Improving Web Application Security: Threats and - CGISecurity

Chapter 20: Hosting Multiple Web Applications 593Run as “NT Authority\NetworkService” or configuredaccountIIS Worker Process(w3wp.exe)aspnet_isapi.dllIIS Worker Process(w3wp.exe)aspnet_isapi.dllIIS Worker Process(w3wp.exe)aspnet_isapi.dllWeb App1Web App2Web App3User ModeKernel ModeHTTPRequestshttp.sysASP.NET StateService(aspnet_state.exe)Runs asASPNETFigure 20.2ASP.NET architecture on Windows Server 2003 with IIS 6Compared to the ASP.NET architecture under Windows 2000, the primary differencein Windows Server 2003 is that separate IIS worker process instances (W3wp.exe) canbe used to host Web applications. By default, these run using the NTAuthority\NetworkService account, which is a least privileged local account thatacts as the computer account over the network. A Web application that runs in thecontext of the Network Service account presents the computer’s credentials to remoteservers for authentication.Configuring ACLs for Network ServiceConfiguring an access control list (ACL) for the Network Service account varies forlocal and remote machines. If you want to grant access to the Network Serviceaccount on the local machine, add the Network Service account to an ACL. If youwant to grant access to the Network Service account on a remote machine, add theDomainName\MachineName$ account to an ACL.Note Do not confuse the Network Service account with the Network built-in group, which includesusers who were authenticated across the network.