Jochem, Can you please explain this to me: > IIS needs to be run as a privileged user, Apache doesn't. Due to this > simple fact, IIS is inherently less secure. If Apache gets compromised, > you get the Apache account. If IIS gets compromised, you get the > server.
I don't know Apache at all. However, there are multiple users that "run" IIS 6.0 - or are we talking IIS 5.0? Do you mean the anonymous account - IUSR_MACHINENAME Or the default IIS 6.0 application pool identity - NETWORK SERVICE Or the default IIS 5.0 COM+ Medium/High User Isolation Mode - IWAM_MACHINENAME I'm not quite sure what you mean by "privileged account". Each of the accounts listed needs some rights in order to access the content, execute the required ISAPI filters/extensions, and spin up a worker process (W3WP or DLLHOST) How does APACHE work in this regard? Does every request come in as the authenticated user, or operate as the anonymous account if no authentcation is needed? I don't know the answer to this question. However, I'm thinking - if so, I would think this is a bigger security hole than the IIS practice of allowing only certain accounts to spin up a worker process. In effect, if the anonymous user/authenticated user accounts are allowed to execute requests on their own, then how can you lock down those accounts to prevent them from executing processes that they should not? I'll defend IIS because I know it, but I don't know how Apache works. If you could explain that, maybe we could actually decide for ourselves which one may or may not be "more secure". BTW, those diagrams mean nothing. Looking at the close ups do not reveal what those nodes are. How do we even know if they are correct? - Chesty > ** Private ** wrote: > > Bah, the source code doesn't directly tell you its secure. > > But without secure source code you can not have a secure application. > > > > To my knowledge there hasn't been any attacks against IIS, every > attack > > was against some specific technology that was usually found to have > been > > left open by the user. > > How about Code Red and Nimda? > > > > If you have IIS doing a strait web request for HTTP with HTML that > does > > not pass through a script engine or ISAPI filter then I bet you hit > the > > same level of security as you would with apache. > > IIS needs to be run as a privileged user, Apache doesn't. Due to this > simple fact, IIS is inherently less secure. If Apache gets compromised, > you get the Apache account. If IIS gets compromised, you get the > server. > > > > I've never had good luck with open source > > If you depend on luck when dealing with software, perhaps the problem > lies elsewhere. > > > > I hate it when people start talking open source for enterprise > > applications that require 24x7x365 because when something does go > wrong, > > I got nobody to call. > > So why not get a support contract for your open source application? > Jochem ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Upgrade to Adobe ColdFusion MX7 Experience Flex 2 & MX7 integration & create powerful cross-platform RIAs http:http://ad.doubleclick.net/clk;56760587;14748456;a?http://www.adobe.com/products/coldfusion/flex2/?sdid=LVNU Archive: http://www.houseoffusion.com/groups/CF-Community/message.cfm/messageid:227153 Subscription: http://www.houseoffusion.com/groups/CF-Community/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.5
