Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 581UNC SharesThere are two main ways that your ASP.NET application might use UNC shares:● Accessing files on UNC sharesFor example, your application must access a remote file such as\\remoteserver\share\somefile.dat.● Hosting applications on UNC sharesYour application’s IIS virtual directory is mapped to a remote share, for example,\\remoteserver\appname. In this scenario, HTTP requests are processed by yourWeb server, but the application’s pages, resources, and private assemblies arelocated on the remote share.Accessing Files on UNC SharesIf your application accesses files on a UNC share, the ASP.NET process account orany impersonation identities must have the appropriate access rights defined by theACL on the share and on the underlying directory or file.If you use the local ASPNET process account, this does not have a network identity,so you must create a mirrored account on the remote server with a matching username and password, or you must use a least privileged domain account that hasaccess to both servers. On Windows Server 2003, the NetworkService account that isused to run ASP.NET Web applications can be authenticated over the network, so allyou need to do is grant access rights to the machine account.Hosting Applications on UNC SharesYou can use IIS to configure a virtual directory to point to a UNC share located onanother computer, for example \\remoteserver\appname. When you do so, IISprompts you to supply account credentials, which it uses to establish a connection tothe remote computer.Note The account credentials are stored in encrypted format in the IIS metabase but are availablethrough an API. You should ensure that you use a least privileged account. For more information, seeMicrosoft Knowledge Base article 280383, “IIS Security Recommendations When You Use a UNCShare and Username and Password Credentials.”If your application resides on a UNC share, ASP.NET impersonates the IIS-providedUNC token (created from the account credentials that you supplied to IIS) to accessthat share, unless you have enabled impersonation and have used a fixedimpersonation identity, as shown with the following configuration: