Currently, any IIS application has read and write access to RAWeb files because we grant read and write access to the IIS_IUSRS account. We grant write access because we need to modify the app settings in Web.config.

To improve security, we now:

1. Set up an application pool in IIS called "raweb" if it does not already exist. We do not replace it if it already exists, which makes it possible for administrators to change the identity of the raweb application pool to a custom account (e.g., if they need RAWeb to run as an account from a specific domain so that group memberships can be read by RAWeb).
2. Configure anaonymous authentication for RAWeb to operate as the raweb application pool identity instead of the default IUSR identity.
3. Remove access to the RAWeb folder from all users and groups except the SYSTEM and Administrators groups.
4. Assign read-only access to the RAWeb folder for "IIS AppPool\raweb".
5. Assign write and modify access to the RAWeb/App_Data folder for "IIS AppPool\raweb".

As part of this change, app settings from Web.config and the resources and multiuser-resources folders are now stored in the App_Data folder. Security permissions for resources are now preserved when upgrading or reinstalling RAWeb. The setup script handles the migration of the app settings and resources.

Resolves #97
Resolves #96

Install

Run as an administrator in PowerShell to install this branch:

iwr -UseBasicParsing install.raweb.app/preview/jackbuehner/restricted-permissions | iex

Checklist

Tested on:

• Server joined to a domain
• Server not joined to a domain

Tested scenarios:

• Resources folder migration
• Multiuser resources folder migration
• appSettings (policies) migration
• Permissions-based access to files in the resources folder (security tab in properties)
• Folder name-based access to files in the multiuser-resources folder
• Using a different identity for the application pool
• Editing policies from the web interface
• Webfeed via Windows RADC
• Webfeed via Windows App (Android)