multi user web hosting

[benxuk]

i have a windows 2003 WE server, with the asp.net stuff installed and i was wondering about security...

i want to provide space for people to use *.aspx files, are there security issues ie: can anybody make an asp.net file to delete/rename or in any way modify files on the server?

if so, any suggestion's for applying additional security?

[nkad]

Try posting on http://www.webhostingtalk.com you may find more help on the subject there.

[benxuk]

Thanks I have registered at the above site, still wasiting on a response

ps: If your familiar with ColdFusion, this system has an function called "Sandbox Security" - it give's me the abillity to only allow tag/code execution inside certain filesystem directory's

ie: C:\webroot\username\* R W E D

that would limit the files (*.cfm pages and scripts) inside that path to only have permissions on that directory and and sub directorys... which in turn give's the client complete control but access is limited to the there home directory...

Thanks Again!

[nkad]

Well I don't know much about ASP.NET security but I do know that you must have special permissions on any directory in which you want an ASP script to execute. I don't know if ASP.NET scripts follow Owner permissions or not.

[Danial]

Originally posted by benxuk
i have a windows 2003 WE server, with the asp.net stuff installed and i was wondering about security...

i want to provide space for people to use *.aspx files, are there security issues ie: can anybody make an asp.net file to delete/rename or in any way modify files on the server?

if so, any suggestion's for applying additional security?

Well if user are connecting to your machine over HTTP they only have access to the Shared Folders. You can set it up such a way that user have only Read/Write/Execute permision.So another word you can set it up as you wish, make sure that you are using NTFS file system, and look up the help file. There are plenty of articles guide also MSDN has a lot of step by step guide on how to secure your sever and apply various security settings.

Hope this helps.