How dangerous are ASPX and DLLs on a web server?

Also, here is a link to a pdf document for securing IIS 5, it includes security tips and patch suggestions.

http://sos.its.psu.edu/guides/IIS5.pdf

>> When you set up the web site, you should be also setting up a user that the website will run as.

Huh?

I simply create an FTP account that locks the user's uploads to a certain folder.

As far as an IIS user account...?  I don't create any.  Why do you need to create an IIS user account? The default "Operators" for all new virtual domains are "Administrator" and "computername\ASPNET"  This has always been the way I set up new virtual domains.

How do you set up this user you are referring to?  And why set up a user that currently isn't even necessary to execute aspx/dll from a remote web browser?

  1.  Right click on the website directory and select Properties from the popup menu.
   2. Select the Directory Security tab on the Properties dialog
   3. Click the Edit button under Anonymous Access and Authentication Control. The Authentication Methods dialog will appear.
   4. Check Anonymous Access and click the Edit button. The Anonymous User Account dialog will be displayed.
   5. Click the Browse button and then select the username that the website will run under from the Select NT User Account dialog.
   6. Click successive OK buttons until to save settings until you return to the Directory Security tab on the Properties dialog.
   7. Optionally, edit IP Address and Domain Name Restriction to prevent access to your website from unauthorized locations.

Here you go:

Internet Information Services (IIS) 5.0 Security Guidelines
http://www.microsoft.com/downloads/details.aspx?familyid=fa89d0f6-14a3-4ef5-85ab-fab049f2f56b&displaylang=en

>> Click the Browse button and then select the username that the website will run under
>> from the Select NT User Account dialog.

You are still losing me.

Any time you create a new virtual domain/web site in IIS, the anonymous user is already set up for you automatically, and it is always "IUSR_computername"

What's wrong with that?  What else am I supposed to change it to?

Well, the problem with leaving every website as IUSR_computername is, that user has access to everything in the wwwroot folder.  If they wanted to they could list every folder in the wwwroot folder, and then list every file in those folders, since they have complete access.  

If you look at reseller portals like Rack Space, they use control panels that allow users to setup new websites.   Every time you setup a new website it creates a new user to run that site under, which would be something like "IUSR_websiteusername".  That username has read/write access to their folder only, nothing else.

Here check this out, a full security check list.

http://windows.stanford.edu/docs/IISsecchecklist.htm

>> Well, the problem with leaving every website as IUSR_computername is,
>> that user has access to everything in the wwwroot folder.  

Well, can't I just delete the entire C:\Inetpub\wwwroot folder and not worry about this issue?

>> If they wanted to they could list every folder in the wwwroot folder, and then
>> list every file in those folders

But even if they do, what's the big deal about listing a bunch of default files that Microsoft installed?

>> Every time you setup a new website it creates a new user to run that site under, which
>> would be something like "IUSR_websiteusername".

Even if I were to create a new user account for each client who has a virtual web on my W: drive, how is that going to keep an aspx/DLL in their w:\their_account folder from deleting files in let's say "c:\winnt\system32" ?

Ok, I see what your getting at. Does IIS 5.0 have an application pool?  I know the default user is ASPNET on IIS 5.0, that is what the application code will run under.

If ASPNET user has read/write access to your c:\winnt\ folder, then they could really mess up your server, but if you only give that user access to the W:\, then that's all they can see.

>>  Does IIS 5.0 have an application pool?

I'm not quite sure I understand.  In the IIS Properties > Home Directory page there is an Application Settings section with Application Protection set currently to MEDIUM (POOLED).  Does that answer your question?

>> If ASPNET user has read/write access to your c:\winnt\ folder

Forgive my ignorance, but how would they have access to c:\winnt ?  That's basically what my question was about to start with.  So we've come full circle.

Yeah I think we got off track, I thought you were asking something different.  I'm not very familiar with Windows NT, but typically you would right click on the WinNT folder, and view the security permissions.  If ASPNET user is there, then they have access.  If not then they can't touch it.

On IIS6, there is an application pool,  each website runs either in a shared pool, or as individual applications which is more secure.  I haven't touched IIS 5.0 in about 10 years so I apologize if I'm naming things that you aren't familiar with.

>>  I'm not very familiar with Windows NT

I'm using Windows 2000 Server.

>> Typically you would right click on the WinNT folder, and view the security permissions

IUSR_computername does not have rights to any folder on c:\    IUSR_computername and ASPNET users only appear on drive W:\