Repository navigation
iisnode on server 2016 with shared websites permissions error - need advise #124
Description
We are running a 2016 server with shared websites, the sites location is in a folder c:\domains\ each acct has its own folder with its subfolder wwwroot where they run their webs from, installing node on this seems to require that the iusr group has full permissions to the domains folder. Surely this is a security risk which could allow other sites to then traverse the folder structures ? What rights or setup would be needed in a case like this. If I dump the users folder into the root and set the website up to use this user1 folder and give iusr grp full permission it works fine. But this is not how our folder structures work in the cp.
Plse advise
Activity
joegasper commentedon Feb 10, 2022
Assumptions: 1 to 1 IIS website to apppool to service account for the apppool.
Create a service account for the apppool: domain\website.one.com_svc
Create security group for users: website.one.com_users
Create security group for apppool account: website.one.com_app
Add account website.one.com_svc to group website.one.com_app
Create a "rollup" security group for all user groups: rollup_users
Create a "rollup" security group for all apppool groups: rollup_app
Add group website.one.com_app to rollup_app
Add group rollup_app to local group: localservername\IIS_IUSRS
Assuming default drive permissions...
On folder C:\domains break permission inheritance and remove localcomputer\Users permissions.
On folder C:\domains give group rollup_users read to This folder only.
On folder c:\domains\website.one.com give group website.one.com_users read to This folder only.
On folder C:\domains\website.one.com\wwwroot give group website.one.com_app read permissions.
On folder C:\domains\website.one.com\wwwroot give group website.one.com_users modify permissions. (Users could rename the wwwroot folder, so could apply modify for their group to Subfolders and files only. Or up one folder if you are placing site logs under the sites' folder, too.)
Create subfolder C:\domains\website.one.com\wwwroot\iisnode and give group website.one.com_app modify permissions (where iisnode will write its error logs).
Create share called "websites$" at C:\domains", enable it for access-based enumeration (ABE is important) and give group rollup_users share-level Write/Read permissions (and give Administrators or some server admin group full control if needed, too). ABE will allow the users for website.one.com to only see their site's folder when they visit \webserver\websites$ path.
Create an apppool: website.one.com
Set its identity to the apppool service account (advanced settings).
Recommend setting the apppool to never recycle and idle time-out to zero.
Create new IIS Site Name: website.one.com, use the corresponding apppool created for it.
Bind the domain name.
Site root: c:\domains\website.one.com\wwwroot
Connect As: Application user (pass-through authentication) (this will use the apppool's account for accessing the site's root)
Ensure at the server root in IIS, for IIS Authentication, Anonymous Authentication is set to "Application pool identity".
Add to local HOSTS file:
127.0.0.1 website.one.com
Add a generic index.htm page to wwwroot and give it a local test.
kdovale commentedon Feb 10, 2022
joegasper commentedon Feb 11, 2022
Ah, you are hitting this issue. Sorry, I forgot that I dealt with that, too:
tjanczuk#247
My folder structure is:
s:\websites\domain1\slot1
s:\websites\domain1\slot2
s:\websites\domain2\slot1
s:\websites\domain2\slot2
The slot# folders are the IIIS site's root folders (we switch between each domain's slot1/slot2 as devs deploy new code).
I give the site's individual apppool account read at \domain#\ folder level.
At s:\websites the group IIS_IUSRS has Read access set to "This folder only".
kdovale commentedon Feb 11, 2022
kdovale commentedon Mar 10, 2022
kdovale commentedon Mar 10, 2022
kdovale commentedon Mar 10, 2022