IT Employment

Ask something
Discussion Locked

password protect web page IIS 5

0 helpful
3 replies

by njaneardude-30601088 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have been tasked with making a password protected employees only page on our internet web site so they can download forms. Now I know how to integrate NT authentication for the entire web site but not just one page. I tried creating a folder within the www root folder, creating my index page and sharing it as a web folder, removing the everyone group and added domain users. But I get a 403.1 error. Any suggestions?

3 replies

by lordinfidel

The first though I want to throw out there is that if you are creating a folder so that is u/p protected.

And you do not use ssl to protect the connection.
Anyone can sniff the connection and grab the u/p.

Also, you mentioned that you were using domain users u/p. If I am hearing this correctly, you have a server that is part of your user domain that is taking anonymous web requests. I hope that I do not have to tell you that this is a really bad thing.

With that said. If you are still hellbent on this. After you set your NTFS permissions on the folder and cascade the permissions down.

You will need to open up IIS, go to the folder inside IIS. Right click, properties, directory security, authentication, and choose integrated windows.

Now you do not need to make a web folder. Simple go http://servername/folder It will prompt you for a user name, password and domain. You need all 3.

Caveat, you can only use IE to connect to it. Netscape and others can not use NTLM authentication.

If that is the case, you need to create a local user account on the machine, add it to the folder, remove domain users. open up IIS and clear the digest and ntlm and use only basic.

I strongly do not reccomend any of the above without the use of SSL to encrypt the connection.

by njaneardude-30601088

I set it up in a lab and was able to do just that.
It's a public web site, just wanted a folder for some coporate documents. Not sure if SSL is necessary, but if it amazes the PHB (pointy haired boss) then I'll do it.

by lordinfidel

Just remember, if you use Basic Auth, the passwords are sent in plain text.

Plus the whole communication is in plain text. Which means that I, the hacker, can grab the data as they cross the wire. This is especially bad if it is going over the public net.

If it is going over a vpn then that is different. If it is a local intranet and that server/site is not publicly accessible via the net, then that also is a different situation.

But if it *is* going over the net. Generate yourslefa key (making a cert authority is trivial in 2K). And enforce 128bit ssl for the site.

The key does not need to be purchased thru thawte or some other 3rd party. If it is just for internal corporate use, generate your own. When they go to the site it will throw a cert warning. As long as they press yes, the session will be protected.

This discussion is closed to new replies.