添加“网络服务”管理员组帐户
我的网络应用程序在Windows Server 2003下的IIS 6.0中运行，我们都知道在这种情况下，IIS使用用户帐户“网络服务”。
我碰巧必须允许某些用户在我的网页上执行某些操作，并且该操作需要管理员权限。
对我来说最懒的解决方案似乎是将“网络服务”添加到管理员组，并且它确实有效。
我的问题是，这个解决方案有多危险，它会以什么方式危害我的网络服务器的安全？
My web-app runs in IIS 6.0 under windows server 2003, and we all know that in this situation, user account "Network Service" is used by IIS.
I happen to have to allow certain user to perform some action on my web page, and that action requires administrator privilege.
The laziest solution to me seems to add "Network Service" to Administrators Group, and it actually works.
MY QUESTION is, how DANGEROUS this solution is, and in what way can it compromise the security of my web server?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这通常是“一个坏主意”。如果这是一个面向公众的服务器，那么这是一个非常糟糕的主意。
您应该做的就是将您需要在另一个进程（例如具有提升权限的 Windows 服务）中执行的特定管理任务沙箱化，这就是我们解决此类问题的方法。
然后，我们在 Windows 服务中托管一个远程服务器，并通过命名管道或 TCP/IP 与该服务进行通信（如果是机器对机器，并且是通过后端专用网络）。
有关更多信息，请参阅我为其他用户留下的有关类似问题的答案：
更好的方法是永远不要在 Web 应用程序和 Windows 服务之间进行直接通信，而是通过作业或消息队列等中介进行通信。您的低特权应用程序发出执行管理任务的请求，您的高特权服务从队列中读取这些任务并执行它们。
在这两种情况下，您都应该确保不会超出每项任务的职责范围。即确保如果任务是在服务器上创建新的 Windows 帐户，则不允许该新帐户获得超出其需要的权限。
This is generally "a bad idea". If this is a public facing server then this is a really bad idea.
What you should do, and this is how we approach problems such as this, is sandbox the specific admin tasks you need to carry out in another process such as a Windows service which has elevated rights.
We then host a Remoting Server in the Windows Service and communicate with the service either over a named pipe or TCP/IP (if machine to machine and this is over a back end private network).
For more information, please see this answer which I left for another user regarding a similar problem:
An even better approach would be to never have direct communication between the web application and the windows service, but go through an intermediary such as a job or message queue. Your low privileged application places request for the admin task to be carried out, your elevated privileged service reads these tasks from the queue and carries them out.
In both cases you should ensure that you don't overscope the responsibility of each task. i.e. ensure that if the task is to create a new Windows account on the server then don't allow that new account to gain more rights than it needs.
如果我要编写一些需要框级管理的 Web 功能，我会使其在自己的应用程序池中成为自己的应用程序，尽可能紧密地锁定该应用程序，为该应用程序池提供一个命名帐户（域资源，如果在 Active Directory 上），然后授予该帐户对该框的管理员权限。将其保留在自己的应用程序池中可以有效地将其与常规应用程序锁定。
NT Authority/Network Service 与您计算机上的大量内容进行交互。我想不出任何充分的理由来获得网络服务管理员权限。
If I were to write some web function that required box-level admin, I would make that it's own application in its own app pool, lock down that application as tightly as I could, give that app pool a named account (a domain resource, if on an Active Directory), and then give that account admin privileges on the box. Keeping it in its own app pool effectively locks it down from your regular application.
NT Authority/Network Service interacts with a ton of stuff on your machine. I cannot come up with any good reason to get Network Service admin privileges.
在任何情况下都不要这样做。
如果您将网络服务添加到管理员组，则所有访问您的 Web 应用程序的匿名用户都将默认成为管理员，并且潜在的损害是巨大的。
根据你的问题
没关系 - 在该网页上使用 Windows 身份验证并使用户成为普通的 Windows 管理员。现在，他们和所有其他管理员可以执行您设置的任务。
Under no circumstances do this.
If you add Network Service to admin group, then all anonymous users accessing your Web app will be admins by default and the damage potential is massive.
Per your question
that's fine - use Windows authentication on that web page and make the user a normal Windows admin. Now they, and all other admins, can perform the tasks you have set up.