How to forbid usage of web.config files?

Question

I have a Windows 2008 R2 server with IIS7.5 installed. I need to provide users with read-write access to some directory tree via WebDAV. The same users will also be able to reach the same directories by other means - FTP, SFTP, CIFS, etc.

My aim: I don't want someone to be able to upload / modify web.config files in the published folders, thus modifying behavior of IIS. If such file is created, IIS should simply treat it as any other file.

Is it possible to concentrate all settings for the site in the applicationHost.config or in any other file outside the published tree, and make IIS ignore any additional web.config files?

Thanks!

score 1 · Accepted Answer · answered May 07 '14 at 07:32

Found the relevant setting - it's called allowSubDirConfig. It can be specified either in virtualDirectoryDefaults element (for all sites) or in virtualDirectory element, in the applicationHost.config file.

Example:

<configuration>
    <system.applicationHost>
       <sites>
            <site name="Default Web Site" id="1" serverAutoStart="true">
                <application path="/">
                    <virtualDirectory path="/" physicalPath="%SystemDrive%\inetpub\wwwroot" />
                    <virtualDirectory path="/Temp" physicalPath="C:\TempRoot" allowSubDirConfig="false" />
                </application>
            <applicationDefaults applicationPool="DefaultAppPool" />
            <virtualDirectoryDefaults allowSubDirConfig="true" />
        </sites>
    </system.applicationHost>
</configuration>

web.config files under /Temp virtual directory won't be checked.

There are some other ways as well: http://www.sourceinaction.com/blog/web.config-dependencies-for-multiple-asp.net-web-applications

Note that this will only make it such that subdirectories are ignored. Virtual directories (those configured as application roots) will still be read - which probably isn't a problem for the original submitter, but it's worth mention. — scradam, Jun 25 '15 at 19:03

fsr · Answer 2 · 2021-07-22T12:28:04.173

An easy way to avoid users from using WebDav to modify web.config files, is by using WebDav Authoring Rules. Just create a rule on top of all others that gives All Users NO Permissions to the web.config files.

Further details: If you enabled and configured WebDav thru the GUI, you already should know that the [WebDav Authoring Rules] is accessed thru an icon on IIS GUI. First you entered that section at the Site level to enable WebDav, then you entered again into the [WebDav Authoring Rules] section at the WebDav folder level to add the rule to give the user/group access to [All files] on this folder. Before entering that rule, you add one that applies only to [web.config] files, [All Users], and you leave all permissions UNchecked. So, the rule is AT THE TOP, and has priority over the one that gives access, so no one can use WebDav to modify web.config files. You can also modify the order of the rules after creation, if needed.

In this page there is a description of how to configure a site for WebDav. I used the GUI method. If you follow that, it's obvious where the section is: https://www.server-world.info/en/note?os=Windows_Server_2019&p=iis&f=9

It sounds for a good solution, but show us the ways, else i have to flag it for low qualitie :-) — djdomi, Jul 21 '21 at 04:17
Well, [WebDav Authoring Rules] is accessed thru an icon on IIS GUI, and you need to enter that section twice to enable and configure WebDav thru the GUI, so i assumed that it needed no further explanation. I'll add some details to the answer. — fsr, Jul 22 '21 at 12:21

score 0 · Answer 3 · answered Apr 07 '14 at 15:18

0

Have a look at the answer from Anil Ruia here: http://forums.iis.net/t/1161527.aspx?Disable+creating+web+configs+in+each+folder

If you go to applicationhost.config and lock all the sections (overrideModeDefault="Deny"), then IIS manager will write all IIS config settings to applicationhost.config (same for asp.net config setting and root web.config file). Note that this will completely prevent someone from being able to use web.config files to override IIS settings - and they may scream about it.

answered Apr 07 '14 at 15:18

MichelZ

11,008
4
30
58

Thanks, @MichelZ, but for some reason this doesn't work: I've set `overrideModeDefault="Deny"` in all entries inside `` , but still web.config files have effect and IIS Manager writes all changes there - even on site level. – Cat Mucius Apr 08 '14 at 07:40

How to forbid usage of web.config files?

3 Answers3