Password Protect a directory using IIS 7 Digest Authentication

Question

This may just be my misunderstanding of the subject, but I would hope to find a simple answer.

I run a web server for my own use, among many reasons just so I have a domain name to reference my network at home.

I just deployed Sever 2008 Enterprise thanks to acquiring a MS charity license. It's so much better than the IIS 5 on XP setup I had before.

I'm still toying around with AD groups and users, but right now I just want to password protect a couple of folders on the web side of this box.

Say I go to domain.com, no problem. I want public access there, and it works just fine. But if I go to domain.com/private, I want that to come up with a user/pass box. I achieved this before by using a cheap program called IISPassword that used .htaccess/.htpasswd files.

While reading up on the capabilities of IIS7, I became interested in Digest Authentication. Knowing that basic auth would transmit passwords in clear text, I decided this would be a far superior option.

I've set permissions on the /private folder to disable all other methods ( anon, basic ), and only enable Digest in IIS MMC. I have not modified the folder permissions on an NTFS level ( just domain groups, IUSR has no entry ). All I get in response when viewing the page is an error 500.

I'll admit I'm still new to this level of administration, and would very much appreciate any help I can get to enable this level of protection. I'd be fine using AD authentication, but I think I'm still stuck at 'why do I get a 500 instead of a credentials prompt'

Thanks! Jon

Answer 1

Hi Jon.

I don't have a 100% answer for you, but I asked this same question. It sounds like it's been removed from IIS7 under INTEGRATED mode.

Please read the answers in that post. It might help you :)

Answer 2

Thank you for your input!

When I migrated everything over, I moved my error pages over as well. After testing this through localhost, I found out that it wasn't allowing an absolute path... Long story short I changed how it was searching for 404 and 401 error pages, and it now doesn't 500 on me. The problem remains that it won't prompt for a password unless I'm testing it on the machine from localhost. Any other machine just throws the 401.htm page immediately.

Answer 3

Well you're likely gonna get a lot of this as anyone who has to implement secure access of one sort or another will have had enough attacks that implementing any real crypto will be at the least difficult and require significant work. ( not that you aren't )

I'm going to hazard a guess that if you are MS charity license it sorta depends on what valuable property you have to protect - transmitting the result of a strong message digest is the same as transmitting the 'pw' in the clear, what Message Digest is used for is you store the Message Digest somewhere server-side, that way if Hairy Gorilla, the Muck Monster sends the evil twin in for a stroll through your system, the passwords cannot be recovered from the Message Digest.

Even if the entire disk is lost, per standard pro-forma failure scenario at several places ( rather than attract attention, let me just tell you this is the nightmare scenario ) then no rash of fraud detectors go off at Big Time Finance World Corp,.... possibly a few here and there but no wave or rash of events.

Keep the funds in the bank, read Sarbanes-Oxley Act of 2002, use small-shop security model, and don't try to deal with Twisted Sister, leave that for someone else. Basic Authentication sends in the clear, it's not packet sniffers you should be worried about - if it is then recent breaks at Heartland tell the tale that only hardware encipherment / decipherment have any use in hostile userlands, a short distance from Alice in Wonderland.

Most of the things that are valued now would get us a beating when I came up, today you get an award for it.

Read Wenbo Mao's preface.

Message edit: can you tell where 7c6a180b36896a0a8c02787eeafb0e4c came from? Neither can Twisted Twin ( ! )

Message edit:

RFC 2617 - HTTP Authentication: Basic and Digest Access Authentication

RFC 3540 - Robust Explicit Congestion Notification (ECN) Signaling with Nonces

RFC 4418 - UMAC: Message Authentication Code using Universal Hashing

Whatever you do, use established tools.