Deploying projects in .net

[satishr23]

Hi ,
I am a beginner to .net and need some help in deploying a .net solution.
I had some questions(Some of them might be stupid and basic...:o ) regarding this
1) If I deploy my solution ,does the target machine have to have the .Net framework and IIS installed on it?
2) My solution has 2 projects-A console application and a web application.These 2 projects do some read/write operations on a common text file.So far I have been giving the physical path of that file in my projects.But now how do I change it for deployment? I thought of using Server.Mappath() but I guess I cant use it in colsole applications..
I would really appreciate any input
thnks

[PeOfEo]

1) For the web application you will need to be running IIS, but in either case you will always need the .net framework to run a .net application (Just like with java, you always need the JRE)

2) You can use server.mappath() for console applications, and it would be easiest to use if you make sure the console application resides in the same directory (or sub directory) as the web application, that way you will always know where it is, relative to your page.

[satishr23]

Hi Thanks for your reply,
So how do I do this? I mean my console application is a different project and therefore has a different folder of its own...Evn if add my console project to the solution containing the web app,it doesnt create a new shared folder or something..
Thanks a lot

[PeOfEo]

Well the server.mappath allows you to access files with their virtual locations. That just makes it easy if you publish projects to a virtual directory on some server. So say your projects are both in subdirectories of the wwwroot directory you can just say
server.mappath("/consoleapp/consoleapp.exe")
If you simply copy the executable over to the same directory as the web app then you can access it either way quite easily by just using the file's name.

[satishr23]

Hi,
Thanks for your reply.
I tried that(putting my console application's exe file within the folder of my web app in the inetpub/wwwroot directory.It worked... So now I can use Server.Mappath to handle the files..
But is it not a security issue? I mean is it safe placing a .exe file in the web directory so that any user can theoritically run the file?
thnks again

[PeOfEo]

You can independently set the permissions on the executable so that it is not served. The only thing that needs permissions to the executable is the ASPNET account. Alternatively you can just put the executable in another directory (maybe parallel to the application's) which doesn't have adequate permissions on it to be served. The only reason I say keep around the web application is so that it is easy to keep track of and get at, but that doesn't necessarily mean it gets served. What I like to do sometimes is keep files (usually xml I am using for light data and configuration) that the server needs but the client wont need in a child directory and not give any worker accounts (http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/3648346f-e4f5-474b-86c7-5a86e85fa1ff.mspx?mfr=true) permission to access it other than the ASPNET account

[satishr23]

hi,
thnks for ur replies again.
I disabled the 'read' properties of the console application's exe file using IIS.So that atleast it is not downloadable/visible using the browser.
Is this secure enough? Is there any other way I can make it more secure?
thnks

[PeOfEo]

Well, you could disable all permissions. The only reason you would probably want to do this is just in the event that someone can sneak an asp classic script onto your machine or something to try to run the process with that. But, if someone already has the ability to get a script onto your machine, then restricting access to this one executable isn't really going to save you. So essentially you have done all that you need to do, the user does not have the ability to get at that file. Other than maybe authenticating users that get into the web application that is making the calls (might not be necessary for what you are doing), you're pretty secure.

Another thing I talked about in another thread is identity impersonation. You can make asp.net, for a certain instance, or globally throughout an application, use another worker account. So, if you didn't want to give the ASPNET permissions to a given resource, you can give another machine account permission to that and then just have ASPNET impersonate that account right before it makes that call. However, this can be a bit more code, but it is something very practical, and if the security of your server is a major necessity then it is definitely worth looking into.

[satishr23]

cool...thanks a lot for all your help.I really appreciate this :)
u just saved me a lot of headache w.r.t to the deployment of my solution :D