Limiting Access to Your Site
Commerce Server Site Packager does not affect Windows access control lists (ACLs). After you unpack a site, you should lock down some of the files and folders on your Commerce Server site by changing permissions on them. You can also limit access to files by setting Web server permissions. For more information, see How Web Server Permissions Are Set.
This topic describes how to use NTFS permissions to limit access to site files. When you limit access to the files and folders on your site, you should consider the following:
A Business Desk user must have access to the log file in the Profiles folder before saving changes to a profile definition. A business manager must also have access to the log file in the Profiles folder to be able to save any changes made in the Profile Designer module. The IIS Web server permissions have read access turned off by default when using the Commerce Server Solution Sites, but you can increase security by also denying read access on this folder's NTFS permissions.
If you use pipeline logging to debug a pipeline, be aware that sensitive information appears in clear text in the log files. Make sure you secure against read access the Pipelines\Logfiles folder, which contains these pipeline log files.
You should use IP address access restrictions to limit permissions on Bdrefresh.asp and RefreshApp.asp so that unauthorized users cannot run these scripts. By default, Bdrefresh.asp and Refreshapp.asp are set to anonymous access, which is required in order for Business Desk users to publish changes to the Web site. To secure these files, grant access to specific Business Desk users by using IP address access restrictions in Internet Information Services (IIS) 5.0. For instructions, see To set IP address access restrictions.
The Bdrefresh.asp script clears the Business Desk cache. The RefreshApp.asp script clears the Profiles cache. Clearing either of these caches repeatedly could lead to a denial of service for users. These files are located in the root folder of an unpacked Solution Site.
There are other similar files included with the Commerce Server Solution Sites. For information about other files to protect, see the Solution Sites Web site.
If, when you unpack a non-Business Desk application, you use an unpack.vbs script file that you created, make sure you delete or secure the file immediately after unpacking. The file exists in the root directory, and can be accessed by anonymous users. Unauthorized use of this script could lead to denial of service or the breaking of site settings. This file does need to be present, however, if you repackage the site.
In the Commerce Server Solution Sites, the unpack.vbs file is secured by default.
You can set file and folder permissions only on drives formatted to use NTFS.
To change permissions, you must be the system administrator or have been granted permission to do so by the system administrator.
Groups or users given Full Control for a folder can delete files and subfolders within that folder regardless of the permissions protecting the files and subfolders.
If the check boxes under Permissions are shaded, or if the Remove button is unavailable, then the file or folder has inherited permissions from the parent folder.
To set, view, change, or remove file and folder permissions
Click Start, point to Programs, point to Accessories, and then click Windows Explorer.
In the Windows Explorer window, navigate to the file or folder you want, right-click the file or folder, click Properties, and then click the Security tab.
On the Security tab, do one of the following:
To change permissions from an existing group or user, in the Name box, select the name of the group or user. In the Permissions box, select Allow or Deny for each permission you want to change.
To remove the group or user from the permissions list, in the Name box, select the group or user, and then click Remove.
To set up permissions for a new group or user, click Add. In the Select Users, Computers, or Groups dialog box, type the name of the group or user you want to set permissions for using the format domain_name**\**user_name, and then click OK.
To close the Properties dialog box, click OK.
To set IP address access restrictions
Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager.
In Internet Information Services, navigate to Bdrefresh.asp file.
Right-click Bdrefresh.asp, and then click Properties.
In the File Security tab, in the IP address and domain name restrictions section, click Edit.
In the IP Address and Domain Name Restrictions dialog box, click Add to add the computers you want to grant access to Bdresfresh.asp, click Denied Access, and then click OK.
Navigate to Refreshapp.asp, right-click Refreshapp.asp, and then click Properties.
Repeat steps 4 and 5 to secure Refreshapp.asp.