Asp.net CMD security problem

Question

I am having trouble with permissions on Windows 2008 server. i have a command line utility that I need to run to convert some standard files to CSV files. That are in turn used to import data to my SQL database. I am able to get the done to work fine on my 2003 server but my windows 2008 server is not allowing the code to run. Below is a watered down version of the code. Basically in this example I am just trying to run a simple command. But I keep getting the output access denied. How do I correct this?

public partial class _Bank : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{

}


protected void btn_Click(object sender, EventArgs e)
{

    ProcessStartInfo processStartInfo = new ProcessStartInfo("cmd.exe");
    processStartInfo.RedirectStandardInput = true;
    processStartInfo.RedirectStandardOutput = true;
    processStartInfo.UseShellExecute = false;
    processStartInfo.RedirectStandardError = true;  

    Process process = Process.Start(processStartInfo);

    if (process != null)
    {

       process.StandardInput.WriteLine("dir");

       process.StandardInput.Close();
       string outputString = process.StandardOutput.ReadToEnd();
       Response.Write(outputString);

       string error = process.StandardError.ReadToEnd();
       Response.Write(error);

    }

}
private string ProcessRunner()
{
    ProcessStartInfo processStartInfo = new ProcessStartInfo("cmd.exe");
    processStartInfo.RedirectStandardInput = true;
    processStartInfo.RedirectStandardOutput = true;
    processStartInfo.UseShellExecute = false;

    Process process = Process.Start(processStartInfo);

    if (process != null)
    {

        //process.StandardInput.WriteLine("This is a test line");
        process.StandardInput.WriteLine("c:\\");
        process.StandardInput.WriteLine("This is a test line");

        process.StandardInput.Close(); // line added to stop process from hanging on     ReadToEnd()

        string outputString = process.StandardOutput.ReadToEnd();
        Response.Write(outputString);
        return outputString;

    }

    return string.Empty;
}

public static int ExecuteCommand(string Command, int Timeout)
{
    int ExitCode;
    ProcessStartInfo ProcessInfo;
    Process Process;

    ProcessInfo = new ProcessStartInfo("cmd.exe", "/C " + Command);
    ProcessInfo.CreateNoWindow = true;
    ProcessInfo.UseShellExecute = false;
    Process = Process.Start(ProcessInfo);
    Process.WaitForExit(Timeout);
    ExitCode = Process.ExitCode;
    Process.Close();

    return ExitCode;
}
}

why don't you use the `System.IO` classes? – Daniel A. White Sep 19 '11 at 12:06 — Daniel A. White, Sep 19 '11 at 12:06

Yves M. · Accepted Answer · 2011-09-19T14:35:57.047

1

This is running within an asp.net application with an App-Pool. The App-Pool has an identity (LocalSystem, Network Service etc) this process is executed. Make sure that this user does have the necessary privileges on the folders you are planning to access.

IMHO: for security reasons starting another process within a web application is not best practice and should never be done on internet web applications.

EDIT: Usualy the user is named ASPNET or IWAM_[Servername] (IWAM_... Built-in account for Internet Information Services to start out of process applications). Just give access to the folder to that user.

edited Sep 19 '11 at 14:35

answered Sep 19 '11 at 12:09

Yves M.

3,330
14
12

Hi @Yves M. thank you for the comment. How do you actually do the above mentioned? Also, you say starting another process within a web application is not best practice. How would you then run a third party application to convert data via the command line? – Rup Sep 19 '11 at 13:32
Well I don't know your context. So in general it is considered bad practice. But there are some situations where it is the best solution thought... So the answer is the famous "it depends". Usualy I write a service that listens on a drop folder for files being dropped there. After droping a file the event is raised and I am doing my magic. In bigger environments we usually use an integration plattform to do file conversions. – Yves M. Sep 19 '11 at 14:33
See my answer at http://stackoverflow.com/questions/7334216/iis7-permissions-overview-applicationpoolidentity/7334485#7334485 regarding how to change file permissions to match the special application pool identity that is used by default in IIS 7+. – Jon Adams Sep 19 '11 at 14:42

Asp.net CMD security problem

1 Answers1