Improving Web Application Security: Threats and - CGISecurity

596 Part IV: Securing Your Network, Host, and Application To use multiple anonymous accounts for resource accessThis procedure describes how to use multiple anonymous accounts, one per Webapplication, for resource access to support individual application authorization andauditing.1. Create new anonymous user accounts, one per application.For more information about creating an anonymous user account, see the“Accounts” section in Chapter 16, “Securing Your Web Server.”If you need to access remote resources using the anonymous account, either use aleast privileged domain account, or use a local account and create a duplicatedlocal account on the remote server with a matching user name and password.2. Use tags in Machine.config to configure each Web application forimpersonation.The allowOverride=“false” setting prevents an individual application fromoverriding this setting in a Web.config file. For more information about the element, see “Machine.config and Web.config Explained” inChapter 19, “Securing Your ASP.NET Application and Web Services.”3. Use Internet Services Manager to configure each application’s virtual directory touse a separate anonymous user account.a. Start Internet Services Manager from the Administrative Tools program group.b. Select the application’s application directory, right-click and then clickProperties.c. Click the Security tab and then click the Edit button.d. Ensure Anonymous access is selected and click Edit.e. Enter the user name for the anonymous account that you have created, or clickBrowse to select the user name from a list.f. If you want to use the account to access a remote resource, clear the Allow IISto Control Password checkbox for the anonymous account.If you select Allow IIS to Control Password, the logon session created usingthe specified anonymous account has NULL network credentials and cannot beused to access network resources where authentication is required. If you clearthis checkbox, the logon session is an interactive logon session with networkcredentials. However, if the account is local to the machine, no other machineon the network can authenticate the account. In this scenario, create a duplicateaccount on the target remote server.