I am going to be using IIS 7.5 to host websites for my clients. Sites will range from static, Classic ASP to ASP.Net and I'd like to add in PHP down the road. I don't want any users to have access to other users' files. I'd like to get some recommendations on the most secure way to get this running.
From my research, I think the following is the way I should set this up. Please correct me if you know of a better way.
- Anonymous Authentication for websites will use Application Pool Identity rather than IUSR
- Setup an application pool for each website
- Create a new windows account for each Application Pool to run in
- Set Directory Permissions on the root folder for Administrator, System and the Application Pool User Account (with Full Control?)
Thanks in advance!