IIS Server Security - IIS Security on Windows XP SP2

This is Interesting: Free IT Magazines  
Home > Archive > IIS Server Security > December 2004 > IIS Security on Windows XP SP2





You are viewing an archived Text-only version of the thread. To view this thread in it's original format and/or if you want to reply to this thread please [click here]

Author IIS Security on Windows XP SP2
Jayme Pechan

2004-12-09, 6:19 pm

I just installed SP2 on my machine and now my web applications don't work.
It says, "
You are not authorized to view this page"
So I add the ASPNET user and IUSR_COMPNAME with explicit permissions to the
directory. I also did the security wizard and selected "Public Site" and
told it to replace permissions. It is set to only allow anonymous access.
Anyone know what else I would be missing here? Thanks.


David Wang [Msft]

2004-12-10, 2:53 am

First, undo all your changes. You are currently randomly changing
permissions with no idea what is actually wrong, which can be very dangerous
to the security and operations of your web server.

Then, uncheck IE's "Show Friendly HTTP Errors" option and report the actual
HTTP error code (looks like 403.x), as well as look in the IIS web log for
that failed request for the Win32 error code. We will start there.
Troubleshooting always begins by observing and gathering information about
the initial failure, analyzing it for possibilities, and repeat until a
conclusion is reached. Random guesses based on incomplete information can
lead to faulty conclusions and faulty configuration.


For example:
1. Adding ASPNET user and IUSR_COMPNAME with explicit permissions has
nothing to do with authorization failure. Authorization means that a user
account already authenticated but failed to access for some reason. Adding
additional users has no effect on the authorization of another user -- but
changing the correct user's permissions or authorization criteria will have
an effect.
2. Security Wizard enables Anonymous access, but how are you guaranteed that
the web browser actually use anonymous access?

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Jayme Pechan" <jayme.pechan@whitefeld.com> wrote in message
news:eNRLzZh3EHA.3452@TK2MSFTNGP10.phx.gbl...
I just installed SP2 on my machine and now my web applications don't work.
It says, "
You are not authorized to view this page"
So I add the ASPNET user and IUSR_COMPNAME with explicit permissions to the
directory. I also did the security wizard and selected "Public Site" and
told it to replace permissions. It is set to only allow anonymous access.
Anyone know what else I would be missing here? Thanks.



Sponsored Links






Free braindumps | Software forum | Database administration forum

Copyright 2003 - 2008 webservertalk.com