Learn how to set IIS Web site Permissions

We are still learning about IIS Web today. IIS checks the Web site permissions to determine the types of operations that may occur on the IIS Web site, such as allowing access to the origin of the foot or browsing folders. You should assign permissions to the IIS Web site to further ensure the security of the site on the IIS server in the three environments defined in this Guide.

The IIS Web site permission can be used with the NTFS permission. They can be configured to specific sites, folders, and files. Unlike NTFS, website permissions affect everyone who tries to access the IIS server site. The IIS Web site permission can be obtained through the IIS Manager Management Unit.

The following table lists the Web site permissions supported by IIS 6.0, and provides a brief description of how to assign the given permissions to the IIS Web site.

IIS 6.0 Web site Permissions

IIS Web site permissions: granted permissions:
Read
You can view the contents and attributes of a directory or file. By default, this permission is selected.

Write
You can change the content and attributes of a directory or file.

Script Source Access
You can access source files. If the read permission is enabled, the source file can be read. If the write permission is enabled, the source code of the script can be changed. Script source access includes the source code of the script. This option is unavailable if neither the "read" permission nor the "write" permission is enabled.

Key point: when "script source access" is enabled, users can view sensitive information, such as user names and passwords. They can also change the source code running on the IIS server, seriously affecting the security and performance of the server.

Directory Browsing
You can view the file list and collection.

Log Access
Each time you access the IIS Web site, a log entry is created.

Index this resource
You can use the Index Service to index resources. This allows you to search resources.

Run
The following options determine the script running level:
"None"-you are not allowed to run scripts and executable files on the server.
"Script only"-only scripts can be run on the server.
"Scripts and executable files"-allows running scripts and executable files on the server.

You should have mastered how to set IIS Web.