Configuring security for a site in Windows 2003

[Chris Leffer]

Hi.

I am developing my first web site using asp.net and IIS 6 and have some
doubts about security. My site will be available on the internet and my
users won't use windows integrated security. The authentication process
relies on a database and forms authentication. But I also wants to
restrict unauthorized access from people inside my department, to the
folders of the application, and I think that NTFS security can be the
way to go. My question is, how exactly should I configure NTFS security
to allow only me and another programmer to write to this folder? Will it
avoid that my internet users writes to the folders too? At this moment,
I see that several accounts (network services, guest, administrators...)
have access to the folders. Is it ok?

Thanks for your time and sorry for the basic questions.

Chris Leffer

*** Sent via Developersdex [url]http://www.developersdex.com[/url] ***
Don't just participate in USENET...get rewarded for it!

[Raterus]

Chris,
Look over this article until you get it, this is how you will want to do it as far as your asp.net application is concerned. NTFS permissiosn is your last line of defence and should be configured as additional security, but hopefully your asp.net application will behave well enough that people can only do what you configure them to do, regardless of NTFS permissions.

[url]http://aspnet.4guysfromrolla.com/articles/082703-1.aspx[/url]

--Michael


"Chris Leffer" <chrisl@wank.com> wrote in message news:%23Ync$ruhEHA.2812@tk2msftngp13.phx.gbl...

> Hi.
>
> I am developing my first web site using asp.net and IIS 6 and have some
> doubts about security. My site will be available on the internet and my
> users won't use windows integrated security. The authentication process
> relies on a database and forms authentication. But I also wants to
> restrict unauthorized access from people inside my department, to the
> folders of the application, and I think that NTFS security can be the
> way to go. My question is, how exactly should I configure NTFS security
> to allow only me and another programmer to write to this folder? Will it
> avoid that my internet users writes to the folders too? At this moment,
> I see that several accounts (network services, guest, administrators...)
> have access to the folders. Is it ok?
>
> Thanks for your time and sorry for the basic questions.
>
> Chris Leffer
>
> *** Sent via Developersdex [url]http://www.developersdex.com[/url] ***
> Don't just participate in USENET...get rewarded for it!