Click here to get back home

IIS or directory security issue on 2003 E server

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
IIS or directory security issue on 2003 E server GeekBoy 01-12-2007
Posted by GeekBoy on January 12, 2007, 9:56 pm
Please log in for more thread options
I got a web site up and have different directories as normally anyone would.
These directories have other locations of the web site.

I just made a new directory for phpBB and added index.php as a default file
in IIS.

However I keep getting a 404 error when i try to access the page via /board/
or /board/index.php.
I have even tried other php files with same error.

This seems to be a security issue. Checking the directory the new directory
seem to have taken on the same security as the parent.

Any idea where to look?

Thanks



Posted by Jesper on January 15, 2007, 7:20 pm
Please log in for more thread options
Did you enable PHP as an extension that IIS serves? It won't serve extensions
that are not enabled.

"GeekBoy" wrote:

> I got a web site up and have different directories as normally anyone would.
> These directories have other locations of the web site.
>
> I just made a new directory for phpBB and added index.php as a default file
> in IIS.
>
> However I keep getting a 404 error when i try to access the page via /board/
> or /board/index.php.
> I have even tried other php files with same error.
>
> This seems to be a security issue. Checking the directory the new directory
> seem to have taken on the same security as the parent.
>
> Any idea where to look?
>
> Thanks
>
>
>

Posted by GeekBoy on January 16, 2007, 11:25 pm
Please log in for more thread options

> Did you enable PHP as an extension that IIS serves? It won't serve
> extensions
> that are not enabled.

I think I had some other apps running on the server before maybe 3 years
ago. I forgot what.

I guess you mean in the Application Configuration in the properties of IIS?
I do not have it setup in that area. I tried to set it in that area when
this problem came up and then the server sees the file, but runs it as a
binary file instead of a text document.
Maybe I am just setting it up wrong?

Thanks for the reply.

GB



>
> "GeekBoy" wrote:
>
>> I got a web site up and have different directories as normally anyone
>> would.
>> These directories have other locations of the web site.
>>
>> I just made a new directory for phpBB and added index.php as a default
>> file
>> in IIS.
>>
>> However I keep getting a 404 error when i try to access the page via
>> /board/
>> or /board/index.php.
>> I have even tried other php files with same error.
>>
>> This seems to be a security issue. Checking the directory the new
>> directory
>> seem to have taken on the same security as the parent.
>>
>> Any idea where to look?
>>
>> Thanks
>>
>>
>>



Posted by Jesper on January 16, 2007, 11:38 pm
Please log in for more thread options
If you open the IIS Manager and expand the name of your computer you will see
three nodes. One is the "Web Services Extensions." php must be listed as an
extension there, with the name of the parser binary in the "required files"
field.

You can quickly test if this is the problem by changing the status for
"Allow unknown CGI/ISAPI extensions" to Allow. If that makes things work this
is definitely your problem.

The installation for PHP should have configured that for you, at least logic
would have it that it should. You also need the appropriate ISAPI filters (I
*assume* PHP is implemented through an ISAPI filter, not a CGI application,
but I don't know) enabled for each site where you host PHP.

"GeekBoy" wrote:

>
> > Did you enable PHP as an extension that IIS serves? It won't serve
> > extensions
> > that are not enabled.
>
> I think I had some other apps running on the server before maybe 3 years
> ago. I forgot what.
>
> I guess you mean in the Application Configuration in the properties of IIS?
> I do not have it setup in that area. I tried to set it in that area when
> this problem came up and then the server sees the file, but runs it as a
> binary file instead of a text document.
> Maybe I am just setting it up wrong?
>
> Thanks for the reply.
>
> GB
>
>
>
> >
> > "GeekBoy" wrote:
> >
> >> I got a web site up and have different directories as normally anyone
> >> would.
> >> These directories have other locations of the web site.
> >>
> >> I just made a new directory for phpBB and added index.php as a default
> >> file
> >> in IIS.
> >>
> >> However I keep getting a 404 error when i try to access the page via
> >> /board/
> >> or /board/index.php.
> >> I have even tried other php files with same error.
> >>
> >> This seems to be a security issue. Checking the directory the new
> >> directory
> >> seem to have taken on the same security as the parent.
> >>
> >> Any idea where to look?
> >>
> >> Thanks
> >>
> >>
> >>
>
>
>

