Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 447●Assign permissions to groups instead of individual accounts.Assigning users to groups and applying permissions to groups instead ofindividual accounts is good practice. For the anonymous account, create a groupand add the anonymous account to it and then explicitly deny access to the groupfor key directories and files. Assigning permissions to a group allows you to moreeasily change the anonymous account or create additional anonymous accountsbecause you do not need to recreate the permissions.Note IISLockdown denies write access to content directories for the anonymous account byapplying a deny write access control entry (ACE) for the Web Anonymous Users and WebApplications groups. It also adds a deny execute ACL on command-line tools.●Use separate accounts for separate applications.If your Web server hosts multiple applications, use a separate anonymous accountfor each application. Add the accounts to an anonymous Web users group, forexample, the Web Anonymous Users group created by IISLockdown, and thenconfigure NTFS permissions using this group.For more information about using multiple anonymous accounts and hostingmultiple applications, see Chapter 20, “Hosting Multiple ASP.NET Applications.”Secure or Remove Tools, Utilities and SDKsSDKs and resource kits should not be installed on a production Web server. Removethem if they are present.● Ensure that only the .NET Framework Redistributable package is installed on theserver and no SDK utilities are installed. Do not install Visual Studio .NET onproduction servers.● Ensure that access to powerful system tools and utilities, such as those containedin the \Program Files directory, is restricted. IISLockdown does this for you.● Debugging tools should not be available on the Web server. If productiondebugging is necessary, then you should create a CD that contains the necessarydebugging tools.Remove Sample FilesSample applications are typically not configured with high degrees of security. It ispossible that an attacker could exploit an inherent weakness in a sample applicationor in its configuration to attack your Web site. Remove sample applications to reducethe areas where your Web server can be attacked.Additional ConsiderationsAlso consider removing unnecessary Data Source Names (DSNs). These contain cleartext connection details used by applications to connect to OLE DB data sources. Onlythose DSNs required by Web applications should be installed on the Web server.