Server Permission Settings

[Jess]

Hello,

I'm not sure if I'm in the right area. I have asp pages that call a
database and sometimes updates it. The pages are under the root the database
is in a db folder under the root. My server guy isn't too sure what the
permissions should be on the server to these folders (root & db). Can you
give me some general instructions for this? Or point me in the right
direction for the answer?

Thanks

[Bob Barrows [MVP]]

Aaron Bertrand [SQL Server MVP] wrote:

I'm still not sure what you think "Full Control" grants IUSR that
read/write/modify does not, but okay.

It's similar to the difference between making a user an object owner (dbo)
and granting a user select/update/insert/delete permissions

"Full" grants the ability to modify permissions for the object. It is one
step down from object owner.
"Modify" grants only the ability to create/read/write/delete

Of course, the terminology varies depending on the OS.

Bob
--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

[Aaron Bertrand [SQL Server MVP]]

> "Full" grants the ability to modify permissions for the object. It is one

step down from object owner.

YES! Now can someone please enlighten me as to how a malicious user will
(a) know that you granted IUSR_ this extra permission, and (b) how they will
take advantage of it.

FWIW, I typically grant Full Control because I'm a lazy ignoramus. After
all, it's checking one box as opposed to three.

[Bob Barrows [MVP]]

Aaron Bertrand [SQL Server MVP] wrote:

"Full" grants the ability to modify permissions for the object. It
is one step down from object owner.
YES! Now can someone please enlighten me as to how a malicious user
will (a) know that you granted IUSR_ this extra permission, and

Obviously, unless he has physical/directory access to the machine, in which
case your goose is already cooked, he won't.
(b)
how they will take advantage of it.
No way that I can think of.

However, that does not invalidate the "least privilege" principle.
Neglecting it in one specific situation may make it easy to neglect it where
it really counts.

FWIW, I typically grant Full Control because I'm a lazy ignoramus.
After all, it's checking one box as opposed to three.

Again, it depends on the OS. On my machine, clicking Modify causes the lower
checkboxes to be checked. On older systems, yes, I remember having to check
multiple checkboxes.

And I will dispute that "lazy ignoramus" label.

Bob Barrows
--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

[Roland Hall]

"Aaron Bertrand [SQL Server MVP]" wrote in message
news:u$******** ******@TK2MSFTN GP12.phx.gbl...
:> "Full" grants the ability to modify permissions for the object. It is one
: > step down from object owner.
:
: YES! Now can someone please enlighten me as to how a malicious user will
: (a) know that you granted IUSR_ this extra permission, and (b) how they
will
: take advantage of it.

Well, then just give the anonymous user Full Rights to your entire web root
them. How will they know you granted the extra permission? After all, READ
rights are inclusive to Full Rights. Define "they". They the net user,
they the local user...?

: FWIW, I typically grant Full Control because I'm a lazy ignoramus. After
: all, it's checking one box as opposed to three.

I'm sorry to hear that. I may have to remove your pedestal. (O:=

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp

[Roland Hall]

"Jess" wrote in message
news:AF******** *************** ***********@mic rosoft.com...
: Thanks for the help.

While we differ slightly in our views, Aaron did direct you to a good
article to let you know you need at least modify rights on the folder
containing your database to solve your issue. Good luck to you.

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp