ASP.NET hosting & MS Access

[FARID]

We are trying to offer free ASP & ASP.NET hosting. I read alot of articles
and documentation in order to setup and offer ASP.NET and MS Access. Based
of what I read, MS Access requires FullTrust in order to work. Providing
fullTrust will be very risky in the ISP environment. In there anyway to lock
an application in it's directory and prevent accessing other customers data
while keeping MS Access support.
Please help.
Run each site in a separate application pool will not be an option because
we have to create thousands of application pools.

thanks alot

[Dominick Baier]

Hi,

the OleDb Provider in .NET has a full trust link-demand. the only way to use OleDb from partially trusted apps is through a sandboxed full trust assembly in the GAC...

this is some info i compiled on this topic:
[url]http://www.leastprivilege.com/PermaLink.aspx?guid=96a0e4af-7996-4e6a-b9fd-78ab8c0b29b5[/url]



---
Dominick Baier - DevelopMentor
[url]http://www.leastprivilege.com[/url]

nntp://news.microsoft.com/microsoft.public.dotnet.framework.aspnet.security/<elKB2x9pEHA.2432@TK2MSFTNGP15.phx.gbl>

We are trying to offer free ASP & ASP.NET hosting. I read alot of articles
and documentation in order to setup and offer ASP.NET and MS Access. Based
of what I read, MS Access requires FullTrust in order to work. Providing
fullTrust will be very risky in the ISP environment. In there anyway to lock
an application in it's directory and prevent accessing other customers data
while keeping MS Access support.
Please help.
Run each site in a separate application pool will not be an option because
we have to create thousands of application pools.

thanks alot



[microsoft.public.dotnet.framework.aspnet.security]

[Daniel Fisher\(lennybacon\)]

By default

>> MS Access requires FullTrust

But you can allow OleDB in a Custom or the Internet PermissionSet.

--
Daniel Fisher(lennybacon)
MCP C# ASP.NET
Blog: [url]http://www.lennybacon.com/[/url]



"FARID" <farid.almoqayed@xpandcorp.com> wrote in message
news:elKB2x9pEHA.2432@TK2MSFTNGP15.phx.gbl...

> We are trying to offer free ASP & ASP.NET hosting. I read alot of articles
> and documentation in order to setup and offer ASP.NET and MS Access. Based
> of what I read, MS Access requires FullTrust in order to work. Providing
> fullTrust will be very risky in the ISP environment. In there anyway to
> lock
> an application in it's directory and prevent accessing other customers
> data
> while keeping MS Access support.
> Please help.
> Run each site in a separate application pool will not be an option because
> we have to create thousands of application pools.
>
> thanks alot
>
>

[Daniel Fisher\(lennybacon\)]

Yep, Dominick!

--
Daniel Fisher(lennybacon)
MCP C# ASP.NET
Blog: [url]http://www.lennybacon.com/[/url]

[Dominick Baier]

yes, i know....but you need full trust to call the library (full trust link deman)



---
Dominick Baier - DevelopMentor
[url]http://www.leastprivilege.com[/url]

nntp://news.microsoft.com/microsoft.public.dotnet.framework.aspnet.security/<OzbpfZ$pEHA.3012@TK2MSFTNGP10.phx.gbl>

By default

>> MS Access requires FullTrust

But you can allow OleDB in a Custom or the Internet PermissionSet.

--
Daniel Fisher(lennybacon)
MCP C# ASP.NET
Blog: [url]http://www.lennybacon.com/[/url]



"FARID" <farid.almoqayed@xpandcorp.com> wrote in message
news:elKB2x9pEHA.2432@TK2MSFTNGP15.phx.gbl...

> We are trying to offer free ASP & ASP.NET hosting. I read alot of articles
> and documentation in order to setup and offer ASP.NET and MS Access. Based
> of what I read, MS Access requires FullTrust in order to work. Providing
> fullTrust will be very risky in the ISP environment. In there anyway to
> lock
> an application in it's directory and prevent accessing other customers
> data
> while keeping MS Access support.
> Please help.
> Run each site in a separate application pool will not be an option because
> we have to create thousands of application pools.
>
> thanks alot
>
>

[microsoft.public.dotnet.framework.aspnet.security]

[admin]

For testing, sorry

[FARID]

Thank you all for youe reply.

My understanding was the OLE DB and ODBC data resources demand full trust.
We can't use a custom policy.
In ISP environment, how can we allow users to use OLE DB and ODBC data
resources and at the same time lock
an application in it's directory??
How can we sandbox the resources?
Would you please send me a sample code with instruction how to configure the
web server?

Thanks alot



"Daniel Fisher(lennybacon)" <info@(removethis)lennybacon.com> wrote in
message news:OzbpfZ$pEHA.3012@TK2MSFTNGP10.phx.gbl...

> By default

> >> MS Access requires FullTrust

>
> But you can allow OleDB in a Custom or the Internet PermissionSet.
>
> --
> Daniel Fisher(lennybacon)
> MCP C# ASP.NET
> Blog: [url]http://www.lennybacon.com/[/url]
>
>
>
> "FARID" <farid.almoqayed@xpandcorp.com> wrote in message
> news:elKB2x9pEHA.2432@TK2MSFTNGP15.phx.gbl...

> > We are trying to offer free ASP & ASP.NET hosting. I read alot of

articles

> > and documentation in order to setup and offer ASP.NET and MS Access.

Based

> > of what I read, MS Access requires FullTrust in order to work. Providing
> > fullTrust will be very risky in the ISP environment. In there anyway to
> > lock
> > an application in it's directory and prevent accessing other customers
> > data
> > while keeping MS Access support.
> > Please help.
> > Run each site in a separate application pool will not be an option

because

> > we have to create thousands of application pools.
> >
> > thanks alot
> >
> >

>
>

[Dominick Baier]

Hi,

you are right - they demand full trust - so you will have problems with this scenario -

the only way to let a partial trust web app access OLEDB sources is through an intermediate full trust code in the GAC -

the only effective way to isolate full trust apps is to -

- give each webapp a different worker process

- use a different account for each worker process

- ACL everything for the specific worker process account - not IIS_WPG

- Set ACLs on the Metabase (so that a worker process cannot read the anonymous account and pwd from another app pool e.g.)

- Give every web app an individual temporary assemblies folder

a.s.o.

for links (especially to the threats and countermeasures paper and OWASP) consult this summary i wrote

[url]http://www.leastprivilege.com/PermaLink.aspx?guid=96a0e4af-7996-4e6a-b9fd-78ab8c0b29b5[/url]



---
Dominick Baier - DevelopMentor
[url]http://www.leastprivilege.com[/url]

nntp://news.microsoft.com/microsoft.public.dotnet.framework.aspnet.security/<uw#PVNuqEHA.3288@TK2MSFTNGP12.phx.gbl>

Thank you all for youe reply.

My understanding was the OLE DB and ODBC data resources demand full trust.
We can't use a custom policy.
In ISP environment, how can we allow users to use OLE DB and ODBC data
resources and at the same time lock
an application in it's directory??
How can we sandbox the resources?
Would you please send me a sample code with instruction how to configure the
web server?

Thanks alot



"Daniel Fisher(lennybacon)" <info@(removethis)lennybacon.com> wrote in
message news:OzbpfZ$pEHA.3012@TK2MSFTNGP10.phx.gbl...

> By default

> >> MS Access requires FullTrust

>
> But you can allow OleDB in a Custom or the Internet PermissionSet.
>
> --
> Daniel Fisher(lennybacon)
> MCP C# ASP.NET
> Blog: [url]http://www.lennybacon.com/[/url]
>
>
>
> "FARID" <farid.almoqayed@xpandcorp.com> wrote in message
> news:elKB2x9pEHA.2432@TK2MSFTNGP15.phx.gbl...

> > We are trying to offer free ASP & ASP.NET hosting. I read alot of

articles

> > and documentation in order to setup and offer ASP.NET and MS Access.

Based

> > of what I read, MS Access requires FullTrust in order to work. Providing
> > fullTrust will be very risky in the ISP environment. In there anyway to
> > lock
> > an application in it's directory and prevent accessing other customers
> > data
> > while keeping MS Access support.
> > Please help.
> > Run each site in a separate application pool will not be an option

because

> > we have to create thousands of application pools.
> >
> > thanks alot
> >
> >

>
>

[microsoft.public.dotnet.framework.aspnet.security]

[FARID]

I don't want to look stupid But how can I do that.

> the only way to let a partial trust web app access OLEDB sources is

through an intermediate full trust code in the GAC -

> the only effective way to isolate full trust apps is to -

I can't create a pool for each user. In this way, I have to create
thousands. In there any way around that.

> - give each webapp a different worker process
>
> - use a different account for each worker process
>
> - ACL everything for the specific worker process account - not IIS_WPG
>
> - Set ACLs on the Metabase (so that a worker process cannot read the

anonymous account and pwd from another app pool e.g.)

>
> - Give every web app an individual temporary assemblies folder
>
> a.s.o.
>
> for links (especially to the threats and countermeasures paper and OWASP)

consult this summary i wrote

>
>

[url]http://www.leastprivilege.com/PermaLink.aspx?guid=96a0e4af-7996-4e6a-b9fd-78ab8c0b29b5[/url]

>
>
>
> ---
> Dominick Baier - DevelopMentor
> [url]http://www.leastprivilege.com[/url]
>
>

nntp://news.microsoft.com/microsoft.public.dotnet.framework.aspnet.security/<uw#PVNuqEHA.3288@TK2MSFTNGP12.phx.gbl>

>
> Thank you all for youe reply.
>
> My understanding was the OLE DB and ODBC data resources demand full

trust.

