更改 Windows Server 2008 EventLog 安全设置是否危险
我有一个 ASP.NET 应用程序在带有 IIS 7 的 Windows Server 2008 机器上运行。该应用程序在带有 IIS 6 的 Windows Server 2003 上启动。
当我更改服务器时，我了解到 Microsoft 如何更改 IIS 7 的默认设置以使其更加安全。其中一项更改是，必须明确授予设置为应用程序池身份的用户帐户读取/写入事件日志的权限。
我的问题是，如果我授予本地帐户（在本例中为网络服务）仅对事件日志内的应用程序日志进行读/写的能力，我是否会产生安全责任？
我可以考虑其他方法来报告站点状况，但在 Windows Server 2003 时代，事件日志是一种很好的方法。
I have an ASP.NET application running on a Windows Server 2008 box with IIS 7. The application started on Windows Server 2003 with IIS 6.
When I changed servers I learned about how Microsoft changed the default settings for IIS 7 to be more secure. One of the changes was, the user account set as the identity for the Application Pool had to explicitly be given permission to read/write the Event Log.
My question is, if I give the local account (in this case NETWORK SERVICE) read/write ability on just the Application log inside of the event log, am I creating a security liability?
I can look at other methods for reporting on site conditions, but the Event Log was a nice way to do it back in the Windows Server 2003 days.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我个人不认为它有什么问题。事件日志是记录事物的完美场所。
如果可以选择授予对网络服务的应用程序日志的写访问权限，或者将 IIS 站点运行的本地帐户更改为更强大的用户（作为事件日志的固有权限），我认为授予对网络服务的访问权限将是更好的方法。
我们在 Web 应用程序中广泛使用事件日志，但为每个应用程序创建单独的日志名称。这使您可以保持事物整洁并授予非常特定的访问权限。
I personally don't see the problem with it. The Event Log is a perfect place to ... well.. log things.
Given the option to either grant write access on the Application log for NETWORK SERVICE, or change the local account your IIS site runs as to a more powerful user which as inherent rights to the event log, I would think granting access to NETWORK SERVICE would be a better approach.
We use the Event Log extensively in our web apps, but create a separate Log name for each application. This allows you to keep things tidy and grant very specific access.