.NET. As part of this process, a local, least privilegedaccount named ASPNET is created. This runs the ASP.NET worker process(aspnet_wp.exe) and the session state service (aspnet_state.exe), which can be used tomanage user session state.Note On server computers running Windows 2000 and IIS 5.0, all ASP.NET Web applications run ina single instance of the ASP.NET worker process and application domains provide isolation. OnWindows Server 2003, IIS 6.0 provides process-level isolation through the use of application pools.Table 16.2 shows the services, accounts, and folders that are created by a defaultinstallation of version 1.1 of the .NET Framework.Table 16.2 .NET Framework Installation DefaultsItem Details DefaultServices ASP.NET State Service: Provides support forStarted manuallyout-of-process session state for ASP.NET.Accounts and ASPNET: Account used for running the ASP.NET worker Added to Users groupGroups process (Aspnet_wp.exe) and session state service(Aspnet_state.exe).Folders %windir%\Microsoft.NET\Framework\{version}\1033\ASP.NETClientFiles\CONFIG\MUI\Temporary ASP.NET FilesISAPIExtensionsISAPI FiltersApplicationMappingsAspnet_isapi.dll: Handles requests for ASP.NET filetypes. Forwards requests to ASP.NET worker process(Aspnet_wp.exe).Aspnet_filter.dll: Only used to support cookie-lesssession state. Runs inside Inetinfo.exe (IIS) process.ASAX, ASCX, ASHX, ASPX, AXD, VDISCO, REM, SOAP,CONFIG, CS, CSPROJ, VB, VBPROJ, WEBINFO, LICX,RESX, RESOURCES\WINNT\Microsoft.NET\Framework\{version} Aspnet_isapi.dll