在NT AUTHORITY \ NETWORK SERVICE下运行池是否安全？ [英] Is it safe to run a pool under NT AUTHORITY\NETWORK SERVICE?

问题描述

我通常会创建一个有限权限的用户并在其下运行该流程但是在2008年IIS7下自动创建的池使用此帐户的事实让我觉得这是非常安全的，并且可能比我创建的更安全吗？ Redmond的整个Secure By Default推送会让我相信这种情况。

I normally would create a limited rights user and run the process under that but the fact that pools automatically created under IIS7 in 2008 use this account makes me think that this is perfectly safe, and possibly more so than something I create? The whole Secure By Default push from Redmond would lead me to believe this is the case.

推荐答案

是的，这是安全的。 服务和服务帐户安全规划指南

Yes it is safe. Services and Service Accounts Security Planning Guide

还有一件事。使用本地服务帐户甚至更好（不要与本地系统帐户混淆！）。它在本地服务器上具有与网络服务相同的权限。但是没有网络权限。网络服务可以使用计算机帐户（如经过身份验证的用户）的权限访问网络资源。

One more thing. It is even better to use the local service account ( not to confuse with local System account! ). It has the same permission on the local server as network service. But does not have network permissions. The network service can access network resources with the permissions of the computer account ( like authenticated user ).

更新1 （回复评论）：

据我所知。这两个选项都有效。您的应用程序代码未在应用程序池标识下运行（默认情况下）。但是以对您的站点进行身份验证的用户的身份。或者，如果允许匿名用户，则使用iuser_computername帐户。应用程序池标识很重要的原因是，您可以通过代码，因此注入其代码的攻击者也可以将应用程序的标识更改为应用程序池标识。

As far as I understand. both option will work. Your application code is not running ( by default) under the application pool identity. But under the identity of the user that authenticate to your site. Or, if anonymous user are allowed, the iuser_computername account. The reason that the application pool identity is important, is that you can by code, so attacker that inject his code can too, to change the identity of your application to the application pool identity.

那就是说，还有更多的复杂功能无法发布。

That said, There are further complication that are too numerous to post.

这篇关于在NT AUTHORITY \ NETWORK SERVICE下运行池是否安全？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！