AJS 3.x Manual

Note! This Manual is for the "Forms authentication" version. This version requires you to create each account and store credentials in the HTTP Commander XML database. If you have Windows server or Active Directory accounts already and want to use them in the HTTP Commander, you need to download the "Windows authentication" version! This Manual is for the Forms authentication version only!

Web file manager Free Installation assistance

NTFS permissions

This section describes how to set up NTFS permissions on HTTP Commander data files and on user data folders.

If you want to check NTFS permissions manually then see information below:

• Application pool identity
  First, you need to know which identity the application runs under. In Windows 2003 IIS 6 and Windows 2008 IIS 7.0 the default application pool identity is "NETWORK SERVICE". In Windows 2008 R2 IIS 7.5, 2012 IIS 8 and 2012 R2 IIS 8.5 (64 bit) the default application pool identity is "IIS APPPOOL\DefaultAppPool" (for applications using default application pool). In general case, the default identity is "IIS APPPOOL\PoolName". Here the PoolName should be replaced with the actual pool name.
  Note! In our video tutorial for IIS 7, 7.5, HTTP Commander runs under the "IIS APPPOOL\htcomnetpool" security identity. If you are not sure of the identity name, then check application settings in IIS console:
  • Open IIS console: Control panel-> Administrative tools-> Internet Information Services (IIS) Manager-> Expand "Default web site"
  • For IIS 7, 7.5, 8 and 8.5: Click the Application pools node. Check the "DefaultAppPool" pool identity (provided the application was assigned to default pool). Most values stand for themselves: LocalService, LocalSystem, NetworkService mean that the application pool runs under the respective identity. ApplicationPoolIdetity is a special value meaning that the application pool uses "IIS APPPOOL\PoolName" identity. Here the PoolName should be replaced with the actual pool name. Other identity value means that a custom account was used to run the application pool.
    Screenshot

     

  • For IIS 6: Expand "Application pools" node and right-click the "DefaultAppPool" item (provided the application was assigned to default pool). Click "Properties" in the context menu and find "Application pool identity" on the "Identity" tab. By default it is "NETWORK SERVICE".
    Screenshot

     

    
    
  If you are still not sure which identity the application works under.
  • open http://localhost/HTCOMNET/Diagnostics.aspx in a web browser and look at the "Application identity" value;
  • open Windows Task Manager, find the "w3wp.exe" process corresponding to your application, and look at the user name column of the table.
  If you use a custom service account as the application pool identity, do not forget to properly configure that account. You must configure the account by running the Aspnet_regiis.exe utility with the -ga switch. One of symptoms that the service account is not configured is NTFS permission problems with the "%Windir%\Microsoft.NET\Framework\version\Temporary ASP.NET Files" folder. For more details see the MSDN article How To: Create a Service Account for an ASP.NET 2.0 Application. Although the above article applies to IIS 6, the same requirements are valid for IIS 7, 8.
• Anonymous user
  By default it is IUSR in Windows 2008, 2012 and IUSR_MACHINENAME in Windows 2003. If you are not sure of the identity name, then check application settings in IIS console:
  • Open IIS console: Control panel-> Administrative tools-> Internet Information Services (IIS) Manager-> Expand "Default web site"
  • For IIS 6: right-click HTTP Commander application, select Properties, in the properties dialog, open "Directory Security" tab, in the "Authentication and access control" group click "Edit" button, in the "Enable anonymous access" group inspect the anonymous user name in the "User name" field.
  • For IIS 7, 7.5, 8 and 8.5: select HTTP Commander application, open Authentication feature, select Anonymous authentication item, click Edit on the Action pane, inspect the identity used for anonymous user in the Edit anonymous authentication credentials dialog. Anonymous user may be either a specific user or application pool identity.
• Note for Windows Server 2008 users! You may face a problem assigning NTFS permissions to identities like "IIS APPPOOL\DefaultAppPool" using the standard Windows security dialog. The early versions of these Operating Systems (before Windows Server R2, and Windows Server 2008 R2 in the default state when update is not installed) may complain that they cannot find the object name "IIS APPPOOL\DefaultAppPool" (known problem). If GUI does not allow you to add the desired identity, you have two options: switch to the old well known "NETWORK SERVICE" identity or use command line utility icacls to assign permissions.
  Screenshot

