IIS 7.5 WebDav Security Issues with Students

Question

Hello Currently I am setting up a server for college students (this includes tech-savy IT students as well) and I will be using IIS 7.5 with Webdav for the students to access their files from home. The built-in Webdav filters out all dangerous file extensions (php,asp,etc dangerous server code) and I was wondering if there is any way for them to break out of these extensions and/or compromise the system. The new version of Webdav seems good enough for me to trust and I was wondering if anyone had some experience or advice with the newer versions of the file system.

Also I am not looking for suggestions on different types of file servers, I know a few I could use and I already have the files on my server ready for IIS 7.5.

Thank you

Answer 1

I'd go the other way round, disable script execution for all upload directories.

http://www.aspplayground.net/community/Disable-script-execution-for-the-upfiles-folder-m376885.aspx

File extensions are not dangerous, code execution is. Depending on the server configuration it might be possible to rename a file through some backdoor or execute scripts even if the extension is wrong (I've seen webservers executing php in .html files, so it's not entirely impossible for someone to screw up the configuration so that the php interpreter runs over every file). Maybe updates break your security (.php6 suddenly might work, too) or someone installs support for a new language.

Also students might want to upload .php only to work on those. Especially if you are expecting IT Students.