Comments on Umbraco Development Blog by Vizioz: Umbraco Permissions Script - Secure Version

Thanks for the snippet. However I Got an error sa...

2011-09-06T09:29:27.219-07:00

Thanks for the snippet.
However I Got an error saying "The SID for a trustee could not be found", so I googled around and found out that it could be due to the installed windows environment.
Once I removed the "%computername%\" part from each setacl.exe call, it worked perfectly.
More info could be found here: http://helgeklein.com/setacl/documentation/command-line-version-setacl-exe/#trustee-1

Many thanks!

Hi Andrew, Why would you want to do this? This me...

2010-08-13T08:20:38.372-07:00

Hi Andrew,

Why would you want to do this? This means that your users cannot work from home, unless they always have VPN access which I would think makes it quite restrictive and I think one thing most clients like is the flexibility it gives them to edit the content wherever they are.

That being said, one way you could do this is to setup two websites pointing to the same folder / database. One on the internal IP address and the other external.

On the external one you could then block access to the admin section within IIS.

You would probably have to add something to the Publish event so that when you do a publish on the private site it then updates the cache on the public site.

My preference thou, would be to rename the directory to make it very unlikely for people to find accidentally, add an SSL certificate so that the data transferred is secure and allow it to still be accessed from anywhere.

Hi Chris, Thanks for this. What do you recommend ...

2010-08-13T08:10:59.214-07:00

Hi Chris,

Thanks for this. What do you recommend for securing the Umbraco administration interface on a single instance of IIS, so that it's not publicly available? Adding in IP Restrictions is ok, but ideally the ./umbraco/ admin site would only be accessible from the LAN where it's hosted. Is the only way in using two instances of Umbraco, one on a LAN-only interface, disabling ./umbraco/ (or removing ./umbraco_client ?) on the internet facing server?

Nice, Chris! By default, IIS5 (winXP) uses the AS...

2009-10-21T02:56:16.584-07:00

Nice, Chris!

By default, IIS5 (winXP) uses the ASPNET user for websites and IIS6 and IIS7 use NETWORK SERVICE as the default application pool owner.

It would be great if you could determine the app pool owner at the start of your script, or at least allow an optional parameter if someone like Nik has a different user set for the application pool owner.

cheers,
doug.

Hi Nik, I am happy to be corrected if someone can...

2009-10-20T12:53:32.757-07:00

Hi Nik,

I am happy to be corrected if someone can suggest an improvement :)

I was thinking of also adding to this script a line that deletes the Install directory, as I think that is quite often forgotten and left.

I hope others who know more about security than me can shed some more light on whether this is good or bad practice so that I can update the script accordingly :)

Cool, thanks for sharing this Chris. Will come in ...

2009-10-20T12:46:24.277-07:00

Cool, thanks for sharing this Chris. Will come in handy for sure. One thing, if I can weigh in... NETWORK SERVICE is a fiarly scary user account in a production environment. It gives permission to imperonate a client after authentication among other things. I tend to stick with the ASP.NET user account for these priveleges. It may not be as big a deal as I think, but just wanted to point it out.

Thanks again!