Asegúr@IT II - Seguridad En Iis7
•
1 recomendación•1,715 vistas
Diapositivas de la Sesión de Seguridad en IIS 7 utilizadas por David Cervigón en el evento de Asegúr@IT II que se realizó en Barcelona en Abril de 2008.
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (18)
Similar a Asegúr@IT II - Seguridad En Iis7
Similar a Asegúr@IT II - Seguridad En Iis7 (20)
Más de Chema Alonso
Más de Chema Alonso (20)
Último
Último (13)
Asegúr@IT II - Seguridad En Iis7
- 2. David Cervigón Luna IT Pro Evangelist Microsoft Ibérica http://blogs.technet.com/davidcervigon
- 10. Envio de Respuestas Log Compresión NTLM Basic Determinar Manejador CGI Static File Autenticación Anon Implementación Monolítica. Instala todo o nada… Extensibilidad del la funcionalidad del servidor solamente a través de ISAPI… ASP.NET PHP ISAPI … …
- 12. Envio de repuestas Log Compress NTLM Basic Determine Handler CGI Static File ISAPI Autenticación Anon SendResponse Authentication Authorization ResolveCache ExecuteHandler UpdateCache … … La funcionalidad del servidor se divide en ~ 40 módulos ... Los módulos se enchufan a una pipeline genérica de peticiones Los módulos extienden la funcionalidad del servidor a través de una API pública. … …
- 16. NET global settings ASP.NET global settings Global settings and location tags .NET Framework Global web.config machine.config IIS 7 applicationHost.config Site Root web.config <system.web> .NET settings .. .. .. <system.webServer> IIS 7 Delegated settings ..
- 24. INETINFO.exe metabase ftp, smtp, nntp User mode Kernel mode HTTP.SYS W3SVC SVCHOST.exe W3 Config Mgr W3 Process Mgr W3Core W3WP.exe #1 Application Pool ID: Network Service W3Core W3WP.exe #2 Application Pool ID: Network Service W3Core W3WP.exe #3 Application Pool ID: Network Service ASP.net Apps .Net App Domain .Net App Domain .Net App Domain ASP.net Apps .Net App Domain .Net App Domain .Net App Domain ASP.net Apps .Net App Domain .Net App Domain .Net App Domain
- 25. #2.config #1.config #3.config IISADMIN metabase ftp, smtp, nntp User mode Kernel mode HTTP.SYS WAS IISCore W3WP.exe #1 Application Pool ID: SidforPool3 IISCore W3WP.exe #2 Application Pool ID: SIDforPool2 IISCore W3WP.exe #3 Application Pool ID: SIDforPool3 ASP.net Apps .Net App Domain .Net App Domain .Net App Domain ASP.net Apps .Net App Domain .Net App Domain .Net App Domain ASP.net Apps .Net App Domain .Net App Domain .Net App Domain modules modules modules Los Application Pools solamente pueden leer su configuración
- 27. SID Injection AppPool: newPool username: newPoolUser password: <password> LogonUser AccessCheck OK AccessCheck Denied Worker Process (W3WP.EXE) Service Host (SVCHost.EXE) Windows Process Activation Service (WAS) World Wide Web Service (W3SVC) applicationhost.config Token Token NewPoolWwwrootdefault.htm ACL OtherpoolWwwrootdefault.htm ACL
- 47. © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
Notas del editor
- 06/03/09 10:43 © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.