IIS in Windows Server 2003 has been rearchitected and might be worth a look. If this is for a shared hosting environment, users will probably want IIS. You probably should really try to convince your friend to run Apache in Linux regardless.
Here's some articles on IIS 6 from Microsoft. http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/proddocs/standard/iiswelcome.asp http://www.microsoft.com/windowsserver2003/techinfo/overview/iisenhance.mspx http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/plan/appisoa.asp Steve On Wed, Aug 20, 2003 at 05:58:04PM -0400, Justin Shin wrote: > Hi guys (sorry for the late response but I'm not really supposed to worry about this > stuff at work ya know :) -- > > Thanks for all your responses. I already knew he shouldn;t be running apache as > root, I have told him before to run apache as a seperate user (eg. "apache") but he > has yet to fix this. > > Once again, the safe_mode on PHP works __directly with the *nix kernel__ , meaning > that it makes sure that resources accessed are owned by the currentuser. However, if > PHP is called by apache, which runs as root, and if root owns everything ... I think > ya get the picture. :) That was my dillema before. > > Now about IIS. I have told him to run *nix but he is stubborn as a, umm, donkey when > it comes to this stuff. He refuses to touch it, so I told him apache on Windows. I > simply do not *trust* IIS as a stable and secure webserver. At least apache is > secure (to a certain degree). > > Also, I have thought maybe he could crate a seperate 2k3 user account per each new > user, but then I don't know if safe_mode works with Windows user accounts. > > So, basically, he shouldn't really be running apache on windows w/ php at all, right? > > Thanks > > -- Justin > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
