Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I had no luck in googling information related on security loopholes when using anonymous access in IIS. So I'm going to throw the question out here...

Maybe it is a very common practice for using anonymous access in IIS 6, but what are the potential security loopholes? I know the obvious fact that allowing anyone to login to the system is already a potential security problem, but I'm trying to cover off some specific security loopholes e.g. hacking of the anonymous account, illegal access of files, unauthorize access to parts of the system (e.g. SharePoint related stuff), etc etc.

Thanks.

share|improve this question
add comment

1 Answer

In IIS 6.0, the anonymous user is actually *IUSR_computername*, which is a valid Windows user that is a member of the Guests group.If that user account has appropriate rights, then the action (typically to read the file) is performed.

Your concern of hacking the anonymous account is baseless as the anonymous user is already using that account. With Anonymous access , you actually avoid the risk of password hacking (as you never ask for password) for other windows accounts, which I would say provides better security in this sense.

Possible security loopholes arise is when

  • You assign different account other than *IUSR_computername* and that account has permissions to do the unintended operations( illegal access of files, unauthorize access to parts of the system ).

  • IUSR_computername or anonymous account has write access permissions.

  • IUSR_computername or anonymous account has execute permissions to all executables in Windows directories and subdirectories.

When using anonymous access with SharePoint, It is common that developers impersonate a high privileged account (in code)to perform some operations(add item to list, delete item) which may again be a security issue.

share|improve this answer
    
thanks for the reply. I'm just not too sure what are the potential security risks involved when enabling anonymous access on IIS 6 e.g. does it have the potential to clash with other things that runs on the same app pool etc. Also, when you mention using anonymous access with SharePoint, do you mean actually using the SP anonymous or IIS anonymous? –  BeraCim Dec 7 '11 at 23:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.