Menu
What are the dangers of giving the Network Service account read/write permissions to your ASP.NET Web application? I have to do this for any directory that my app needs to write to like App_Data for my VistaDb database and some random directories to uplaod images and make changes to text files, etc. What is the danger in doing this? And is it acceptable to just grant read/write perms to the entire Web application for Network Service?
705
The NetworkService account is a predefined local account used by the service control manager. This account is not recognized by the security subsystem, so you cannot specify its name in a call to the LookupAccountName function. It has minimum privileges on the local computer and acts as the computer on the network.
To grant ASP.NET write access to a file, right-click the file in Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access.
Right-click the domain object and select Properties. Click the Security tab. Select the desired user account (add the account if it's not listed there already). In the Permissions area, next to Replicating Directory Changes, click Allow.
The biggest security risk of giving the Network Service Account write permissions to folders is experienced in Shared Hosting or when you run multiple websites on the same server.
Basically, if you grant modify permissions then every other ASP.NET application that server configured to run as Network Service (all by default) will also have write permissions to that folder, which could be exploited.
59
The danger of doing this is that Network Service is a shared account and any application or service running under this account would have access to that directory.
Depending on what version of IIS you are using, you can place the web application in a separate application pool and have it run under a different user account. Then, you can grant access specifically to that user and not Network Service. This is only available in IIS 6 or later.
28
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
