Improving Web Application Security: Threats and - CGISecurity

Chapter 20: Hosting Multiple Web Applications 599To configure impersonation at the application level, use an element inthe application’s Web.config file as shown below.4. Configure NTFS permissions for each account to ensure that each account hasaccess only to the appropriate file system files and folders, and no access to criticalresources such as operating system tools.For more information about configuring NTFS permissions for the anonymousaccount, see Chapter 16, “Securing Your Web Server.”Note On Windows 2000 and the .NET Framework version 1.0, if you impersonate a fixed identity byusing the above configuration, you must grant the “Act as part of the operating system” privilege tothe ASP.NET process account used to run your Web applications. This is contrary to the principle ofleast privilege. You are recommended to upgrade to the .NET Framework version 1.1 where this is nolonger a requirement.Isolating Applications with Application PoolsIf your applications run on Windows Server 2003, you can use application pools andconfigure each application to run in its own worker process that provides processlevelisolation. By default, all applications run in a default application pool. Withapplication pools, you can configure each process to run using a separate identityand, as a result, you do not need to use impersonation. To provide process level isolation1. Create a set of new Windows accounts, one per application to run each workerprocess instance.2. Configure NTFS permissions for each account to ensure that each account only hasaccess to the appropriate file system files and folders, and cannot access criticalresources such as operating system tools.For more information about configuring NTFS permissions for the anonymousaccount, see Chapter 16, “Securing Your Web Server.”3. Disable Web application impersonation.You can do this in Machine.config or Web.config. To disable impersonation formultiple applications in Machine.config, place elements inside elements as shown below.