The following are the minimum NTFS permissions required for WebChart operating as the anonymous user.
If explicit user logins are permitted, then similar permissions should be granted for all users logging that will need to create and delete files.
From cacls:
BUILTIN\Administrators:(OI)(CI)F
<computername>\IUSR_<computername>:(OI)(CI)(special access:)
|
SYNCHRONIZE |
|
|
FILE_READ_DATA |
|
|
(allows writing of files) |
FILE_WRITE_DATA |
|
(allows directory creation) |
FILE_APPEND_DATA |
|
FILE_READ_EA |
|
|
FILE_EXECUTE |
|
|
FILE_READ_ATTRIBUTES |
<computername>\IWAM_<computername>:(OI)(CI)(special access:)
|
SYNCHRONIZE |
|
|
FILE_READ_DATA |
|
|
FILE_READ_EA |
|
|
FILE_EXECUTE |
|
|
(allows del of files & dirs) |
FILE_DELETE_CHILD |
|
FILE_READ_ATTRIBUTES |
For Windows 2003 Server using IIS 6.0, a third set of permissions are required for the OCTemp. These permissions are not necessary to generate chart or image files, but they are necessary for the automatic deletion of the temporary files.
NT AUTHORITY\SERVICE:(OI)(CI)(special access:)
|
SYNCHRONIZE |
|
|
FILE_READ_DATA |
|
|
(allows del of files & dirs) |
FILE_DELETE_CHILD |
IUSR_<computername>
IWAM_<computername>
