IIS6 - System Drive permisisons 1

[a6m1n0]

I have a windows 2003 server with IIS6 which I am trying to setup for shared hosting. I have this configuration:

C: system
D: webapps that are protected with NTLM permissions
E: inetpub

C: has default permissions except my removal of Everyone.
D: AdminGroup, Admin, Creator, System, and some special service users.
E: same as above, but IUSR has some permissions in

http://wwwroot.

There is a script thats been floating around on some of my peers servers called webadmin.php. With this file and default permissions on my C: drive, I am able to jump root and view/download (almost) anything in C:\ as IUSR.

I have not ran the lock down configuration tool yet as I am still setting up this server for shared hosting and would like to do most of this manually (is good experience) before running the lockdown tool. I do not think I can just outright *deny* IUSR from C:, or can I? What would be the appropiate permissions to apply to C: to secure it against the user 'jumping root' and browsing C:?

Any input is appreciated. I am a little rusty with server's so take it easy on me.

Thanks

-a6m1n0

Curiosity only kills cats.

 

[Wullie]

C: has default permissions except my removal of Everyone.

What permissions exactly do you have on the root? You should only have Administrators and System, nothing else.

Hope this helps


Wullie

Fresh Look - Quality Coldfusion 7/Windows Hosting
YetiHost - Coming Soon

The pessimist complains about the wind. The optimist expects it to change. The leader adjusts the sails. - John Maxwell

 

[a6m1n0]

Administrators = Full Control (Default perms)
System = Full Control (Default perms)
Creator Owner = Special (Default perms)
Users = Read/List/Read&Execute ? These were set, but I have deleted them. Were these permissions set when I installed IIS or were they installed when 2003 was installed? Odd. They are not defult perms.

I also moved system temp to F:\TEMP, and added the special permissions for User/Network Service, and updated the Enviroment Variables.

Are there any other files in C: that have special perms for Users Group? What is standard procedure for auditing permissions on Windows Servers?

Sorry for all the questions...if I need to start a new topic just say the word.

Thanks Wullie.

-a6m1n0

Curiosity only kills cats.