Improving Web Application Security: Threats and - CGISecurity

Chapter 20: Hosting Multiple Web Applications 597Note The type of logon session created is controlled by the LogonMethod IIS Metabasesetting. The default is an interactive logon session, which requires the account to have the“Allow Log on Locally” user privilege.The Allow IIS to Control Password option is not available on IIS 6. IIS 6 sets the defaultLogonMethod to Network Cleartext, which requires the account to have the “Access thiscomputer from the network” user privilege. This allows the account to be authenticated by anetwork server.4. Configure NTFS permissions for each account to ensure that each account hasaccess only to the appropriate file system files and folders, and cannot accesscritical resources such as operating system tools.For more information about configuring NTFS permissions for the anonymousaccount, see Chapter 16, “Securing Your Web Server.”Note If you run the IISLockdown wizard, it creates a Web Anonymous Users group. Members ofthis group are denied access to system directories and tools.Fixed Identity ImpersonationWhen you need IIS to authenticate users for your application, for example by usingIntegrated Windows authentication or certificate authentication, you can use a fixedimpersonation identity to execute your ASP.NET application. This scenario is shownin Figure 20.4.ABCDEFWeb ServerIIS(inetinfo.exe)v-dir1v-dir2v-dir3ABCDEFASP. NET(aspnet_wp.exe)AppDomain1AppDomain2AppDomain3App1UserApp2UserApp3UserRemoteComputer(s)RemoteResourceRemoteResourceRemoteResourceIntegrated WindowsAuthenticationFixed AccountImpersonationFigure 20.4Applications impersonate a fixed account and use that to access resources