win2008 Server folder permissions configuration

Improve the security of your site by controlling folder permissions.

This permission setting includes two aspects, one is the system directory, the drive letter permission, one is the application's Upload folder permission setting.

System directory

Make sure that all the drive characters are in NTFS format, and if not, you can convert the D:/FS:NTFS to NTFS format using the command.

All disk root directories only give system and administrators permissions, and others are removed.

Where the system drive letter will have a few hints, directly determined on it. Before you do this, your running environment software must be installed before you can do it. Failure to do so may result in software installation errors, and it is important to remember that all security settings must be made after the software is installed .

Site Directory

Each Web site corresponds to a directory, and the site directory with IUSR and IIS_IUSRS permissions, all only to "List Folder Contents" and "read" permissions.

For example, I created a wwwroot directory under the D-Packing directory, and then created a blog.postcha.com directory inside it, which contained my website program. Where wwwroot as long as the permission to save the D disk, and blog.postcha.com This directory, we need to add two additional permissions, namely IUSR and Iis_iusrs.

Wwwroot Permissions:

Site Directory Permissions:

The general website has the upload file, the picture function, but the user uploads the file is not credible. So you have to set the upload directory separately. The upload directory also needs to add "modify" and "write" permissions to the IIS_IUSRS group.

Through the above to set up a execute permission, once the user uploaded a malicious file, our server fell, but we do not have to give, so we have to cooperate with IIS to set up a bit.

In IIS7 and above, this setting is very convenient. Open IIS Manager, locate the site, check the upload directory, double-click on "Handler mappings" in the middle column of IIS, and then select "Edit function Permissions" to tick off the "script".

OK, let's open the upload folder and see if there's a Web. config.

The content in Web. config is as follows:

?

123456

<?xml version="1.0" encoding="UTF-8"?><configuration>  <system.webServer>    <handlers accessPolicy="Read" />  </system.webServer></configuration>

This means that all files under the upload directory (including all subfolders) will have read-only permissions. This way users can not play a role even if they upload malicious files.

The value of

Each website program has different functions, and the settings vary. The least privilege is the maximum security.

win2008 Server folder permissions configuration