in reply to CGI + IIS + Win32::Service == Doh!

If you do not have any specific IIS permissions on the CGI script, it will run as IUSER_Machine_Name, which probably does not have the rights to srart/stop services.

I suggest taking OFF anonymous access to the CGI script - then it will inherit the ID from whoever logs-on.

"When you are faced with a dilemma, might as well make dilemmanade. "

Replies are listed 'Best First'.
Re: Re: CGI + IIS + Win32::Service == Doh!
by paulbort (Hermit) on Feb 15, 2004 at 20:35 UTC
    You should be very careful when changing the account that CGI runs as. You're giving anyone who finds a vulnerability in IIS, or your script, way too much access to your box.

    There are safer ways to do this. One of the easiest is to have the CGI script write a flag file, or a row in a database table (if it already has DB access for something else) that tells a back-end process what to do. The back end then (a) has permissions to do things, and (b) isn't a script that's exposed to the outside world. Yes, you're writing two scripts instead of one, but the reduction in risk is worth it.


    --
    Spring: Forces, Coiled Again!
[reply]
Re: Re: CGI + IIS + Win32::Service == Doh!
by mdog (Pilgrim) on Feb 15, 2004 at 18:49 UTC
    Many thanks! I obviously hadn't thought to change the permissions at the ISM level. Went in and changed who was running the script with anonymous access from IUSER to my account and everything worked great!

    Thanks again!
    mdog

[reply]
      Like paulbort says, it is a security hazard to have the script running privileged commands for anybody.

      My suggestion was to remove Anonymous access - this would require some other form of User authentication before the script was run - either "Integrated NT", or Cleartext. If you are on the Internet, I would recommend Cleartext over HTTPS.

      "Experience is a wonderful thing. It enables you to recognize a mistake when you make it again."
[reply]

In Section Seekers of Perl Wisdom