Iis – How to Monitor IIS app pools and alert for any down time

Nagios with passive checks and then wrap your scheduled jobs to send a message (send_nsca)to your nagios server indicating what happened when they complete. If the job errors then nagios will alert.

More relevant to the problem you're seeing is that you can also set nagios to alert if it hasn't heard from your cron job for too long, so you can spot jobs that are failing silently.

All free and fairly trivial to set up.

Assigning the anonymous inet user "modify" rights the default temp folder isn't very wise. As such, it's not a security failure but you're making some classes of attack against your web infrastructure easier.

As always, the devil is in the details. As long as nothing but innocuous data is written to that folder, there is no specific risk: the folder itself isn't different from numerous other places on your system. Of course, if you want to setup rights for the IUSR_ on that folder, it also means you intend to use that assignment so that web application can write to it.

There comes the risks: - Having "execute" rights on that folder removes a security layer: if an attacker finds a way to upload an executable on the temporary folder and have the system run it, it will run. If you deny the "execute" right, it simply won't work. - The folder is right on top of the most sensitive part of your system: the location of the operating system files. It means that, should someone manage to use a directory traversal bug in a web app that exploits a temporary file, he'll be one step away from the system root and all the interesting things that sits in it.

None of these are really too risky in themselves but a good security relies on security in depth. In this case, I'm pretty sure you can have your PHP app use a different folder than the system's temporary directory to save its temporary files. Best would be to place that on a separate partition, in a folder where the IUSR_* have read/write access but NOT execute permission.