2

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group.

What are the security implications of granting AppPoolIdentity modify and create permissions in the intepub/wwwroot/website/ directory? Are there any ways to mitigate these risks?

In my particular instance, it is for an ASP.NET website that needed these privileges for logging and reporting.

3

It is perfectly normal for a website to need write access to one or more folders under it's web root. The AppPoolIdentity is the best thing to use for application pool identities as it does not create a windows user account that can be compromised. Instead it generates a new local user on the fly when the application pool is started. Granting the AppPoolIdentity write permission to the entire wwwroot would be my only concern. Instead you can just give it modify access to the particular logs or reports folder to minimize any sort of risk.

EDIT: Restricting write access mitigates any damage that could be caused by a compromised application. Write access to the entire wwwroot would give full access to rewrite entire site (if compromised) compared to if you only gave write permissions to the logs folder. They would have to compromise the OS/NTFS Permissions to get past that so it is an added layer of security.

  • What are the potential issues with write permission for the entire wwwroot? – Ryan Gates Jan 24 '14 at 14:57
  • 1
    Updated answer. – Brock Hensley Jan 24 '14 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.