paul's questions

I have IIS 6.1 on Windows Server 2008 SP1. There is one web application which has only Windows Authentication enabled. This has just one provider: NTLM.

When I works, it works fine - until the server is rebooted. Following a reboot, the login dialog is always displayed but logins always fail.

I have tried restarting both IIS and the application pool but this does not help. What does work is enabling and disabling Authentication mechanisms - e.g. Anonymous. After fiddling around for a while, NTLM works - until the next server start.

In the log I can see the following:

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2016-01-14 12:56:11 127.0.0.1 GET /Pages/MainPage.aspx - 80 - 127.0.0.1 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.1;+WOW64;+Trident/6.0) 401 2 5 0
2016-01-14 12:56:11 127.0.0.1 GET /Pages/MainPage.aspx - 80 - 127.0.0.1 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.1;+WOW64;+Trident/6.0) 401 1 2148074254 0

What could be causing this? What is the solution?

Our IT department has around 90 people. We manage systems and create applications. The systems are of varying size from SAP to Lotus Notes to Tivoli Access Manager (TAM).

Increasingly, the applications we create connect to these systems via web services, LDAP queries etc.

As time goes by it is easy to forget what connects where so, that when changes are made, service connections can become disrupted.

Example:

The TAM system contains an LDAP with user information including which applications they are authorised to view. An unrelated application fetches this user information to build a dynamic web-based menu containing personalised links.

The TAM crew are told to tighten their security and so close all the ports. They have long forgotten about the mini web app that builds its menu every night. The next morning the production boss is in a rage because his people cannot start their applications because the menu is half empty.

Question

What kind of systems could be introduced to help remind all concerned which services are in use?

I am trying to set up a web site on Windows Server 2008 using IIS 7.5. I have created a new application pool (TestAppPool) and a new web site at c:\inetpub\wwwroot\test. I have given the Read/Execute permissions to 'IIS AppPool\TestAppPool' (using icacls). Authentication is just NTLM.

When I try to access the site, a login prompt comes and will not let me through.

I have followed through the instructions which I found at https://stackoverflow.com/questions/5437723/iis-apppoolidentity-and-file-system-write-access-permissions but still cannot access the web page.

What do I need to do?

The event log contains the following:

Event code: 4008 
Event message: File authorization failed for the request. 
Event time: 07.09.2015 14:18:58 
Event time (UTC): 07.09.2015 12:18:58 
Event ID: bdf78e0b751e41dcae5b391d18555406 
Event sequence: 3 
Event occurrence: 1 
Event detail code: 0 

Application information: 
    Application domain: /LM/W3SVC/3/ROOT-1-130861019381349122 
    Trust level: Full 
    Application Virtual Path: / 
    Application Path: C:\inetpub\wwwroot\TEST\ 
    Machine name: SRVC200 

Process information: 
    Process ID: 3552 
    Process name: w3wp.exe 
    Account name: IIS APPPOOL\TestAppPool 

Request information: 
    Request URL: http://mywebsrv:8080/ 
    Request path: / 
    User host address: 172.xx.xx.xx 
    User: DOMAIN\me
    Is authenticated: True 
    Authentication Type: Negotiate 
    Thread account name: IIS APPPOOL\TestAppPool 

Custom event details: 

I have just installed WS 7 on our stage server. The test server was done some months ago. I have deployed the same applications to stage as on test.

One application is causing me problems. I call the login servlet but the result is an 'Internal Server Error' message. From my logs I can see that the servlet processed the log in successfully and redirects to a JSP. That is the last message. I can find no further info in any of the other standard out/err logs.

I have tried creating a simple JSP containing only HTML - same error. If I rename the file to test.html, it displays correctly. The plugin configuration appears to be identical with the one on the test server (where everything works)

Ideas anyone?

I am currently investigating an instability problem in my customer's web site. While looking through the access log I noticed a sudden burst of activity from one particular IP. It started off requesting normal URLs but at a high rate - 8 hits/sec. For most of the time the same URL (actually a directory) was requested but interspersed with these were URLs which started off as valid but always ended with a random 11-character value like this:

93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/0g2exjxspky.html HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -

Has anyone seen this kind of behaviour before? I can't figure out what might lie behind this. I'd be interested to hear anyone's opinion on this.

Paul

We're deploying a simple newsletter webapp on a stand-alone LAMP platform in the company DMZ. There is some discussion as to whether the MySQL server should be removed from the DMZ and put in the internal network.

The server is behind a firewall with only port 80 open and MySql will be attached to a non-standard port. The database contains customer email addresses.

Is this a secure setup (or secure enough)? How much more secure would it be by placing the data behind a second firewall? (I'm more of a developer so I'm not really aware of all the security aspects here - can someone enlighten me!)

Update Just for clarification and to attact more comment here is our current setup:

internet - firewall1 - http server - firewall2 - appserver - firewall3 - enterprise resources

This new application was supposed to go completely within the DMZ between firewalls 1 and 2. We're currently discussing pulling the MySQL server in behind the 2nd firewall.