> We can't use a custom policy.
> In ISP environment, how can we allow users to use OLE DB and ODBC data
> resources and at the same time lock
> an application in it's directory??
> How can we sandbox the resources?
> Would you please send me a sample code with instruction how to configure

the

> web server?
>
> Thanks alot
>
>
>
> "Daniel Fisher(lennybacon)" <info@(removethis)lennybacon.com> wrote in
> message news:OzbpfZ$pEHA.3012@TK2MSFTNGP10.phx.gbl...

> > By default

> > >> MS Access requires FullTrust

> >
> > But you can allow OleDB in a Custom or the Internet PermissionSet.
> >
> > --
> > Daniel Fisher(lennybacon)
> > MCP C# ASP.NET
> > Blog: [url]http://www.lennybacon.com/[/url]
> >
> >
> >
> > "FARID" <farid.almoqayed@xpandcorp.com> wrote in message
> > news:elKB2x9pEHA.2432@TK2MSFTNGP15.phx.gbl...

> > > We are trying to offer free ASP & ASP.NET hosting. I read alot of

> articles

> > > and documentation in order to setup and offer ASP.NET and MS Access.

> Based

> > > of what I read, MS Access requires FullTrust in order to work.

Providing

> > > fullTrust will be very risky in the ISP environment. In there anyway

to

> > > lock
> > > an application in it's directory and prevent accessing other

customers

> > > data
> > > while keeping MS Access support.
> > > Please help.
> > > Run each site in a separate application pool will not be an option

> because

> > > we have to create thousands of application pools.
> > >
> > > thanks alot
> > >
> > >

> >
> >

>
>
>
> [microsoft.public.dotnet.framework.aspnet.security]

[Dominick Baier]

i gave you a whole array of links to get smart about it.

in my blog entry i mention the Threats and Countermeasures Paper from MS patterns and practices - see chapter 9 for an example of sandboxing code in the gac.



---
Dominick Baier - DevelopMentor
[url]http://www.leastprivilege.com[/url]

nntp://news.microsoft.com/microsoft.public.dotnet.framework.aspnet.security/<Ok2zvOyqEHA.3728@TK2MSFTNGP09.phx.gbl>

I don't want to look stupid But how can I do that.

> the only way to let a partial trust web app access OLEDB sources is

through an intermediate full trust code in the GAC -

> the only effective way to isolate full trust apps is to -

I can't create a pool for each user. In this way, I have to create
thousands. In there any way around that.

> - give each webapp a different worker process
>
> - use a different account for each worker process
>
> - ACL everything for the specific worker process account - not IIS_WPG
>
> - Set ACLs on the Metabase (so that a worker process cannot read the

anonymous account and pwd from another app pool e.g.)

>
> - Give every web app an individual temporary assemblies folder
>
> a.s.o.
>
> for links (especially to the threats and countermeasures paper and OWASP)

consult this summary i wrote

>
>

[url]http://www.leastprivilege.com/PermaLink.aspx?guid=96a0e4af-7996-4e6a-b9fd-78ab8c0b29b5[/url]

>
>
>
> ---
> Dominick Baier - DevelopMentor
> [url]http://www.leastprivilege.com[/url]
>
>

nntp://news.microsoft.com/microsoft.public.dotnet.framework.aspnet.security/<uw#PVNuqEHA.3288@TK2MSFTNGP12.phx.gbl>

>
> Thank you all for youe reply.
>
> My understanding was the OLE DB and ODBC data resources demand full

trust.

> We can't use a custom policy.
> In ISP environment, how can we allow users to use OLE DB and ODBC data
> resources and at the same time lock
> an application in it's directory??
> How can we sandbox the resources?
> Would you please send me a sample code with instruction how to configure

the

> web server?
>
> Thanks alot
>
>
>
> "Daniel Fisher(lennybacon)" <info@(removethis)lennybacon.com> wrote in
> message news:OzbpfZ$pEHA.3012@TK2MSFTNGP10.phx.gbl...

> > By default

> > >> MS Access requires FullTrust

> >
> > But you can allow OleDB in a Custom or the Internet PermissionSet.
> >
> > --
> > Daniel Fisher(lennybacon)
> > MCP C# ASP.NET
> > Blog: [url]http://www.lennybacon.com/[/url]
> >
> >
> >
> > "FARID" <farid.almoqayed@xpandcorp.com> wrote in message
> > news:elKB2x9pEHA.2432@TK2MSFTNGP15.phx.gbl...

> > > We are trying to offer free ASP & ASP.NET hosting. I read alot of

> articles

> > > and documentation in order to setup and offer ASP.NET and MS Access.

> Based

> > > of what I read, MS Access requires FullTrust in order to work.

Providing

> > > fullTrust will be very risky in the ISP environment. In there anyway

to

> > > lock
> > > an application in it's directory and prevent accessing other

customers

> > > data
> > > while keeping MS Access support.
> > > Please help.
> > > Run each site in a separate application pool will not be an option

> because

> > > we have to create thousands of application pools.
> > >
> > > thanks alot
> > >
> > >

> >
> >

>
>
>
> [microsoft.public.dotnet.framework.aspnet.security]

[microsoft.public.dotnet.framework.aspnet.security]