Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Controlling Access to Web Folders Using WebDAV

Web-based Distributing Authoring and Versioning (WebDAV) is an extension to the HTTP/1.1 standard, which allows clients to remotely publish, lock, and manage resources on the web. Before you discount this technique as just another way to update websites, and thus an area of concern only for those responsible for website security, think again.

WebDAV can be used to transfer data to and from a web folder for which the user is given permissions. The data does not have to be HTML files or web-executable scripts and programs. It can be Word files, text files, or any kind of file.

WebDAV folders allow properly permissioned users to copy and move files around in the WebDAV directory.

If permissioned, users can retrieve and modify file properties.

Multiple users can read a file concurrently, but only one user can modify a file at a time. (Files can be locked and unlocked.)

Web folders can easily be created on any IIS server. The permissions assigned to these folders determine who can transfer data files to them.

Since these are the very things that server message block (SMB) shares allow users to do on a remote server, WebDAV should loom as large on your security horizon as SMB-based shares. (And perhaps it should be considered as a valid substitute for SMB-based shares, if properly secured.) Table 5-6 presents the similarities and differences between WebDAV publishing and SMB-based sharing.

WebDAV is not new to Windows Server 2003, but in Windows Server 2003, implementation changes mean that from Windows XP or Windows Server 2003, a user can use simple UNC-based connections to copy files to WebDAV folders and use browser-based publication. For example, connecting to a WebDAV folder is now similar to connecting to a share. If the name of a WebDAV folder is HR Feedback and it resides on the server IAM, a user can connect using the net use command. Windows will also look for the virtual directory hr Feedback using HTTP and make a new network connection:

net use \\iam\HR Feedback
net use * http://IAM/HR Feedback

WebDAV cannot be used by default to provide access to data on Windows Server 2003 because IIS is not installed by default. Even if IIS is installed, WebDAV is not enabled by default. To use WebDAV, IIS must be installed, and WebDAV must be enabled. However, once enabled, clients can connect to and use WebDAV folders across a firewall if port 80 is open to the server. Unlike SMB ports, there is no special WebDAV port, so you cannot provide access to a website and block access to WebDAV shared data by setting firewall ports. Since port 80 is often open to allow access to a web server, and WebDAV uses HTTP, clients can connect to and publish and manipulate files on servers where connections to SMB shares are blocked. This is important to remember. For years, the security community has advised against allowing access to SMB shares over the Internet (and has not been successful in convincing companies and individuals to do so). Now, if WebDAV publishing is enabled, and access to the website is allowed, a connection is possible via the Internet right through the firewall. It is for this reason that you must develop a policy concerning when WebDAV is allowed, if it is allowed on Internet-accessible web servers, and how permissions and web server authentication will be configured to ensure the least risk of intrusion.

WebDAV permissions are not meant to replace NTFS permissions; they are meant to be used with NTFS permissions. Like share permission, WebDAV permissions combine with underlying NTFS permissions, and the most restrictive permission is the one that will be used. However, unlike share permissions, WebDAV permissions affect every user. You cannot give Read permission to one group of users and not to another. However, you can use the underlying NTFS permissions to implicitly or explicitly deny groups of users that you don't wish to read the files. Table 5-7 lists and describes the WebDAV permissions.

Enabling Script Source Access is a bad idea because users can read and possibly modify scripts. (If Script Source Access is enabled and either Write or Read is also assigned, users can access source files. If Write is assigned, then users can modify scripts.) It is always a good practice to place scripts and executable files in a separate folder on a website, and then set appropriate permissions. For example, set Execute permission in a folder that contains scripts and executable that users should be allowed to run, set Read permissions on folders used to make stored files available for reading, and set Write permission on folders used for file publishing. Never set both Execute and Write permissions on the same folder, because a malicious user could then publish a script to the folder and run it. Scripts may also contain sensitive information such as passwords and therefore should not be readable by all users.

Appropriate file and WebDav combinations are as follows:

Read, Write, and Directory Browsing enabledClients can see a list of resources, modify them, publish their own resources, and manipulate files.

Write enabled and Read and Directory Browsing disabledClients can publish information but cannot list or read anything published.

Read and Write enabled and Directory Browsing disabledClients can open and read the files they know the names of, and publish files to the folder, but they cannot list the contents of the folder.

The Write access permission does not provide clients with the ability to modify script-mapped files. Script-mapped files are Active Server Pages (ASP) and others. To modify these files, both the Write and Script source access must be assigned.

To create a publishing directory, enable WebDAV, create a directory to share and assign NTFS permissions, create a virtual directory on IIS, and configure virtual directory permissions.

Enable WebDAV

When IIS is installed, WebDAV is not enabled. To enable WebDAV, do the following:

Create a Folder to Share and Set NTFS Permissions

Create a file system folder where files to be shared will be placed. Set appropriate NTFS permissions on the folder. For example, if the folder will be a repository where accountants may store and modify files, NTFS permissions should give the Accountants group Modify permission. Full Control would not be required.

Create a Virtual Directory

The next step is to create a virtual directory on the web server that points to the created folder:

Configure Virtual Directory Security

The wizard does not allow completion of security configuration. Immediately after creating the virtual directory and before allowing client access, care should be taken to apply further security:

Client Side Configuration

Once WebDAV has been configured, enable and start the Web Client service on the client to take full advantage of the benefits. The Web Client service is disabled by default.

WebDAV may already be in use in your organization. To make sure it doesn't become part of the data misuse in your organization, follow these best practices:

Ensure WebDAV directories reside on NTFS-formatted volumes.

Assign NTFS permissions on files and folders in the WebDAV directory.

Use web folder permissions.

Insist on Windows Authentication on intranet.

Use but protect basic authentication on the Internet with SSL.