DNN 9.1

Just trying to understand what this means and what the correct settings are. I run my DNN sites in their own app pools with what I thought were standard/required permissions. How do I change permissions to rectify this so my sites are locked down?

 

Thanks!

What is exactly is this CheckDiskAccess issue?

More detail please.

---

"if the only tool you have is a hammer you tend to see every problem as a nail" http://www.carawaydesign.com

The solution to this is to use a dedicated partition for your DNN instance. Then remove Users and Everyone from the root of that partition and set IIS Apppool identity to Modify permissions on the folder where your instance runs. That will make that warning go away. But there is more... there is a bug in the security analyzer https://github.com/DNNCommunity/Secur.... Timo and I ran several tests and it seems that even after implementing the above it does not secure everything. You must understand that a web server is not the place where you store confidential files at all. Bottom line is that even after extensive testing we (Timo and me) do not understand how it is still possible that with a specially crafted aspx page we were able to write files on almost any folder on that particular machine. Needless to say that the issue Timo and I found does not have anything to do with DNN. It is a .Net and IIS issue or maybe even a design issue in Windows Server. I don't know and I wish we could discuss this with some IIS, .net guru in a Skype meeting with all of us.

---

www.server-essentials.com is a community for IT Consultants and Business Owners who, themselves, take care of the IT infrastructure and Employees who do that little extra in the company to keep things running. Our forum is for discussing all things ‘IT’ and more. Our documentation is top notch and written by and for the community. Join now at https://www.server-essentials.com/secure-registration