WebDAV on IIS6 - security problems

I have a probem with WebDAV on IIS6 (Windows Server 2003) not respecting
NTFS file permissions.

The shared web folder is configured on the web site to not allow anonymous
access, and to use integrated windows authentication.

Access from the client (Windows 2000) is using Add Network Place under My
Network Places in Windows Explorer.

Two issues:

1. Files created on the server (ie uploaded through WebDAV from a client)
are owned by the Administrators group, not by the user that logged in.

2. When connecting as a user that does not have browse access to a
subdirectory, repeated attempts in windows explorer of
- right-clicking the folder under web folders in the left pane
- choosing "explore" to create a new windows explorer window
eventually give me (2-3 attempts) an explorer window allowing full access to
ALL of the shared web folders and sub folders -- even write access to
folders which NO users (apart from Administrator) have access.

Steve
Wed Jul 23 19:07:36 CDT 2003

btw... if you use ftp (on IIS 6) to upload a file, it respects who you are
and saves the file as owned by the user who logged in, unlike WebDAV which
seems to save all files as owner: Administrators.

Also, another oddity, if you move stuff between directories using the IIS
implementation of WebDAV it does a copy/delete on the server, not a move,
which means it takes for ages if you are moving large files.

OK so it's better than having to download/delete/upload using FTP but to my
mind it's seriously flawed.


"Steve Bayliss" <Steve.Bayliss@nospam.zen.nospam.co.uk> wrote in message
news:3f1e60bd$0$248$fa0fcedb@lovejoy.zen.co.uk...
> I have a probem with WebDAV on IIS6 (Windows Server 2003) not respecting
> NTFS file permissions.
>
> The shared web folder is configured on the web site to not allow anonymous
> access, and to use integrated windows authentication.
>
> Access from the client (Windows 2000) is using Add Network Place under My
> Network Places in Windows Explorer.
>
> Two issues:
>
> 1. Files created on the server (ie uploaded through WebDAV from a client)
> are owned by the Administrators group, not by the user that logged in.
>
> 2. When connecting as a user that does not have browse access to a
> subdirectory, repeated attempts in windows explorer of
> - right-clicking the folder under web folders in the left pane
> - choosing "explore" to create a new windows explorer window
> eventually give me (2-3 attempts) an explorer window allowing full access
to
> ALL of the shared web folders and sub folders -- even write access to
> folders which NO users (apart from Administrator) have access.
>
>