Hello,

Unfortunately we are far behind on the documentation at this point (it's a large project and a team that works on support/ dev/ etc in their free time there's always plenty to do and little time to do it in).

For web and FTP however it's pretty straight forward.

For IIS FTP

1. Assign an ip in IPAddresses to the server(s) in question.
2. Add FTP service, select the IP, set the DNS record if you want SolidCP to manage your dns servers
3. Apply (this will create the FTP site with the correct settings for you).

For Web: 

1. Web Sites Shared IP Address : I leave this to All Unassigned (this is the * binding in IIS which is most compatible with SNI certificates).
2. Web Sites Public Shared IP: Put in it's actual public ip here, it is not used in configuration but more displayed for the customers incase they need to set dns etc. (it is a mandatory field).
3. ASP.NET Mode (2.0/4.0): i always put 64bit
4. IIS 8 and above have an SNI checkbox, i would highly recommend selecting this.
5. I personally never use Web Publishing due to permission based problems caused within VS it self so i don't touch it.
6. for DNS Records add one: [host_name] with value [ip] for all other records i would use value [ip] (which uses the value entered above in shared public ip).

Policies:

1. Go to serveradmin home --> bottom right "policies"
2. Open up Web Policy
3. Select the Dedicated application pool, uncheck any auth besides anon auth.

Now make sure when you do this the dedicated application pool should always be enabled in the Hosting plan section.

Segregation:

1. Add full trust to domain admins or if it's a non-domain server: administrators to the hostingspaces along with the group as mentioned above.
2. Make sure Websitepanel Server pool user is member of Administrators and/or Domain Admins
3. Make sure your logged in as Administrator Take ownership of HostingSpaces:
   takeown /f C:HostingSpaces /r /d y /a
4. Disable inheritance on HostingSpaces --> make sure only administrators (and Filezilla if applies) remain, remove system etc.
5. Remove users from C
6. Add the following 2 users to C
   Local ServiceNetwork Service
   With Read & Execute, List folder contents and Read
7. Add the "Administrators File Access" access group to have full control on C:

##############################################

Deny IIS_IUSRS From System32 and syswow64
########################################
First of all make sure ALL _web users are a member of the IIS_IUSRS group.

If their not please make sure you add them all to that group.

Take ownsership:
takeown /a /F c:windowssystem32*.exetakeown /a /F c:windowssyswow64*.exe

Revoke permissions for IIS_IUSRS:
cacls c:windowssystem32*.exe /E /D IIS_IUSRScacls c:windowssyswow64*.exe /E /D IIS_IUSRS

Thats about it when it comes to segregation.

We have made an automated deploy script a while back which does take care of most of those steps for you which can be used here:

http://installer.solidcp.com/Files/stable/Tools/SolidCP-Configuration-Tool.zip

Do note that the script is still part experimental but should get you what you need.

Hello Marco,

Many thanks for taking the time to put this together and posting it here!
I'll get to work with trying this out immediately, and if something should arise, I'll get back to you here.

Again, thank you!

Do we need to do something extra to stop the Anonymous (_web) user being able to browse the whole drive?

I notice that even though the _web user isn't added to the local "Users" group, it still is a part of it - or is that a misconfiguration my end? (for example, I create a folder with no permissions - using ASP I cannot browse to it. But if I add the "Users" permission, suddenly I can)

Using the standalone install out the box, any shared account is able to access all the session data of any PHP session too, just by browsing to the Windows temp folder.

Hello,

As per default windows every user is part of the Users group.

and Users group by default has read + execute on the whole disk(s).

You will always need to remove it as explained by my segregation step in the previous post.

This would be a security measurement every windows system admin should take on new servers.

Regards,

Marco