Posted by GeekBoy on January 17, 2007, 1:08 am
Please log in for more thread options

> If you open the IIS Manager and expand the name of your computer you will
> see
> three nodes. One is the "Web Services Extensions." php must be listed as
> an
> extension there, with the name of the parser binary in the "required
> files"
> field.
>
> You can quickly test if this is the problem by changing the status for
> "Allow unknown CGI/ISAPI extensions" to Allow. If that makes things work
> this
> is definitely your problem.
>


Looking...the "Unknow CGI" was permitted
And "unknown ISAPI" was on PROHIBITED so I changed it to Allowed and still
same 404 error result.

> The installation for PHP should have configured that for you, at least
> logic
> would have it that it should. You also need the appropriate ISAPI filters
> (I
> *assume* PHP is implemented through an ISAPI filter, not a CGI
> application,
> but I don't know) enabled for each site where you host PHP.

Looking at that on the site I do not see any filters. Strangely when i first
looked it showed ASP.NET v2.0. I pressed cancel and now it is gone now with
no filters.
I would not even know what DLL to use.

As I mentioned I used another PHP app like 3 years ago..

Looking I found it still in an old web directory. It's called Zen cart and
It worked fine.
So I don't know what is going on now.

Thanks again.





>
> "GeekBoy" wrote:
>
>>
>> > Did you enable PHP as an extension that IIS serves? It won't serve
>> > extensions
>> > that are not enabled.
>>
>> I think I had some other apps running on the server before maybe 3 years
>> ago. I forgot what.
>>
>> I guess you mean in the Application Configuration in the properties of
>> IIS?
>> I do not have it setup in that area. I tried to set it in that area when
>> this problem came up and then the server sees the file, but runs it as a
>> binary file instead of a text document.
>> Maybe I am just setting it up wrong?
>>
>> Thanks for the reply.
>>
>> GB
>>
>>
>>
>> >
>> > "GeekBoy" wrote:
>> >
>> >> I got a web site up and have different directories as normally anyone
>> >> would.
>> >> These directories have other locations of the web site.
>> >>
>> >> I just made a new directory for phpBB and added index.php as a default
>> >> file
>> >> in IIS.
>> >>
>> >> However I keep getting a 404 error when i try to access the page via
>> >> /board/
>> >> or /board/index.php.
>> >> I have even tried other php files with same error.
>> >>
>> >> This seems to be a security issue. Checking the directory the new
>> >> directory
>> >> seem to have taken on the same security as the parent.
>> >>
>> >> Any idea where to look?
>> >>
>> >> Thanks
>> >>
>> >>
>> >>
>>
>>
>>



Similar ThreadsPosted
Server 2003 network directory access March 13, 2008, 4:56 pm
Windows 2003 security issue January 25, 2006, 3:50 am
Re: Ntbackup Windows 2003 SP1 issue (VSS/Security) June 13, 2005, 6:37 pm
Re: Ntbackup Windows 2003 SP1 issue (VSS/Security) May 13, 2007, 5:47 pm
RPC Local Security Windows 2003 Trust Issue February 2, 2006, 9:02 am
Windows Server 2003 sharing issue July 7, 2005, 2:12 pm
Windows Server 2003 - Services Permissions Issue August 29, 2005, 1:28 pm
Security settings for forcing user to see only one directory at the server February 25, 2007, 9:30 am
The security of this directory server can be significantly enhanced - windows 2008 June 12, 2008, 7:32 pm
Re: Server 2008 Domains - Security issue February 15, 2008, 2:51 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap