1. IIS and .NET Security
Application Pools
Pamella Smith June 18, 2009

2. Application Pool Defined Application Pool and Application Domain
IIS 5.0 Process Model
IIS 6 Process Model
IIS 7 Process Model
Security Issues
Application Pool Configuration
Caveats
8/30/2019

3. Application Pool Defined
An application pool is a way to isolate applications/Web sites within the IIS framework.
Each application pool is given its own set of server resources.
An application pool may have 1 to many processes.
8/30/2019

4. Application Pool or Application Domain
An application domain used to isolate executed applications to prevent resource and memory interference.
One application may have many application domain.
One process may be associated with many application domains.
An application pool can contain one or many applications.
Each application pool runs in its own worker process.
Application pools can be configured to provide required isolation needs.
8/30/2019

5. IIS 5.0 Process Model
The IIS inetinfo.exe process listens on Port 80 for incoming HTTP requests. Since this is a process, it runs in “user mode”.
Requests are queued to a single process queue.
ASP.NET requests handed to the ASP.NET ISAPI.
ISAPI communicates with ASP worker process via a named pipe.
ASP worker process delivers the request to the ASP.NET HTTP runtime environment.
ASP.NET web applications are hosted inside the worker process.
Uses the concept of app domain…each virtual directory is executed in a single app domain.
8/30/2019

6. IIS 5.0 Application Protection
Low
Medium
High
8/30/2019

7. IIS 6 Process Model Applications run in different worker processes.
Each application pool can contain multiple application domains
Multiple processes may host one application pool.
Incoming HTTP requests are handled and queued at the kernel level versus the user mode (HTTP.SYS)
Request is routed directly to correct application pool/specific worker process.
The worker process loads the ASP.NET ISAPI extension.
Request dispatching is not affected by crashes and problems at user level.
8/30/2019

8. IIS 7 Process Model More modular
Separate modules for authentication schemes
Can uninstall or “not” install
Reduces attack surface of server
ASP.NET integrated – communication with ASP.NET ISAPI eliminated
Still uses application pools
Classic Mode
Integrated Mode
8/30/2019

9. Security Issues
.NET-integrated enhancements in IIS 6 and IIS 7 provide a greater level of application stability.
Application Pools provide greater isolation levels for applications.
High-risk applications can be grouped into properly configured application pools.
Application pools can be tuned to provide a more granular level of security and safety.
8/30/2019

10. Application Pool Configuration
Creation
Request-Processing Mode
Recycling
Start/Stop
Performance
Health
Identity
Other Configuration Options
8/30/2019

11. Application Pool Creation
Simple
APPCMD
Programmatically
ADMIN extension
8/30/2019

12. Request-Processing Mode (Classic and Integrated mode (IIS 7))
Handles requests as IIS 6.0
Duplication of some steps, i.e., authentication.
Integrated
Only configured steps are executed, i.e., one-time authentication
Managed features available to all content types
8/30/2019

13. Recycling Restarting the worker process Default 1740 minutes
Useful for problematic code
8/30/2019

14. Performance Idle Time-Out Request Queue Limit Enable CPU monitoring
Max number worker processing
8/30/2019

15. Health Enable Pinging Enable Rapid-Fail Protection Startup Time Limit
Shutdown Time Limit
8/30/2019

16. Identity
Predefined
LocalSystem
NetworkService
LocalService
8/30/2019

17. Other Configuration Options
Specify .NET framework
Automatic Startup
Assign applications to an application pool.
8/30/2019

18. Caveats Don’t have too many application pools. Set memory capacities
8/30/2019

19. References
Working With Application Pools in Internet Information Server
IIS 5.0 Process Model
Dotnetextract.googlepages.com/iis-5.0-process-model
IIS 6.0 Process Model
Dotnetextract.googlepages.com/ii6.0processmodel
IIS 7.0 Process Model
8/30/2019

20. Ditto http://www.casabaseurity.com/iis7_security_guide
8/30/2019