IIS Security - Week 20, 2006

Adding Administrator to NTFS permissions gives full control to WebDav

Tim Guy - 19 May 2006 8:54 PM - 2 messages

I have an IIS 6.0 server which is running Webfolders/WebDav If the administrator has full control to a Webfolder then ANY user that is part of the domain can logon to that virtual folder where they dont have ...

XP FIREWALL ERROR "Due to an unidentified problem. windows cannot

netprophet - 19 May 2006 6:02 PM - 2 messages

I have posted this in the IIS section which may indeed be the wrong place ! I have XP Professional SP2 and during installing and messinga round with IIS my Firewall stop working and cannot be displayed and therefore activated. The error says " "Due to an unidentified problem. windows cannot display ...

fileshare on my website

Nigel.UK. - 19 May 2006 8:21 AM - 4 messages

I am running wsbs2003sp1 on one machine and w2003sp1 and iis on my web server. My website is visible on the www but clients cannot open pdf documents, which i can open in my own browser. apparently ipnat.sys is running on the wsbs machine and windows firewall on ...

<customErrors> confusion

Jayyde - 18 May 2006 9:11 PM - 2 messages

New to this so please bear with me... I set up the: <customErrors mode="On" defaultRedirect="~/Unavailable.aspx"> </customErrors> And what it'll do is redirect to the Unavailable.aspx page, but then bring up ASP errors saying how it can't display what's going on and in order for ...

Certificate Services Web Enrollment Support not working

msteinhoff - 18 May 2006 6:48 PM - 4 messages

I have installed Certificate Services and Certificate Services Web Enrollment Support. My problem stems from the fact that when I go to http://servername/cersrv I get a 404 Page cannot be found error. This occurs on the server and from a desktop. ...

a new idea to prevent DoS attacks

Eng.Rana - 18 May 2006 8:29 AM - 4 messages

Dear ALL, i was wondering if there exists any plugins or filters for IIS that will allow me to limit the number of requests from a specifi IP address. or to automatically decrease the number of requests achieved from a ...

Kerberos timout with IIS6, ASP.Net and SQLServer

roarfred - 17 May 2006 8:34 PM - 4 messages

I've been struggling with a problem for the last two months that are almost driving me nuts... We have a traditional ASP.Net 1.1 web site accessing a SQL2000 database using delegation and a trusted connection. I have seen many posts ...

Dumb basic authentication and SSL question

Anthony Yates - 17 May 2006 5:10 PM - 3 messages

I have a web directory protected by SSL and basic authentication. It works fine. The user is prompted to authenticate before the page is displayed. It bothers me that there is no SSL padlock shown on the page during the ...

What dictates whether the LOGON_USER Server Variable is sent?

nickbdavies - 17 May 2006 2:12 PM - 5 messages

Hi I'm using IIS 5.1 and I am trying to gain an understanding of what dictates whether a client sends logon credentials, in order for the Server Variable LOGON_USER to be accessible (i.e. contain useful info)? The current setup I'm working with is as follows ... ...

IIS6 security problem

LT_Hassan - 17 May 2006 11:25 AM - 3 messages

We have a little situation here: We have two servers - one web server and another fileserver. We need to expose some files located on the fileserver to users, but the file server itself is not exposed to the internet. So we created a virtual ...

IWA not working

Ishmealm - 16 May 2006 3:07 PM - 3 messages

I recently upgraded to IIS 6. In the past we haven't used Intergrated Windows Authenication, but I thought that it would be nice to start using that instead of Basic Authenication w\ SSL. For some reason it doesn't work. ...

Issuing a certificate

Zart the Artist - 16 May 2006 12:51 PM - 2 messages

I have set up a Standalone CA on a DC with W2k3 (test lab) I have created a new certificate that is pending autorization from a CA. I am trying to use this pending request with my CA and I am having ...

SSL certificates without AD

Frederik Vanderhaeghe - 16 May 2006 8:16 AM - 2 messages

Hi, Is it possible to give user certificates to users without having a AD, we are using a member server. If it is possible, how? Fré ...

Service principal name (SPN) / Active Directory Problem

RCarbol - 15 May 2006 9:53 PM - 11 messages

I'm having problems getting a web application working -- it's throwing a 403 error. I ran AuthDiag to determine what was wrong, and it's giving me the message: Service principal name (SPN) for user 'DOMAIN\MACHINE_asp' not found in ...

HTTPS : Secured and non secured item with absolute path

trihanhcie - 15 May 2006 12:13 PM - 3 messages

Hi, I have a <img src = "http:// ..."> which needs to be put in a secured page. For example on amazon when the confirmation page is displayed... The problem is that it's a secured page (https) and my tag is an ...

Multiple SSL Sites on One Web Server Running on Port 443

chingcho18 - 14 May 2006 12:24 AM - 4 messages

Hi, I need some help in configuring second SSL website in a web server on port 443. I read several articles and dicussions forms and I could n't get any solution. Please reply ASAP. Thanks ...