SecurityException in ASP.net application - asp.net

I have a web app which queries a Lucene index and it works just fine in a W2K3 server in my network. Now I got my azure code so I wanted to test the service uploading the app. In order to do that I had to install Vista (I did it in a Virtual machine) cause the Azure SDK won't install on an XP box.
I created my Cloud Service, added the files from my app but when I run it (just F5) I get a SecurityException, when I call Lucene to query the index, saying:
The application attempted to perform
an operation not allowed by the
security policy. To grant this
application the required permission
please contact your system
administrator or change the
application's trust level in the
configuration file.
I've been googling around and the solutions I've found concern modifying the machine.config file which is something I won't be able to do "in the cloud".
Could anybody help on this?

Ok, in case somebody is facing the same issues, this is the correct answer which I got from the Azure forum:
This is because of the trust policy
for the Windows Azure CTP. The
enviroment variablies TEMP and TMP are
avaliable and set up appropiately.
However, System.IO.Path.GetTempPath
and System.IO.GetTempFile do not work
as they require unrestricted
environment permissions. I would
suggest you contact the Lucene
developers to see if they can modify
the code so it runs properly in medium
trust environments.
Thanks to Daniel C. Wang for the answer.

I also found a question regarding my same issue and how if was fixed.
Here the link: Lucene.Net fails at my host because it calls GetTempPath(). What’s the work around?

You can change trust in the web.config, unless that has been disallowed in the machine.config (which it often is in shared hosting). inside your put and see what happens.
If you are not allowed to do that, see if you can get your control GACd by talking to your provider. If that doesn't work, sorry to say but you are out of luck. Sometimes you can find workarounds that don't require full trust for a specific method, but if a third party dll requires it there is not much you can do

Haven't done this but isn't it possible to have a desktop version of the Live Operating Environment? This would seem a good start for troubleshooting.

Related

protect my code from plagiarizing when deploying symfony2

I'm working with Symfony2.3.4 and PHP 5.6.3.
I'm going to deploy a project I just finished and I need to do it "by hand", it means copying the project source code manually onto the production server in a company because I can't use any tool for it or anything of the like.
I've never done this before and for what I've googled so far it's hell. But what worries me the most is the matter of protecting my code once it's in the server, i.e.: no one sniffing around, editing, copying, plagiarizing it, etc.
I don't know if I'm making any sense or if this is an obvious question, I really really have zero experience deploying web apps so be gentle.
Anyone who has administrative access to the server can read and copy your code, including of course the server administrators (i.e. the hosting provider staff).
Of course any hosting provider in the world can do that and AFAIK it's never been a problem, because they usually are professional and don't do it.
The only solution I can think of is to setup a VPS where you have the only SSH access, but of course that means you have to setup the whole web server yourself... and that's even more complicated than simply deploying your code.
To answer your question, and if you really (really!) want that, you can checkout this SO question: Is there a code obfuscator for PHP?
But you shouldn't do that! As said, don't be scared by hosting providers, or setup your own server. :)

How to enable User to surf during ASP.NET DLL upload

I am using ASP.NET as the backend for windows phone browser. Sometime I need to make changes on the ASP.NET Pages WHILE users are surfing the website. I want to know how can I provide un-interrupted service to user in such a way they can surf during ASP.NET DLL uploading process:
Assume
say, there are a few ASP.NET (DLL) in production WebServer in such a way that all aspx pages in the one Folder and all DLL(s) in bin-folder.
page(1).aspx , page(1.2).aspx , page(1.n).aspx from DLL(1) and page(2.1).aspx, page(2.2) from DLL(2)
default.aspx from DLL(1)
Question
What will happen if I upload the updated DLL(2) to the production server and leave DLL(1) as it is :
Can user call the deafult.aspx?
Will user still be able to call aspx pages from DLL(1) during the uploading process?
I am a big fan of Martin Fowler's Blue Green Deployment methodology (link).
The idea is simple, have two very similar environments setup (staging & production). You make changes to your code, deploy it on staging, do your testing and then swap staging with production via a simple router configuration.
It has worked great for us so far.
The answer to both the questions is YES
You need Microsoft Web Deployment Tool. Please find more details on below link
How to deploy an ASP.NET Application with zero downtime
Are you hosting within a clustered server environment? If your not, I would be more concerned about a single point of failure rather than interrupting clients briefly during a release.
That said, the update process in such an environment is much better if your fearful of disturbing your users.

