Home / server / Questions / 399264
In Process
Chris Marisic
Asked: 2012-06-16 11:44:19 +0800 CST

Disabling all overrideModeDefault="Deny" in applicationHost.config

  • 772

Given a server's only role is to be a webserver, and the server is only for hosting dedicated applications there is no kind of collocation / user manageable websites.

Is there really any purpose to applicationHost.config settings of overrideModeDefault="Deny"?

Would there be any reasons that replacing all Deny with Allow would be a bad idea?

iis configuration

1 Answers

  1. To quote the docs, the overrideModeDefault="Deny" attribute is generally used to deny changes to configuration settings that:

    are related to any performance, security or critical aspect of the server ... [snipped] ... If the overrideModeDefault attribute is set to "Deny", then any configuration files at a lower level (i.e. web.config files) [my emphasis]

    Even in an environment where your server (public facing) is dedicated to running your own applications, it's generally good practice to not allow changes these settings. The reason being that if your site is hijacked it can't be further subverted by allowing attackers to add their own ISAPI filters or tinker with other critical settings in a site's web.config file.

    Another reason being is where you have developers (who are not server admins) who may not understand the implications of casually overriding a setting to get something to work in a site's web.config which may affect the overall performance and security of the server.

    If you have full control over the server then it's still better to keep these changes restricted to applicationHost.config rather than allow them to be set willy nilly in site web.config files. The server admin team then become the gatekeepers of any changes that might need to be applied for a particular site.

    • 4