« Previous Next »

Thread: White-Paper on Secure Scalability of IIS 6.0 web apps (Windows Server 2003 R2)

Last post 04-21-2008 9:00 AM by Rovastar. 6 replies.

Average Rating Rate It (5)

RSS

Page 1 of 1 (7 items)

Sort Posts:

  • 04-18-2008, 1:38 PM

    White-Paper on Secure Scalability of IIS 6.0 web apps (Windows Server 2003 R2)

    Hello,

    I've been tasked on coming up with the "best practices" scalability (and security) model for adding 1 - n .Net 3.0 web apps onto IIS 6.0. The apps are almost similar, except for small customizations here and there for each customer (graphics, reports etc.).

    I'm looking for a single document that outlines the most secure way to deploy multiple web apps on a single box, running Windows Server 2003 R2, where IIS 6.0 is the default web server.

     This (hopefully) would include best practices for internal IP configurations against a single NIC card as point of entry...generally everything you'd need to consider to ensure each customers data is secure. We are also planning on getting SSL implemented as well.

     If anyone has any links to where I might find all this information encapsulated, I'd be most appreciative !

     Barry

  • 04-18-2008, 2:44 PM In reply to

    Re: White-Paper on Secure Scalability of IIS 6.0 web apps (Windows Server 2003 R2)

    This is excatly what I have been doing for a few years,

    A collegue and I are in the middle of writing it up as a high level design, hopefully if we can remove the corporate references we will publish this as a paper

    but a few thing to note so far are

    We use CIFS (windows shares on sep file server for content) while this has a performance hit, separating web server from content opens up a whole new world of possibilities for scale out and DR situations

    Each web site should have its owns app pool (this is now standard on IIS7)
    Then restrictions are applied via ASP.NET trusts which enforce these restrictions on each application (each application will run under medium trust which prevents OS access and file system access outside the applications folder).  This means you cannot use the ADO.NET managed OLE DB data provider to access databases. However, you can use the managed SQL Server provider to access SQL Server databases. 
    EventLogPermission is not available. ReflectionPermission is not available. This means you cannot use reflection.
    RegistryPermission is not available. This means you cannot access the registry.
    WebPermission is restricted. This means your application can only communicate with an address or range of addresses that you define in the <trust> element.
    FileIOPermission is restricted. This means you can only access files in your application's virtual directory hierarchy. Your application is granted Read, Write, Append, and PathDiscovery permissions for your application's virtual directory hierarchy.

    Each application pool runs under its own Active Directory identity.  This is granted minimum server access and read-only access to its own code area. Each application is run inside a dedicated application pool in web server memory, again under the same identity

    using unique ID for each sites uses a LOT of desktop heap
    see http://support.microsoft.com/kb/831135
    and http://blogs.msdn.com/ntdebugging/archive/2007/01/04/desktop-heap-overview.aspx

    SQL Database access / authentication will be achieved using a ‘trusted’ connection with the Worker process identity. As every application container has a dedicated domain account, this can be locked down to just code within the container.  Using this method no extra UserId or password is required to connect to the database. Eliminating the use and need for any application accounts which can be used in an anonymous manner by the Application Support Groups or inadvertently displayed to end users during an error condition.
    The application access to the SQL DB will only have Data_Reader and Data_writer
    Where Possible the Application support staff only have DDL_admin , Data_Reader and Data_writer to the database as standard, while this may seem restrictive, it prevents them change various database parameters someone with DBO can, such as logging mode

    ASP.NET caches pre-compiled ASPX code for speed.  The default location of this cache is moved to the local data drive (typically H:) and minimal NTFS permissions set to ensure access is only available to appropriate worker processes. , ( i believe this is iis_wpg : create and create_owner:full control) this allows each app pool to create its cache and managed it, but it cannot be acess by any other application

    To ensure the web as a service infrastructure is fully scalable, the touch points between the application and the infrastructure must be kept to a minimum and fully defined and controlled by the infrastructure.  All touch points must be defined in virtual or alias terms.

    • File Path : uses DFS
    • Database connections : FQDN DNS Name
    • Downstream service connectivity (web services) : FQDN DNS Name
    • SMTP : All routed by Localhost

     

    Lee hampton-whitehead
    Http://siliconpizza.com | I’ll have a slice of that
  • 04-18-2008, 3:41 PM In reply to

    • tomkmvp
    • Top 10 Contributor
    • Joined on 03-20-2003, 6:27 AM
    • Central NJ
    • Posts 6,235
    • IIS MVPs

    Re: White-Paper on Secure Scalability of IIS 6.0 web apps (Windows Server 2003 R2)

  • 04-18-2008, 6:42 PM In reply to

    Re: White-Paper on Secure Scalability of IIS 6.0 web apps (Windows Server 2003 R2)

    I wasn't aware of that document/book at all. Thanx for the info...guess I now have my Monday morning reading !

  • 04-18-2008, 6:46 PM In reply to

    Re: White-Paper on Secure Scalability of IIS 6.0 web apps (Windows Server 2003 R2)

    Thank you very much for all that detailed info..I'll have to read it over a couple of times to get it all...on Monday morning...:-). If you ever get your strategy fully documented, please let me (us) know...I'd love to read it....

  • 04-21-2008, 5:58 AM In reply to

    Re: White-Paper on Secure Scalability of IIS 6.0 web apps (Windows Server 2003 R2)

    species5618:
    This is excatly what I have been doing for a few years,

    A collegue and I are in the middle of writing it up as a high level design, hopefully if we can remove the corporate references we will publish this as a paper

    I hope you can publish it somewhere. I am looking a writing a paper or two too. I'll have to setup an IIS publish portal.

    There are some good ideas there (some I will have to look at in more detail as a few I have never thought of) and interesting to see how a big hosting provider like you work for does things now. (I worked for them as a contractor 7 years ago and we didn't have anything like that :) )

    They do not look *too* restrictive that can often happen in a security recommendations. That delicate balance of security versus practiciality.

    Obviously we should secure IIS/windows as much as we can - I am curious though most hacks, scripts, etc come via the http port and often because not of any possible IIS configuration but via the code. Would any of these best practice suggestions help for example the current nihaorr1 (sql injection) attack (http://forums.iis.net/t/1148917.aspx)?

    In general, speaking as an IIS admin I should do all I can however, I think the focus/majority of the security configuations/thoughts should be on the code side. Just someting to think about as that is how most attacks are launched. Even a default/badly configured IIS server is going to be fairly secure if website code is - however a robust hyper-secure IIS configuration is overall not secure if the website has dodgy code.

  • 04-21-2008, 9:00 AM In reply to

    Re: White-Paper on Secure Scalability of IIS 6.0 web apps (Windows Server 2003 R2)

    species5618:
    SQL Database access / authentication will be achieved using a ‘trusted’ connection with the Worker process identity.

    I read that as you were somehow linking the (changable) w3wp.exe's PID to SQL ! :)

Page 1 of 1 (7 items)
Microsoft Communities