Re: Prevent security bypass

To do this in IIS:

1. Set authentication options in IIS nto to allow anonymous.
2. Assign appropriate NTFS permissions on directories.

Exact steps will vary with IIS version.

I too prefer Apache. But IIS is capable of doing this.

Best Wishes,
Chris Travers
----- Original Message -----
From: "Ulrich P." <spam@wir-sind.org>
To: "Chris Neil" <Chris.Neil@abs-ltd.com> Cc: <webappsec@securityfocus.com>
Sent: Tuesday, February 04, 2003 9:33 AM Subject: Re: Prevent security bypass

>
> you could convert your webserver into an apache and then use
guidelines as
> > I read them.
> >
> > How do people address the issue of non-authenticated users requesting
html
> > pages directly from a site without logging in?
> >
> > FYI. This is an IIS server. Our asp pages check the user is logged in,
but
> > with html pages we cannot.
> > My only idea so far is to convert all our html pages to asp. Is there
> > anything less drastic?
> >
> >
> > Chris Neil
> > Security Officer
> > Chris.Neil@abs-ltd.com
> > -------------------------------------------
Received on Tue Feb 4 17:02:24 2003