Chapter 13 – Site Security

Internet Information Server ASP.NET Applications.NET Framework Windows NT/2000 Operating System Forms Passport Windows Certificates Anonymous Standard Windows Digest Code Access Security Active Directory File Permissions Web Clients SSL

Web Clients Get Default.aspx Security Authority Windows Forms Passport Custom user id=GlennJ password=hi2u2! Who are you? Provide proof. Ok, here is Default.aspx Authentication

Web Clients GlennJ says: Select * from Orders Is GlennJ Authorized to retrieve the Orders? Here are the Orders. Authorization

Workgroup Client Workgroup Client Workgroup Client Workgroup Client Directory Users Administrator Randy Gary Sue Directory Groups Users Managers Directory Users Administrator Randy Gary Sue Directory Groups Users Managers Directory Users Administrator Randy Gary Sue Directory Groups Users Managers Directory Users Administrator Randy Gary Sue Directory Groups Users Managers

Local User Account Creation

Domain Workstation Domain Workstation Domain Workstation Domain Workstation Active Directory Users Administrator Randy Gary Sue Active Directory Groups Domain Users Managers Domain Controller Directory Groups Users Printer Users Directory Groups Users Scanner Users Directory Groups Users File System Users Directory Groups Users HR Users

Discretionary Access Control List (DACL) Managers Read and Execute, Write Users Read and Execute Sue Full Control, Member of Users Glenn Deny Write, Member of Users, Managers SalesData.xml Glenn Sue Effective Permissions Read and Execute Effective Permissions Full Control Access Control Entries (ACEs)

IIS Security

Browser Client Web Site Server Initiate Conversation - Can we talk? Here is an encrypted session key Hi - here's my certificate containing the public key, signed by CA's private key Communication with session key Validate Digital Certificate

IIS Certificate Wizard

Certificate Backup

Certificate Restore

SSL Configuration

ASP.NET Authentication Run as User Account or IUSR Run Using Account (ASPNET) Internet Information Server Authentication IP and Domain Acceptable? User Authentication Impersonation Enabled? Yes No Perform ASP.NET Security Checks Check Windows DACL for Resource Permissions Request is Authorized - Respond to User

Browser Client Web Site Server 1. Request protected resource GET mydoc.aspx 3. Get login page - login.aspx?RETURNURL=/mydoc.aspx 5. POST login.aspx?RETURNURL=/mydoc.aspx 2. Redirect to login page 4. login.aspx 7. Redirect to mydoc.aspx with authentication cookie 6.Authenticate User 8. Request protected resource with authentication cookie GET mydoc.aspx 9. mydoc.asmx

Login Page

machine.config allow users="*" Web.config at / ( root ) Web.config at / ( root ) ( no entries ) Web.config at /customers allow users="Joe" deny users="*" Web.config at /customers/sales allow users="Mary" Web.config at /customers/sales/reports allow users="Mary,Joe" deny users="*"

AuthenticationType Name IsAuthenticated IIdentity AuthenticationType Name IsAuthenticated Ticket FormsIdentity AuthenticationType Name IsAuthenticated IsGuest IsSystem Token GetAnonymous( ) GetCurrent( ) Impersonate( ) WindowsIdentity AuthenticationType Name IsAuthenticated HasTicket GetProfileObject( ) PassportIdentity AuthenticationType Name IsAuthenticated GenericIdentity

Identity IsInRole( ) IPrincipal Identity IsInRole( ) WindowsPrincipal Identity IsInRole( ) GenericPrincipal

Forms Authentication Using Database Access

Populated Database

Database Access

Permissions Retrieve Evidence From Assembly Retrieve Evidence From Assembly Code Groups 3 Strong Name My_Computer_Zone Assign into Code Groups UNIONed Permissions Intersect Policy Permissions Enterprise Machine User Application Domain Code Access Security

Security Policy Administration

Testing Code Access Security

Lab Require Login to Customer site