Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Normally in the past, I've managed that the production server only serves http(s) to the internet, and is isolated from it's database by a firewall which only allows database queries to travel. However, I have a situation where a bunch of workers using MS office manipulate files living on a domain. These files also need to be served to customers, so I was thinking that the webserver could have domain privileges such that it could access the folders with those files and only those folders. Obviously this means that the filewall separating the webserver from the domain would need to allow a bunch of ports, for being authenticated to the domain, file sharing, etc. How unsafe is this? Any advice on how to make it better? It'd be IIS 7.5 running on 2008.

share|improve this question
    
Are you asking about the server being joined to the domain, or the IIS user itself having advanced privileges in the domain? –  Scott Pack Mar 28 '11 at 20:12
    
really both. However, I already planned that whatever IIS user itself would have only basic rights, meaning read-only file rights to a few directories. –  Knox Mar 28 '11 at 20:48

2 Answers 2

up vote 3 down vote accepted

This generally isn't much of a problem. Lots of people need to do this. There is a good discussion on the IIS forums here: http://forums.iis.net/t/1175096.aspx

There is also a good high level overview on TechNet: http://technet.microsoft.com/en-us/library/cc731278(WS.10).aspx

And the ports required for Windows Auth: http://support.microsoft.com/kb/832017

share|improve this answer
    
very good tips; thank you. –  Knox Mar 28 '11 at 20:51

I suggest an audit of this IIS server be done with the Microsoft TCM Spider tool. I believe that Coalfire Systems has a contract to provide this service with the Microsoft ACE team.

It also depends on what else runs on the IIS server. For example, MySQL (not normally installed in a Windows environment, but it's good to specify these things) will run under the SYSTEM account. If it becomes compromised through a SQL injection, then it is likely that all accounts, including domain accounts, will be compromised.

However, the situation doesn't differ much if MS-SQL is installed, although recent version of MS-SQL are at least run with lower privileges.

share|improve this answer
    
I did not know about the Spider tool. Thank you, and good info about later versions of MS-SQL running with lower privileges. I'm still at 2005, maybe that's reason enough to go to a higher level. –  Knox Mar 29 '11 at 20:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.