IIS7 Admin read/write access to folder

Question

I have an ASP.Net website running on IIS7. The developers have created a CMS in the \\admin folder, which allows the website admin to create/edit/delete pages.

They have said:

"The read/write permission should be given to the user that requires login access to the admin panel, not the anonymous user that has general public access to the website. The reason for the write permission is to allow the administrator to be able to upload images and files through the CMS, and make various changes to the navigation, style sheet, etc".

Also, they have said:

"Password protect the /admin folder and assign full rights to your admin user as it needs to update data (site files) accordingly as mentioned in the Folder level section above. For certain modules to work, such as the file manager, you would need to use Basic Authentication at the Directory Security level. The FCKeditor folder also should be protected so it has the correct permissions. "

Is this approach safe? I have tried assigning full rights to the Plesk protected folder user (the \\admin folder is protected through Plesk), but Plesk keeps reverting back to its default settings. I am told this is a security measure, which makes sense.

What would an alternate way of accomplishing this be without rewriting any code?

Answer 1

If the application needs the ability to upload then it will always need read/write permissions to the directories it is going to upload to - no amount of rewriting will change this, it's part of the basic functionality. The same applies to editing stylesheets etc.

Reverting changes you make sounds like a very bad security measure - warning you would be fine, but generally you make these changes for a reason and want them to stay.

Answer 2

Hay try this...

1. Right-click the file and select Properties.
2. Click on the Security tab.
3. Click Advanced in the lower right.
4. In the Advanced Security Settings window that pops up, click on the Owner tab.
5. Click Edit.
6. Click Other users or groups.
7. Click Advanced in the lower left corner.
8. Click Find Now.
9. Scroll through the results and double-click on your current user account.
   10. Click OK to all of the remaining windows except the first Properties window.
   11. Select your user account from the list up top and click Edit.
   12. Select your user account from the list up top again and then in the pane below, check Full control under Allow, or as much control as you need.
   13. You'll get a security warning, click Yes.
   14. On some files that are essential to Windows, you'll get a “Unable to save permission changes… access is denied” warning and there's nothing that you can do about it to the best of my knowledge.
   15. Reconsider why you're using Windows.