Welcome Guest! To enable all features please Login or Register.

Notification

Icon
Error

Avoid running as Network Service?
PeterE
#1 Posted : Monday, 17 October 2011 6:26:58 AM(UTC)
Rank: Newbie

Joined: 12/10/2011(UTC)
Posts: 1
Location: Malmö, Sweden

Greetings and thanks for a great application!

I'm running GSP in a hosted environment where I only have file access the server, ie I can't modify any IIS settings (more than a few related to .Net version etc).

The server was recently migrated from IIS 6 to IIS 7 and after that I'm not able to upload anything to the site.

I have been trying to figure out why this happens and it seems to end up with this reply from the ISP helpdesk:

Quote:
Customer applications run impersonated as their IUSR.
This IUSR should be in the same group as their FTP login, meaning that they should have full control of their entire webhotel. Generally speaking permissions should not be an issue on Windows hotels.

However, in some specific instances their code will run as the less privileged NETWORK SERVICE user instead. This user does not have write access to their files. This is the case with code run from Application_End() and Application_Begin()in their Global.Asax file.

The Local System is not involved in executing applications on our servers, and under no circumstance can we run their code as this user, as this would severely compromise security on the server.


As far as I understand this implies that GSP always runs as Network Service and that the ISP only allows applications that may be impersonated as the web hotel user.

Is it possible to avoid GSP running as Network Service or do I have to change ISP to get this working?

I'm running version 2.3.3456 of GSP. However, I tried to install a clean 2.5 to a subdomain on the same server and I still experience the same problem.

Best regards,
Peter
Roger Martin
#2 Posted : Monday, 17 October 2011 9:22:56 AM(UTC)
Roger Martin

Rank: Administration

Joined: 3/08/2007(UTC)
Posts: 3,300
Location: Fort Atkinson, WI

Which user GSP runs under is decided by IIS, not anything within the code. GSP is not hard coded to use Network Service or any other account. Also, GSP does not use a Global.asax file, meaning it does not run code in application-level events such as Begin() and End(). Finally, GSP does not use impersonation.

The user is specified in IIS, and it requires modify permission to the media objects directory as well as App_Data. Are these permissions granted? Many hosting companies allow you to configure these settings in their control panel.

If you still have trouble, tell us the exact error message you are getting.
Roger Martin
Creator and Lead Developer of Gallery Server Pro
Rss Feed  Atom Feed
Users browsing this topic
Guest
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.