Windows 2000 - Windows 2003 Server - ASP Security

[deeaccess]

Hi All,

Recently, our server with Window 2000 Small Business server has been migrated to Window 2003. After the upgrade, I am having a problem with the ASP pages. I can get the index page of the asp to show up. However, after trying to log in with a username and password it just comes up with a generic "The page cannot be displayed" message with no further details. I thought this may have to do with security, but I am not 100% sure if that is the case.

Any insight into this matter would be much appreciate.

Thank you in advance.

 

[jmaddone]

If you want access without a login, check the permissions of the folder that contains the ASP pages and make sure IUSER_<Computer Name> has read and execute permissions.

 

[deeaccess]

Thanks for your reply.

I do not think in Windows 2003 there is a IUSER_<Computer Name>. I have given full access to user "Everyone"

Also, after removing the "friendly errors" message in I.E., I now get the following error:
Microsoft OLE DB Provider for ODBC drivers error 80004005. Microsoft ODBC Driver Manager Driver's SQLSetConnectAttr failed.

Strange thing is that it was working completely fine under Windows 2000 Small Business Server.

 

[jmaddone]

First thing Everyone is a Group, not a User. The Everyone group is as it says, it is access for Everyone. This is not recommended for webservers, because this will give a resourceful person full access to the web pages, and possibly other resources on the server. They might be able to change pages or worse on the server. At the most you should give Read and Execute permissions to the web folders.

On to the error message, did you create an ODBC connection for the ASP pages to use? If you did, then did you test it out to make sure it works from the Web Server to your Database?

 

[deeaccess]

Yes, an ODBC connection has been created for the ASP pages. In Window 2003 server, how do you go about testing ODBC connection?

I have a hunch that this may lead into security issues as I have heard Windows 2003 has implemented quite a bit of security.

Thank you for your continued help on this issue.

 

[jmaddone]

What kind of database are you connecting to? Some ODBC drivers allow you to Test or "Apply & Test" the connection inside the ODBC connection setup. Another way to test it is to find a program that uses ODBC (Word, Excel, Access) to connect to data and do a basic test. Or if none of that is avalible, create a simple test ASP page and do a simple query on data that you know is there. The error makes it sound like the web server cannot connect to the database server. You might also check to see if you can ping the database server, to make sure it can at least see the server.

Hope that helps

-jeff