Web server permissions allow you to control how users access and interact with specific Web sites.
You can use these permissions to control whether users visiting your Web site are allowed to view a particular page, upload information, or run scripts on the site.
Unlike NTFS permissions, Web server permissions apply to all users accessing your Web site.
This distinction is imperative because NTFS permissions apply only to a particular user or group of users with a valid Windows NT account.
For example, disabling Web server Read permission for a particular file will prevent all users from viewing that file, regardless of the NTFS permissions applied to those users' accounts. However, enabling Read permission will allow all users to view the file unless NTFS permissions that restrict access have applied.
If both Web server and NTFS permissions are set, the permissions that explicitly deny access will take precedence over permissions that grant access.
When you select the Write and Execute check boxes, you enable users to upload and execute programs on your Web server. In this case, a user could inadvertently or intentionally upload and then run a potentially destructive program on your server. Whenever possible, select the Script option rather than the Execute option, because the Script option limits users to executing programs associated with an installed script engine, not any executable application.
You can configure your Web server to grant or deny specific computers, groups of computers, or domains access to Web sites, directories, or files. For example, you can prevent external network users from accessing your Web server by granting access only to members of your intranet, and explicitly deny access to outside users.
In many cases, IP access security is sufficient. However, while either restricting or permitting various IP addresses, remember that packets can be intercepted and “spoofed.” Spoofing is a technique where a sophisticated user can alter the contents of a packet without affecting the IP address.
IP access and domain name restrictions are configured with IIS administrative tools. When you configure a security property for a specific Web site or directory, you automatically set it for all directories and files within that site/directory, unless the security property of the individual directories and files were previously set. For those directories and files with previous security settings, you are prompted for permission to reset (replace) its security setting. This security inheritance mechanism applies to all of the IIS security methods.
Under most circumstances, all users who attempt to establish a connection with your Web server will log on as anonymous users. When an anonymous connection is established, your Web server will log on the user with an anonymous or guest account This account is a valid Windows NT user account to which you have applied restrictions that limit the files and directories the anonymous user can access.
To prevent anonymous users from connecting to restricted content, you can configure your Web server to authenticate users. Authentication involves prompting users for unique user name and password information, which must correspond to a valid Windows NT user account, governed by the NTFS file and directory permissions that define the level of access for that account.
Your Web server will authenticate users under the following circumstances:
- Anonymous access is disabled.
- Anonymous access fails because the anonymous user account does not have permission to access a specific NTFS file or resource.
If either of these conditions occur, your Web server will refuse to establish an anonymous connection. Your Web server will then use the authentication method you have enabled to attempt to identify the user.