iisnode on server 2016 with shared websites permissions error - need advise

kdovale commented 2 years ago

We are running a 2016 server with shared websites, the sites location is in a folder c:\domains\ each acct has its own folder with its subfolder wwwroot where they run their webs from, installing node on this seems to require that the iusr group has full permissions to the domains folder. Surely this is a security risk which could allow other sites to then traverse the folder structures ? What rights or setup would be needed in a case like this. If I dump the users folder into the root and set the website up to use this user1 folder and give iusr grp full permission it works fine. But this is not how our folder structures work in the cp.

Plse advise

joegasper commented 2 years ago

Assumptions: 1 to 1 IIS website to apppool to service account for the apppool.

Create a service account for the apppool: domain\website.one.com_svc

Create security group for users: website.one.com_users Create security group for apppool account: website.one.com_app

Add account website.one.com_svc to group website.one.com_app

Create a "rollup" security group for all user groups: rollup_users Create a "rollup" security group for all apppool groups: rollup_app

Add group website.one.com_app to rollup_app Add group rollup_app to local group: localservername\IIS_IUSRS

Assuming default drive permissions... On folder C:\domains break permission inheritance and remove localcomputer\Users permissions. On folder C:\domains give group rollup_users read to This folder only. On folder c:\domains\website.one.com give group website.one.com_users read to This folder only. On folder C:\domains\website.one.com\wwwroot give group website.one.com_app read permissions. On folder C:\domains\website.one.com\wwwroot give group website.one.com_users modify permissions. (Users could rename the wwwroot folder, so could apply modify for their group to Subfolders and files only. Or up one folder if you are placing site logs under the sites' folder, too.)

Create subfolder C:\domains\website.one.com\wwwroot\iisnode and give group website.one.com_app modify permissions (where iisnode will write its error logs).

Create share called "websites$" at C:\domains", enable it for access-based enumeration (ABE is important) and give group rollup_users share-level Write/Read permissions (and give Administrators or some server admin group full control if needed, too). ABE will allow the users for website.one.com to only see their site's folder when they visit \webserver\websites$ path.

Create an apppool: website.one.com Set its identity to the apppool service account (advanced settings). Recommend setting the apppool to never recycle and idle time-out to zero.

Create new IIS Site Name: website.one.com, use the corresponding apppool created for it. Bind the domain name. Site root: c:\domains\website.one.com\wwwroot Connect As: Application user (pass-through authentication) (this will use the apppool's account for accessing the site's root)

Ensure at the server root in IIS, for IIS Authentication, Anonymous Authentication is set to "Application pool identity".

Add to local HOSTS file: 127.0.0.1 website.one.com

Add a generic index.htm page to wwwroot and give it a local test.

kdovale commented 2 years ago

Hi Joe,

Thanks for coming back to me.

Let me give you the setup and as half of this is already done automatically, so it will short circuit the needed changes, and you could advise this using the current naming that is generated by solidcp.

C:\domains, is only administrators file access

The following is created when a website gets added via the cpanel. It is solidcp which we are using.

A user folder is created in the c:\domains\ folder, ie user1, (Admins, system is only access)
A domain folder is created within this folder, ie domain1.co.za with same user rights
Then the wwwroot folder is created with an app pool user domain1.co.za_web and assigned full perms

The website that is created is setup as follows :

Path is set to c:\domains\user1\domain1.co.za\wwwroot with pass through authentication.
App pool is called domain1 v4.0 (intergrated)
Identity is set to the user acct domain1.co.za_web
The service acctdomain1.co.za_web is added by default to the iis_iusrs group

This can then run php and .net apps etc. When we run the nodejs site it bitches about the c:\domains access and this is where I got stuck.

So basically this is already done by the solidcp.

Assumptions: 1 to 1 IIS website to apppool to service account for the apppool. Gets Created automatically.

Create a service account for the apppool: domain\website.one.com_svc Gets Created automatically

Create security group for users: website.one.com_users Create security group for apppool account: website.one.com_app

Add account website.one.com_svc to group website.one.com_app

Create a "rollup" security group for all user groups: rollup_users Create a "rollup" security group for all apppool groups: rollup_app

Add group website.one.com_app to rollup_app Add group rollup_app to local group: localservername\IIS_IUSRS

Assuming default drive permissions... On folder C:\domains break permission inheritance and remove localcomputer\Users permissions. Correct On folder C:\domains give group rollup_users read to This folder only. (currently admins full inherited from domains folder) On folder c:\domains\website.one.com give group website.one.com_users read to This folder only. (currently admins full inherited from domains folder) On folder C:\domains\website.one.com\wwwroot give group website.one.com_app read permissions. (currently admins full inherited from domains folder) On folder C:\domains\website.one.com\wwwroot give group website.one.com_users modify permissions. (Users could rename the wwwroot folder, so could apply modify for their group to Subfolders and files only. Or up one folder if you are placing site logs under the sites' folder, too.) (App user domains1.co.za_web gets full perms on this folder)

Create subfolder C:\domains\website.one.com\wwwroot\iisnode and give group website.one.com_app modify permissions (where iisnode will write its error logs). This gets inherited from the wwwroot folder, user typically upload this themselves and thus inheritance

Create share called "websites$" at C:\domains", enable it for access-based enumeration https://theitbros.com/config-access-based-enumeration-windows-server-2016/ (ABE is important) and give group rollup_users share-level Write/Read permissions (and give Administrators or some server admin group full control if needed, too). ABE will allow the users for website.one.com to only see their site's folder when they visit \webserver\websites$ path.

Create an apppool: website.one.com Gets Created automatically Set its identity to the apppool service account (advanced settings). Gets Created automatically Recommend setting the apppool to never recycle and idle time-out to zero. Gets Created automatically

Create new IIS Site Name: website.one.com, use the corresponding apppool created for it. Gets Created automatically Bind the domain name. Gets Created automatically Site root: c:\domains\website.one.com\wwwroot Gets Created automatically Connect As: Application user (pass-through authentication) (this will use the apppool's account for accessing the site's root) Gets Created automatically

Ensure at the server root in IIS, for IIS Authentication, Anonymous Authentication is set to "Application pool identity".

Add to local HOSTS file: 127.0.0.1 website.one.com

Add a generic index.htm page to wwwroot and give it a local test.

From: Joe Gasper @.> Sent: Thursday, 10 February 2022 8:41 AM To: Azure/iisnode @.> Cc: kdovale @.>; Author @.> Subject: Re: [Azure/iisnode] iisnode on server 2016 with shared websites permissions error - need advise (Issue #124)