> We are getting requests from our customers to upload files to > a password secured area of our site so they can share them with > other users from their company, as well as with our internal > people. The intent is for files like Excel, Word, and Powerpoint > documents. Some of the restrictions we need to do are pretty > straightforward, like who can upload, who can delete, total > file size, etc., but what pitfalls do I need to watch out for > from a server security standpoint? We are on IIS 4.0, Windows NT > 4.0 SP5, CF4.5 ENT, with plans to go to Win2000. Is it as simple > as restricting certain executable file types? Rather than focusing on specific file types, which may be a losing battle, you might simply make the directory itself safe. 1. Put it outside the web server document root. This way, the web server itself won't be able to execute anything in there. 2. Only allow read and write rights within the directory. Remove execute rights from ALL users! Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ voice: (202) 797-5496 fax: (202) 797-5444 ------------------------------------------------------------------------------ Archives: http://www.mail-archive.com/[email protected]/ To Unsubscribe visit http://www.houseoffusion.com/index.cfm?sidebar=lists&body=lists/cf_talk or send a message to [EMAIL PROTECTED] with 'unsubscribe' in the body.
