How do I limit editing of web pages?

[michko]

Okay, the person who handles our web site is currently on vacation. I know next to nothing about web hosting or how security is set up on a web site. Here's my problem: it appears that anyone can edit our web site. I can access the site page from any pc (using ie), click on File, and drop down to "edit with Microsoft Word". Click on this, it opens Word and downloads the web page. I can then edit the page, and save it back to the web server. I know this is NOT a good thing. The site is hosted on a pc running WinNT(4) with IIS. I looked through the various security settings, but since I don't know what is correct, I was unable to spot anything glaringly out of the ordinary. Could someone give me an idea of what settings may be changed to correct this problem? Or even links to more information regarding security setup in this situation.
thanks for your time and assistance.

 

[usalabs3]

I personally use win xp pro, using IIS 5.0 as the webserver.

I'm not to up on winnt4, but I would suggest to upgrade your computer to either win 2003 server (which has IIS6) or win xp pro, using NTFS.

The security on winxp pro or 2003 server is great, to prevent external editing of a website the security of the folder that contains the website, needs to be changed to only allow admin write, I don't know how to do that on winnt4.

 

[michko]

I'd love to upgrade this one and some other systems we have, but it's not going to happen within our current budget. Any other suggestions?

 

[spazman]

Use NTFS permissions and remove the Write permision for the group everyone, this will require that you use NTLM authentication.

 

[usalabs3]

This is what I suggest, basing the settings on winxp pro (winnt4 may have a similar procedure).

open 'my computer' then open the drive that has the website on it, then navigate to the folder that has the website, then right click on the folder, then select 'properties', then select the 'Security' tab, then place a check in the following 'allow' settings (unless otherwise specified):-

NOTE......You must have admin rights to change these settings)


Administrators..................full control
creator owner...................uncheck all the boxes
[computer name] admins..........List folder contents
[computer name] authors.........List folder contents
[computer name] browsers........List folder contents
SYSTEM..........................Full Control
[user account]..................Modify/Read&Execute/List Folder Contents/Read/Write
Users...........................Read&Execute/List Folder Contents/Read
Web Anonymous...................[deny] Write
Web Applications................[deny] Write

But remember YOU MUST HAVE ADMIN RIGHTS TO CHANGE THESE SETTINGS, and all accounts on the computer must be passworded.

 

[ChrisHirst]

usalabs3, While using NTFS permissions can protect the files from editing on a workstation or on a shared folder, anyone who can log-on to a NT based server will be an administrator or part of an administrative group as the default access permissions do not allow console logon otherwise.

Chris.

Indifference will be the downfall of mankind, but who cares?

http://www.candsdesign.co.uk

A website that proves the cobblers kids adage.

http://www.cram-system.com

Nightclub counting systems

So long, and thanks for all the fish.

 

[ryandoah]

Question:
Where is it asking you to save the editable file?

Chances are it's only to your local machine, and not actually allowing changes to be made to the hosted version on the server. Also, in the editing program, you should still only able to view the HTML source code, not including any asp(scripting), well plus all the junk code that MS Word will auto-add to the code. This is normal, to be able to view the source code, and edit it, but you should not be allowed to save any edited version back to the server. It is possible to block these viewing options, though I forget how, off hand. Unless you don't want people to view the source code, which usually isn't a big deal, you should be ok the way you are. Check to make sure it's only trying to save the page to the local machine(like in My Docs, etc.), if so, you should be ok.

ryandoah

 

[michko]

Thanks everyone for all the help and suggestions. Usalabs3, you got it, permissions on the folder containing the web site were set to full control for Everyone. I changed permissions iaw your post and everything is back to normal. Thanks again!