iis 6 won"t serve mdb file

hi all,

I have written an asp.net 2.0 app that to allow users to
download files. It does this by presenting the user with
a url to the file, they click it and save the file to their
local drive.

When the user clicks on an assess file (*.mdb) they get
an error "This type of page is not served" (logged as 403 0)

I know II6 only severs files with a defined MIME type, but
mdb files are defined in the MIME list (by default, I did
not need to add it)

So there must be another mechanism that prevents download.

I am aware that allowing IIS to serve mdb files is considered
a security risk, but this site is password protected and
serving mdb files is one of the reasons it exists at all.

So I have two questions:

1) Why are mdb files blocked even though they are a defined
MIME type for the IIS server.

2) How do I allow mdb files to be served (if not via the
MIME type)?

thanks
kpg

Re: iis 6 won"t serve mdb file

The text string you give here is not coming from IIS. So there has to be a
configuration on your server preventing mdb files from being served. Could
it be that you have mapped the mdb extension to ASP.NET? It looks like that.

In that case, you need to edit your web.config file.



--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info


kpg wrote:

>hi all,
>
>I have written an asp.net 2.0 app that to allow users to
>download files. It does this by presenting the user with
>a url to the file, they click it and save the file to their
>local drive.
>
>When the user clicks on an assess file (*.mdb) they get
>an error "This type of page is not served" (logged as 403 0)
>
>I know II6 only severs files with a defined MIME type, but
>mdb files are defined in the MIME list (by default, I did
>not need to add it)
>
>So there must be another mechanism that prevents download.
>
>I am aware that allowing IIS to serve mdb files is considered
>a security risk, but this site is password protected and
>serving mdb files is one of the reasons it exists at all.
>
>So I have two questions:
>
>1) Why are mdb files blocked even though they are a defined
>MIME type for the IIS server.
>
>2) How do I allow mdb files to be served (if not via the
>MIME type)?
>
>thanks
>kpg

Re: iis 6 won"t serve mdb file

"Kristofer Gafvert" wrote in
news:xn0f3gvincpc9ej006@news.microsoft.com:

> The text string you give here is not coming from IIS. So there has to
> be a configuration on your server preventing mdb files from being
> served. Could it be that you have mapped the mdb extension to ASP.NET?
> It looks like that.
>
> In that case, you need to edit your web.config file.


OK. mdb files are mapped (by default) to asp.net. I found the
httpHandler
in the web.config file in the system .net configure folder, and it was
using the forbidden handler.

I made several faied attempts to edit the local web.config file to
remove
the httpHandler but then I got a page not found error.

So I ended up removing the mdb mapping for that web site, which has the
same effect as mapping it but then allowing access.

I suppose ideally I would like to use the section to only
allow
mdb files for a particular page - but like I said the edits I tried in
the
web.config file did not produce the desired results.

this:





seemed to remove the handler, but since the file was still mapped
I got a page not found error.


this:


type="System.Web.DefaultHttpHandler" validate="True" />


and this:



type="System.Web.DefaultHttpHandler" validate="True" />


had the same effect, which puzzles me somewhat.

Removing the mapping by clicking configure on the directory tab
of the web site properties worked - but I think the web.config
technique is slightly more desirable (if possible).

thanks
kpg

Re: iis 6 won"t serve mdb file

mdb files are not mapped to ASP.NET by default. At least not on any system
i have used. Why would you desire to use ASP.NET to serve the file? It
requires more resources on the server, and i can see no benefit at all
using this technique for serving static files.

I think you need to consult the ASP.NET newsgroup for ASP.NET specific
problems.

--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info


kpg wrote:

>"Kristofer Gafvert" wrote in
>news:xn0f3gvincpc9ej006@news.microsoft.com:
>
>>The text string you give here is not coming from IIS. So there has to
>>be a configuration on your server preventing mdb files from being
>>served. Could it be that you have mapped the mdb extension to ASP.NET?
>>It looks like that.
>>
>>In that case, you need to edit your web.config file.
>
>
>OK. mdb files are mapped (by default) to asp.net. I found the
>httpHandler
>in the web.config file in the system .net configure folder, and it was
>using the forbidden handler.
>
>I made several faied attempts to edit the local web.config file to
>remove
>the httpHandler but then I got a page not found error.
>
>So I ended up removing the mdb mapping for that web site, which has the
>same effect as mapping it but then allowing access.
>
>I suppose ideally I would like to use the section to only
>allow
>mdb files for a particular page - but like I said the edits I tried in
>the
>web.config file did not produce the desired results.
>
>this:
>
>
>
>
>
>seemed to remove the handler, but since the file was still mapped
>I got a page not found error.
>
>
>this:
>
>
> > type="System.Web.DefaultHttpHandler" validate="True" />
>
>
>and this:
>
>
>
> > type="System.Web.DefaultHttpHandler" validate="True" />
>
>
>had the same effect, which puzzles me somewhat.
>
>Removing the mapping by clicking configure on the directory tab
>of the web site properties worked - but I think the web.config
>technique is slightly more desirable (if possible).
>
>thanks
>kpg

Re: iis 6 won"t serve mdb file

"Kristofer Gafvert" wrote in
news:xn0f3h2rdcz8xbc009@news.microsoft.com:

> mdb files are not mapped to ASP.NET by default. At least not on any
> system i have used. Why would you desire to use ASP.NET to serve the
> file? It requires more resources on the server, and i can see no
> benefit at all using this technique for serving static files.
>
> I think you need to consult the ASP.NET newsgroup for ASP.NET specific
> problems.

hmmmm...perhaps we are using different terminology.

When I say .mdb files are mapped to asp.net, what I mean is that
from the IIS configuration snapin, right clicking on the web
site tree node, going to properties, select the Home directory
tab, click configure, select the Mappings tab, .mdb files are
handled by C:\windows\ms.net\fw\v2.0.50727\aspnet_iisapi.dll.

This is true for all machines I have asp.net 2.0 installed on.

The site in question is a generic file transfer site, used in lieu
of an ftp site, designed to allow my clients to upload and download
files to me. Sometimes the file will be an mdb file.

I use an asp.net app for this becuase my clients can use a web
browser but are often not technical enough to use an ftp site,
plus I use SSL and a custom login for security.

My dilemma stemmed from the fact that my users could not download
mdb files. By removing the "mapping" they can now download mdb files.

Indeed, mdb files were being handled by the httpforbidden handler
due to the mapping.

In any case you have guided me to the solution,

thanks again

won"t serve mdb file

You say you were guided to the solution. Could you share the solution? I am using a shared hosted server and the only option I have is to use a web.config. Everything I have searched on says to change the ISS settings but I do not have that option.

EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com

Solution

put a web.config in the directory or directory structure you want to allow the access database to download from.










The solution required that you first remove the system default and then add your own as aparentlly you can't just overwrite it (I tried). I had to figure out what the system default was since the remove has to match exactlly.

EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com

re: solution

Last post lost code due to open brackets make sure you put them back in

remove verb="*" path="*.mdb" />
add verb="GET,HEAD" path="*" type="System.Web.StaticFileHandler"/>

EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com

re solution

<configuration>

<system.web>

<httpHandlers>

<remove verb="*" path="*.mdb" />

<add verb="GET,HEAD" path="*" type="System.Web.StaticFileHandler"/>

</httpHandlers>

</system.web>

</configuration>

EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com