  

  • To switch to the "NETWORK SERVICE" identity, select the application pool in the IIS Manager, click "Advanced settings" on the Action pane, find the Identity property in the Process Model group, click the change button next to the property, select NetworkService in the Built-in account combo box.
  • Use icacls command line utility to assign NTFS permissions.
    You need to execute a command like the following:
    icacls "Path\To\Folder" /grant "IIS APPPOOL\DefaultAppPool:(OI)(CI)(RX)"
    This command assigns NTFS permissions for "IIS APPPOOL\DefaultAppPool" identity to the "Path\To\Folder" folder or file. This command adds Read permissions.
    Note Once the identity is added to the ACL of the folder, you may use standard Windows GUI to manage the identity permissions.
• Temporary folder
  

  HTTP Commander uses a temporary folder to store temporary files, such as thumbnails, intermediary video files created in video conversion process, zip files for download, and other. The temporary folder is normally "%WINDIR%\Temp", or it may be "%USERPROFILE%\AppData\Local\Temp" if the application pool is configured to load the user profile. The user refered here is the application pool identity user. For example, if the application pool is named HttpCommanderPool, the temporary directory may be "C:\Users\HttpCommanderPool\AppData\Local\Temp". Location of the temporary directory depends on the value of TEMP system and user environment variables. To be certain of the location of the temporary folder, refer to the Diagnostics.aspx page in HTTP Commander.

  A system-wide temporary folder ("%WINDIR%\Temp") by default provides necessary access to Administrators and System, but not to normal users. A user-specific folder allows access only to the respective user. HTTP Commander requires write access to the temporary folder for application pool account and end-user accounts in Windows version. The result is the default access is inappropriate. The simplest solution is to configure Modify NTFS permission for all required users. This choice, however, creates security vulnerability, users may read and overwrite each other's files. NTFS permissions allow that. A more secure solution is to configure NTFS permissions as follows. Assign Full Control to CREATOR OWNER pseudo-user. Assign Create files, Create folders, Traverse folder permission to the target users. Apply the last permission to "This folder only". Target users will be able to create files and folders in the temporary directory, but they have access to only their files and folders. Access to others files and folders will be denied. Assigning Full control to CREATOR OWNER guaranties that users have full control to their files.
  Screenshot

  

• After you have learned the accounts used in the HTTP Commander application, you are ready to configure NTFS permissions.
  How to set permissions:

  HTTP Commander AuthMode	Resources	Accounts	Permissions	Note
  all	HTCOMNET folder	application pool identity	Read
  Forms	HTCOMNET folder	Anonymous user	Read	1
  all	Temporary folder	application pool identity	Modify
  all	Data folder	application pool identity	Modify	2
  Forms	web.config and HttpCommanderSettings.config files	application pool identity	Modify
  Forms	user data folders	application pool identity	Read or Modify depending on your needs

• Note 1. Why grant access to anonymous user?

  Applies to AuthMode Forms, Forms with Windows users, Novell EDirectory.

  • IIS 7 and above
    

    Normally the web application accesses the file system under the application pool identity, but sometimes the anonymous user is impersonated. Note that ASP.NET Impersonation is disabled in IIS.

    You may find out that the web application works without problems even when you have not assigned explicit permissions to an anonymous user account. The typical cause of this issue is that the anonymous user gains access to the file system via permissions assigned to Users group. Another explanation may be the fact that anonymous user matches the application pool identity to which you have assigned Read permissions already.

  • IIS 6
    

    Web application accesses file system under application pool identity as well as with impersonated anonymous user.

  Why write access is not needed for anonymous user?

  The application does not explicitly impersonate the anonymous user to perform its tasks. All work is done under the application pool identity. As for read access to the application's root directory, it is IIS that impersonates the anonymous user to verify access to specific objects.

• Note 2. By default, the Data folder is located in the HTCOMNET root folder, but you can move it outside the web server (See DataFolderPath key in the Application settings)!

• Note 3. If you have an existing folder structure for domain users with set permissions, you don't need to modify existing permissions. The application impersonates the end-user when processing a user request. NTFS file system permissions determines the level of access the end-user gets to the file system through HTTP Commander.
  If you want to create a new structure of folders, you need to apply the necessary NTFS permissions on the folders for the domain users.