Hello, There's another glitch when you have a password protected webdirectory with IIS5 and sendin the http://www.iisServer.blah/blah.ida When the root folder on that website is password protected you do not get asked to authenticate but you just recieve the error like other postings. Ditto with guessing content of that folder the server would not ask for the auth but just report a missing .ida file with full path of the local file. IIS should ask for the password before giving out anything else. Kevin Matthew <kevinmat_private> Windsor Information Network Company Limited (WINCOM) 4325 County Road 42, Unit 10 Windsor, Ontario N8A 6J3 ____________________________________________________ Phone: 519.972.1007 Fax: 519.972.7009 On Tue, 18 Jan 2000, Brock Tellier wrote: > BTW, different error messages are given depending on whether or not the path > up to the idq file exists. In my brief testing: > > http://www.example.com/exists/bah.ida > yields > The IDQ file C:\Inetpub\wwwroot\exists\bah.ida could not be found. > > > http://www.example.com/doesntexist/bah.ida > yields > File C:\Inetpub\wwwroot\doesntexist\bah.ida. The system cannot find the path > specified. > > Brock Tellier > UNIX Systems Administrator > Chicago, IL, USA > btellierat_private > > Frank Knobbe at Home <FKnobbeat_private> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > > -----Original Message----- > > > From: Chris Tobkin [mailto:tobkinat_private] > > > Sent: Wednesday, January 12, 2000 2:08 PM > > > > > > > The same problem still exists on IIS4 (tested with SP5 - > > > didn't try on > > > > SP6). > > > > > > Still exists as far back as IIS3 also. (SP6a) > > > > Can't reproduce the problem with IIS3 and SP6. > > > > BTW: I'm running IIS3 on several servers without problems. I did not > > want to upgrade to IIS4 due to the complexity of its internal > > processes (and all those exploits that followed). My main complaint > > is still that I do not want to run IIS under the system account as > > IIS4 requires. > > > > Anyway, a time will come when we need to upgrade to W2K and IIS5. > > Does anyone have a comparison or analysis of IIS5 in respect to > > security (data channels, posting acceptors, etc)? > > > > Regards, > > Frank > > > > > > -----BEGIN PGP SIGNATURE----- > > Version: PGP Personal Privacy 6.5.1 > > Comment: PGP or S/MIME (X.509) encrypted email preferred. > > > > iQA/AwUBOIFcCURKym0LjhFcEQI+XwCeM4vv5ILglddvWw1LIWYBNOPifSEAoJ7z > > /+V1C97k2f+QTjNw9YGgmA90 > > =qq7D > > -----END PGP SIGNATURE----- > > > ____________________________________________________________________ > Get free email and a permanent address at http://www.netaddress.com/?N=1 >
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:29:12 PDT