I am planning to host mulitple web site's on a single server with each web
site/applicaiton being assigned a seperate applicaiton pool.

For secutiry and auditing reasons I would like to assign each applicaiton
pool a specific identity to for the worker process's to run under.

2 questions -

1 - is this a good idea?
2 - If so, I what are the minium security rights required for the app pool
users?

Thanks!

Russ.

Hi Russ,

    I'm guessing here, but I think you should consider that each AppPool
runs under it's own process, and so if you have *too much* proccess running
they may have a processor starving and stuff like that. Do you know the
avarage number of sites that will be hosted?
   Regarding the second point, to run an app pool under another identity,
you need to add the user account to IIS_WPG group. Do not assign the
permissions directly to the account because it seems that IIS has some hard
coded checking against the identity belonging to this group.

Cheers,

Eric

Show quoteHide quote

Isolating each website with its own Application Pool usually means you plan
to host very few websites on that server because process creation overhead
will kill the server if you try for hundreds/thousands.

1. Depends on your server's available hardware resources (CPU, RAM, NIC,
HDD). Depends on what you are trying to achieve
2. Look at security privileges of "Network Service"

Show quoteHide quote

Do you control the web applications?

If not (i.e. other people are writing the applications) and each application
can not be trusted to not be malicious (e.g. one application may try to
subvert another application, or steal information related to another
application, or read/write to the files that belong to another application),
then you will need to look at things such as process isolation, and ensuring
that each process runs as a separate user. Then you can use NTFS ACLs to
keep each application out of every other application.

Cheers
Ken

Show quoteHide quote

Network/Web Site Authentication
iis problems with some xp clients - kerberos issue?
IIS + SQL (Not enough storage is available to complete this operation)
Virtual Directory On UNC Share Not Writable
changing "CN" name
Microsoft URL Scan
HTTP 405: The HTTP verb used to access this page is not allowed
IIS default file permissions used improperly?
IIS 5.0 vs IIS 6.0
Integrated Windows Authentication results in -2146893052 (0x80090304)