Windows server 2003 security

A charity I help out with has been given a fully working and configure web server (Windows server 2003). We are about to launch an ASP site that allows users to dynamically update content via forms. Can anyone give us any advice on what security should be applied to the Database folder to prevent people from downloading the DB, if in fact this is necessary? And any other advice on security pitfalls that would normally be pre configured by your host?

--moved to the Windows Security forum, you'll get better answers here.

On the server open your web browser to http://localhost/iishelp for the IIS documentation.

Look at the Microsoft server documentation in the online help, and at the msdn library.

There's way too much for any simple answer.

If you have a Micorsoft Access database then you really need to remove read permissions for it or the folder it is in.

This will deny browsers permission to open the file.


You can remove read permission to files/folders from IIS.

Another option is to move the database into a folder outside of the webroot.

e.g.
Your website is on the server is at
C:\Inetpub\

The webroot (where the html/asp scirpts/images etc) is at
C:\Inetpub\wwwroot

You could have your database at
C:\Inetpub\Data




For the content management, make sure you know what you are allowing your users to do.
If you let them post all HTML tags then they could break their pages.
It's best to restrict them to formatting tags such as tables, headers, paragraphs, links, images, lists etc.


If you let them post all HTML then they can disrupt their pages using styles, iframes, HTML/BODY/Script/Form tags.

If you have script tags available then they could bring down the server using reloads and redirects etc.

Thanks degsy, i have moved the folder outside the root directory as suggested above. This solved the problem of people browsing to and downloading the DB.

Do you have any suggestions of how i would go about restricting the users to only "formatting tags"?

You just have to add your own custom validation to the script.

If you really want to get into it you would look into using Regular Expressions to parse the input and detect or remove invalid content.