473,660 Members | 2,459 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Issues in locking down aspnet user security in shared environment

I am trying to lock down file access of some sites in a shared hosting
environment so that different users can only access their own site's
directory with their asp.net code. However there's a problem with some
aspnet user access.

[I enabled identity impersonate in machine.config and made allowoveride =
false.]

After some experimenting with ntfs permissions, I noticed that any asp.net
enabled site *must* have asp.net user have read access on the folder above
the application folder plus have read access to the web.config file,
regardless whether the site is impersonating another user.

This means any asp.net site can list the files of any other asp.net enabled
site plus read someone else's web config file which might contain sensitive
non encrypted settings.

Does anyone see a security hole in this security model? In some cases you
can display or even download files by just looking at someone else's site
folder and typing the url + filename in a browser. Like an .mdb file if the
user didn't password protect their sensitive folder.

How can I plug this hole with better lockdown? I was going to look at the
<location.. > tag and trust levels and see if they help.
Is there any whitepaper on how to very securely lockdown asp.net sites in a
shared environment?

Thanks.

John

Nov 17 '05 #1
0 1141

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

28
2786
by: grahamd | last post by:
Who are the appropriate people to report security problems to in respect of a module included with the Python distribution? I don't feel it appropriate to be reporting it on general mailing lists.
16
8920
by: Nid | last post by:
How do I do row-level locking on SQL Server? Thanks, Nid
3
17782
by: Philip V Pham | last post by:
These questions apply to std vector, map, and cout: I am uncertain of the thread safety for reading/writing for std templates. I know if all threads are reading concurrently, it is thread safe. However, I have this situation: Case 1: map thread 1 ---------
16
2878
by: Justin Lazanowski | last post by:
Cross posting this question on the recommendation of an I have a .NET application that I am developing in C# I am loading information in from a dataset, and then pushing the dataset to a grid, or other controls depending on the particular form. This application is setup with one MDI parent calling MDI children with the exception of one Modal form (the report viewer). When I run the application and run one of the screens that pulls...
2
1784
by: Sanjay Poojari | last post by:
Hi All, Need some advice on some of the security issues in my ASP.Net application. There are certain tasks that I need to implement so need advice/guidance on them as well as safeguards that I should implement. The application would be typically running on Windows Server 2003 with IIS6 with .Net framework 1.1 1. My application saves its settings to the registry. I know that by default the Aspnet user does not have rights to edit the...
0
935
by: John Dalberg | last post by:
I am trying to lock down file access of some sites in a shared hosting environment so that different users can only access their own site's directory with their asp.net code. However there's a problem with some aspnet user access. After some experimenting with ntfs permissions, I noticed that any asp.net enabled site *must* have asp.net user have read access on the folder above the application folder plus have read access to the...
15
6187
by: z. f. | last post by:
Hi, i have an ASP.NET project that is using a (Class Library Project) VB.NET DLL. for some reason after running some pages on the web server, and trying to compile the Class Library DLL, it can't compile because the DLL is in use (and the PDB too), and the w3wp.exe process is the process locking the DLL (as viewed with Sysinternals - Process Explorer). this is a huge problem. i need to do IIS reset in order to free the DLL! 1. why is...
4
1813
by: IcedCrow | last post by:
I have stumbled upon a serious problem and I hope someone can help me out. I have programmed a web service in VB.NET. When I use integrated security for the piece, of course it does not use my log in but the ASP log in. No problem. I get an error. So first in experiment I try and use the sa account. I
10
3077
by: Robert | last post by:
I have an app that was originally 1.1, now migrated to 2.0 and have run into some sporadic viewstate errors...usually saying the viewstate is invalid, eventvalidation failed or mac error. My web config does specify a machinekey setting: <machineKey validationKey="447C05E8B3A71401CC4CAE5513A7F1A3494A3618EE819316AAD1D58433F236A759D66FB4154500E01EB4E1BC1DE42046E2D652D391CB8367A1649438867A02EB"...
0
8341
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
0
8754
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
1
8542
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
8630
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
0
7362
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
5650
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
4177
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
4343
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
2760
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.