Administering an ISP Installation

Restricting Content

You might need to restrict access to some of your Web sites, or to portions of them. For example, you might want to restrict most of a site’s content to members only, while allowing the general public to see just a generic page containing a submission form in order to join the site. You can restrict a site’s content in several ways:

• Disclose the site’s URL only to those people who should have access to the site’s content.

  Because this method is not completely reliable, use it only for sites that contain nonsensitive information.

• Require members to log on, by assigning each user a logon account. Create a user group for those users who are members and restrict the site’s content to this particular group.

  You can also restrict content of a site simply by setting a DACL that denies access to the anonymous user, but that allows access to authenticated users.

• Set a password page that will be verified by an ASP program.

  You can set a single password for all users or you can attach it to a database. This method, however, will prevent you from setting Windows DACLs. As a result, someone knowing a URL could bypass the password (except for the ASP content, which can check within each script). For more information, see Security in this book.

• Require Secure Sockets Layer (SSL) with client certificates either for logon or for comparison to a database, using a script in an ASP page.
• Create your own Internet Server Application Programming Interface (ISAPI) authentication filter.

  Creating your own ISAPI authentication filter becomes more complex if you need to restrict different areas of the site to different groups of people. You can set this configuration up through an ISAPI script or a script in ASP pages, or you can create Windows accounts. For information about setting up an ISAPI filter, see the “Installing ISAPI Filters” topic in the IIS 5.0 online product documentation.

• Set DACLs on individual files within the site in order to further restrict the content to specific users or groups.

© 1997-1999 Microsoft Corporation. All rights reserved.