MVC2 Model callout to powershell

Recently created a MVC2 Portal but now I want to add a couple of models that call out to other processes such as powershell in order to run some tasks for the user and return the results.
All the examples I've found show the MVC model binding to SQL so the question is can MVC be used for what I'm asking of it and if so does anyone know of some examples that I can look at etc.
Any suggestions or comments are appreciated.
Closed due to lack of response, will look at doing a custom model which talks to powershell runspace.
All things are possible, but I suspect the issue you're going to have is that of security and the user account that you're running your website under.
Generally, the AppPool that an IIS website runs under is set up to run as Network Service or as some other account that has limited access to the file system. That service generally doesn't have it's profile (Desktop) loaded either.
You can certainly run the AppPool as a local account, and can load that user's profile (these settings are found in IIS manager) but by doing that you need to understand the security implications.
Having given you this "health warning" one example of hosting powershell in ASP.NET can be found here...
http://www.leastprivilege.com/HostingPowerShellInASPNET.aspx
... and another slightly longer one here...
Link

How to find issue on remote server that you don't have access to?

Ok, so this is my dilemma... I have an ASP.NET MVC site that is running into some conditions that it is pegging the processor on the iss boxes it's running on. I don't have access to these servers (it's a farm of about 5 iis6 boxes behind a netscalar). I am doing some logging to a sql database, but the problem is that when the cpu pegs my database starts timing out. The iis servers are hosted in house, but I can't get access to them.
And to make things ever more complicated, I can't reproduce any of these issues in my qa environment (which I don't have access to either). QA is setup to similarly to our prod environment, but it runs on a single box that isn't behind a netscalar.
So, any thoughts on the best way to try to track down where my issues lie? Thanks!
Since you are already logging to a database, why you don't log to another database, install this DB on another computer, so that when your MVC application starts killing the CPU the database won't be affected (since it is working on another computer).
or you could log to an FTP folder that you can access.
Hope I helped.
Regards.
ASP.NET Trace. Haven't used MVC, but I'm assuming it still works...
http://msdn.microsoft.com/en-us/library/y13fw6we%28VS.71%29.aspx
If you want to know what is going on with the system you could read from the event viewer programatically:
http://support.microsoft.com/kb/815314
This should help you to learn what is going on with the system. This way you can build a web interface for it and capture any info you may want to look at for what is going.

Top 10 gotchas using shared hosting with ASP.NET

I have recently started using a shared-host for my clients so see project progress or to play with a new technology for myself. I seems like every time I deploy a new project that runs fine locally, I run into something new on the shared-host.
Do you have a shared hosting deployment checklist?
What are the common problems you run into when deploying to a shared host?
Medium Trust. If you are developing code to go into a shared host, you should set your local application to run in medium trust otherwise you can almost guarantee you'll get security issues with code that executes fine in full trust but dies in a medium trust environment.
This MSDN article explains about medium trust in more detail:
http://msdn.microsoft.com/en-us/library/ms998341.aspx
They don't always offer you direct access to the database (Enterprise Manager / Management Studio).
You end up using some weird web GUI for creating database entities, which does not accept otherwise valid SQL syntax and you have to update all your queries and stored procedures to accommodate their custom changes and restrictions.
One of mine is file IO permission problems. An example being writing to a file on the web server from ASP.NET. You have to use a provided online tool to allow permission to do more than reads.
No preview site.
That is, a host based path to your web application without actually pointing the DNS to it.
Example:
http://www234.your-shared-host.com/preview/user/bla/default.aspx (don't try it, it's just an example..)
Inconvenient cancellation procedure
In some of the shared hosts I used, I found out that for cancellation I must make a phone call. Nothing over the web, not even an email.
I bet the host thinks most people won't bother calling until it's really needed. They're right.

Resources