Gossamer Forum
Home : Products : Links 2.0 : Installation -- Windows :

Admin security with NT4 and IIS3

Quote Reply
Admin security with NT4 and IIS3
So far I have only been able to come up with some work-around methods of protecting the admin CGI scripts/directory with links 1.1, the same methods do not seem to work with 2.0 for some reason.

EG:

I used to be able to remove IUSER from the permissions on the nav.html file 1.1 used. Sort of a low security way of keeping people from the scripts.

I believe that I also tried doing that with the various admin scripts and had a little more protection..

Before you nudge me on to IIS4, SP4, etc, etc I have reasons for this particular setup and will one day update the server but for now it's really not a high priority for this one script.

If I come up with a decient method of admin protection I will present it here.

..likewise, if anyone has something fielded they would like to share I am interested in what you have been able to come up with.

-john
Quote Reply
Re: Admin security with NT4 and IIS3 In reply to
I'm a little rusty with IIS password protection so be patient.. Smile

First off, just protecting nav.htm is not adequate, it will make things inconvienant, but really isn't security at all. How about setting all .cgi files to non readable for IUSER? That will protect anyone from altering your data, but does not secure against them viewing your database files (which you could protect by moving them outside of the document tree).

Hope this helps,

Alex
Quote Reply
Re: Admin security with NT4 and IIS3 In reply to
I've just gotten the painful upgrade from IIS3 to IIS4 done and added FP98 Server extensions (gag). IIS4 allowed me to set permissions on the LINKS "admin" directory giving me closer security model as you can do with UNIX. Seems to be fine.

I have yet to migrate/create the site with FP but will be giving it a go soon. I hated to change from what I had running to the new fangled server but IIS3 is basically a dead product as far as MS is concerned and I needed to get back to date.

I prefer the text editor approach as opposed to the FP server extensions but want to get some idea of how to add cgi via them just for kicks.

-john
Quote Reply
Re: Admin security with NT4 and IIS3 In reply to
I just love the Microsoft upgrade or else approach! Sometimes it isn't feasable for a company to upgrade hundreds (if not thousands) of computers, but does MS care? I'm just starting to get knee-deep in NT and I can just see the impending doom around the corner when they start (unofficially) dropping support for NT 4.0 when they release Windows 2000.