write permissions and security

[mark | r]

we're working on a cms system that allows the admin to upload files to the
server - the host (supplied by the client) says that opening write
permissions means that windows is open to exploits.

we're using FSO to move the file

anyone know a way of locking down this so its not 'open to exploits' ?

thanks

mark

[Jeff Cochran]

On Mon, 6 Sep 2004 13:21:41 +0100, "mark | r" <ma******@gmail.com>
wrote:

we're working on a cms system that allows the admin to upload files to the
server - the host (supplied by the client) says that opening write
permissions means that windows is open to exploits.

we're using FSO to move the file

anyone know a way of locking down this so its not 'open to exploits' ?

You can either deny writes and be safer or allow them and be less
safe. In your case, you have to sacrifice one element of security in
order to provide functionality, but that's what all security decisions
entail. Some might argue that the primary cause of all exploits is
having a computer. At least until your toaster gets hacked and used
for serving WaReZ bagels...

Jeff

[Roland Hall]

"mark | r" wrote in message
news:41**********************@news.dial.pipex.com. ..
: we're working on a cms system that allows the admin to upload files to the
: server - the host (supplied by the client) says that opening write
: permissions means that windows is open to exploits.
:
: we're using FSO to move the file
:
: anyone know a way of locking down this so its not 'open to exploits' ?

Hi Mark...

This does not have to be a security issue. Opening write permissions to a
data repository that then gets processed by the server to move the files
where they need to be can be quite secure. You can put as many layers of
security on this as you need. You could define a VPN between you, with SSL
connectivity, logon with name/password, MD5 checksum, acceptance of only
specific IPs in your tunnel, call back, etc.

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp