chapter 1 · including web servers (iis vs. apache), internet mail servers (exchange vs. sendmail),...

CHAPTER 1

Introducing IIS 6

3

OsbNetw / IIS 6 Administration / Tulloch / 219485-5 / Chapter 1

P:\010Comp\OsbNetw\485-5\ch01.vpFriday, March 21, 2003 12:21:19 PM

Color profile: Generic CMYK printer profileComposite Default screen

4 I IS 6 Administrat ion


We’ll begin our overview of IIS 6 by examining the many new features andenhancements Microsoft has included in the latest version of their popularweb server platform. These enhancements were designed to increase the

security, reliability, scalability, performance, and manageability of the product, andthey range from fundamental changes in underlying architecture and operation tocosmetic improvements in the user interface for administration.

This chapter and the next (“IIS 6 Architecture”) will provide the backgroundnecessary for later chapters dealing with issues such as deployment, configuration,management, monitoring, maintenance, and troubleshooting IIS. Also included in thischapter is a brief history of the different versions of IIS and an overview of Microsoft’snew Windows Server 2003 operating system family (of which IIS is a component) andhow the different flavors of Windows Server 2003 relate to IIS.

THE IIS STORYThose of us who have been working in the IT field for a while may remember theabrupt about-face Microsoft made in 1995 with regard to the Internet. Realizing thatthey were about to be left behind by companies like Netscape, Microsoft suddenlyshifted gears from a position of “The Internet? Who cares?” to a policy of buildingInternet functionality into all of their products and giving this functionality away forfree. It was one of the smartest business moves in all history, and an incredibly fastmove for a company as large as Microsoft. To the popular mind, the centerpiece ofMicrosoft’s strategy was the Internet Explorer web browser, which Microsoft gaveaway for free and soon incorporated into their 16- and 32-bit Microsoft Windowsoperating system platforms. The result of this action was the infamous “Browser Wars”of the late 1990s, where Microsoft and Netscape furiously competed with each other byincorporating more and more features in their browser platforms as new versions cameout with breakneck speed. No one doubts now that Microsoft won the war, though atthe time some parties thought they did so unfairly, which resulted in a series of lawsuitsthat culminated in the famous legal battle between Microsoft and the U.S. Departmentof Justice during the Clinton era. Microsoft seems to have won that battle, though anumber of states decided that the Department of Justice let Microsoft off too lightly andare still pursuing legal action against the company at the time of writing this book.

While the battle between browsers may have captivated the public imagination, afar more earnest battle began taking place in IT shops during the same time period, andhas continued to this day. This is the battle for server supremacy, or: who will controlthe content on the Internet? Microsoft has been waging this war on several fronts,including web servers (IIS vs. Apache), Internet mail servers (Exchange vs. Sendmail),web application programming (Active Server Pages vs. Perl), and web portals (MSNvs. AOL). Any of these topics could form the basis of a whole book in itself, but it’sthe first of these, the battle for web server supremacy, that provides the underlyingexcitement for this new release of IIS. Will the new features and enhancements foundin version 6 finally make IIS the server of choice for enterprise environments? Can IIS



recover from its checkered reputation in earlier versions as a product full of securityholes? Has Linux built up enough momentum in the enterprise to convince IT decisionmakers to start switching from IIS back to Apache? And is version 6 of IIS secure andreliable enough to enable Microsoft to regain the trust of IT departments after its mistakesand oversights in earlier versions?

Exciting, isn’t it? Makes you want to learn all about IIS 6, doesn’t it? Well if it does,read on!

IIS RISINGVersion 6 of IIS is both the culmination of a long history of development for the productand an important new beginning from the standpoint of performance, reliability, andsecurity. It’s worthwhile to take a few moments to review the history of IIS and how ithas evolved over the last six years. That’s right, six versions of the product in six years,a new version each year. That’s a hectic pace for an upgrade cycle from the enterprisepoint of view, and in fact many industry pundits have taken Microsoft to task for this,saying things like, “Why couldn’t Microsoft have gotten it right in the first place?”and “Why release versions of the product that were inferior, lacked security, and hadperformance and scalability problems?” On the other hand, you can only admire acompany that turns itself completely around and hits the ground running.

Perhaps the corporate world has been the world’s biggest beta testing environmentfor IIS, and perhaps, as such, it has complained bitterly about holes and leaks beingdiscovered almost daily and about the steady stream of fixes and patches coming outof Redmond. But the corporate world has nevertheless embraced IIS with enthusiasm,as various statistics demonstrate:

• Netcraft (www.netcraft.com) has maintained statistics on websites connectedto the Internet since August 1995. While Apache continues to be the dominantplatform used with a 56.5 percent share of hosted sites as of February 2002,growth in market share for this platform has flattened out in the last two yearsand may even be starting to decrease. Meanwhile, after flattening for severalyears, market share for IIS has been increasing in the last year and stands at a30.25 percent market share at the time of this writing. The results of the Netcraftsurvey are well known in the Internet community (especially among Apacheenthusiasts!) but a lesser known fact is that Netcraft also conducts surveys ofweb server platforms used for secure e-commerce, and in this area IIS excels.For example, a January 2001 survey of over 100,000 web servers using SSLindicated that almost half (48.76 percent) of these sites ran on IIS, while only28.21 percent employed Apache and 6.79 percent used Netscape/iPlanet. TheNetcraft statistics, when considered overall, say clearly that while Apache isstill favored for simple web hosting purposes, IIS is popular for web applicationsand particularly for hosting e-commerce sites.


Chapter 1: Introducing IIS 6 5



• ENT Magazine (www.entmag.com) surveyed the sites of Fortune 500 companiesin July 2000 and found that IIS was the most popular platform used with a 41percent market share. Sun-Netscape Alliance’s iPlanet server came in secondwith a 35 percent share, while Apache came in third with only a 15 percentshare. Large companies like Compaq, Ford Motor Company, Phillip Morris,and many others use IIS exclusively as their web server platform, primarilybecause using IIS simplifies the process of developing large-scale webapplications.

HISTORY OF IISLet’s now take a closer look at how IIS evolved since its inception in 1995. This willhelp you understand the significance of some of the new features of IIS 6 and how thisversion can be considered a quantum leap forward from earlier versions. It’s also aninteresting story of how a large company develops a new product on-the-fly, and howadvances come in fits and starts.

IIS 1The initial version of IIS was released in February 1996 for the Microsoft Windows NT3.51 Server platform. Microsoft migrated their own microsoft.com site to IIS 1 for testingpurposes prior to commercially releasing the product. This is a little-known fact tomost people who complain about bugs and instabilities in Microsoft products and saythey feel like beta testers who have to pay for Microsoft software prior to testing it. Thereality is that Microsoft tests all new software they develop on their own in-house serversprior to releasing it commercially, and since microsoft.com is one of the largest sites inthe world, this means each version of IIS gets thorough in-house testing prior to shipping.In fact, many Microsoft employees end up working with release candidates of currentMicrosoft Windows platforms and Microsoft Office products prior to general productrelease, and thus end up being (sometimes unwillingly, I suspect) beta testers for newsoftware!

Anyway, IIS 1 included support for three popular Internet protocols: HypertextTransfer Protocol (HTTP) for delivering web content, File Transfer Protocol (FTP) forhosting FTP sites for uploading and downloading files, and Gopher (not an acronym)for hierarchical storage and retrieval of files. It also included support for the CommonGateway Interface (GCI), a UNIX programming environment for implementing dynamicfeatures like forms on web pages using scripting languages like Perl. Everything workedfine, but performance was less than stellar, despite Microsoft’s claim that it was thefastest web server around. Some of the features of IIS 1 included

• Internet Services Manager, a GUI tool for managing IIS (see Figure 1-1).

• Integration with the Windows NT platform (IIS was implemented as acollection of Windows NT services).





• Virtual servers, a method for hosting multiple websites on a single physical IISmachine. This feature was particularly useful for Internet Service Providers(ISPs) who needed to host thousands of sites for their clients, and it obviatedthe need of deploying a new physical server each time a new client wanted toset up a website.

• Virtual directories, a method for locating website content in a directory locatedoutside of the web root directory (\wwwroot) or on a network file server insteadof on the web server itself, which provides added security and flexibility topublish content easily.

• Internet Server API (ISAPI), an application programming interface that alloweddynamic web applications to be written using a high-level language like C++and incorporated into static HTML pages.

• Internet Database Connector (IDC), Microsoft’s first attempt at tying websitecontent to back-end databases running Microsoft SQL Server or some othercommercial database program like Oracle.

• Support for both Basic Authentication (an RFC-compliant authenticationscheme compatible with UNIX platforms) and Windows NT LAN Manager(NTLM) Challenge/Response Authentication for extra security in a corporateintranet environment.

• Support for Secure Sockets Layer (SSL) version 1 protocol for building securee-commerce sites.

• Text file and ODBC logging for troubleshooting problems and tracking traffic.

Not bad for a first try!



Figure 1-1. Internet Services Manager for IIS 1





IIS 2This release marked the inclusion of IIS as a component of the new Microsoft WindowsNT 4 Server platform, with its new services and enhanced Windows 95–like GUI. IIS 2added several new features including

• Integration of IIS into Windows NT Setup, allowing for IIS to be configured aspart of the default installation of a Windows NT system.

• Support for host header names in order to allow multiple websites to be hostedon a single server using only a single IP address and the default TCP port 80.This is great feature for ISPs and web hosting providers who want to host largenumbers of sites on a single machine—but unfortunately, in this early release,few could figure out how to use it!

• Support for both NCS- and CERN-style image maps.

• Enhanced logging features for logging both successful and failed HTTPtransactions. This feature was useful in troubleshooting browser/servercommunication problems.

• HTTP byte range, a feature that allowed its supported client (Internet Explorer,naturally) to recover from interruptions and resume download.

• Enhanced syntax for Internet Data Query (IDQ) and Hypertext Extension(HTX), which were early file formats used for connecting IIS to back-enddatabase engines to allow clients to issue queries against databases.

• HTML Administrator, an ISAPI application that supported administering IISfrom a standard web browser (like Internet Explorer) as an alternative to theInternet Services Manager application in Administrative Tools. Using HTMLAdministrator, you could manage an IIS server remotely over the Internetusing only a web browser. It was clunky, but it worked.

• Key Manager, a tool for generating key pairs for acquiring digital certificates toimplement the Secure Sockets Layer (SSL) protocol. For history’s sake, note thatSSL was actually developed by Netscape!

• Index Server, a tool for creating content indexes to allow users to performfull-text queries of web content hosted on IIS.

IIS 3Released in December 1996 (that’s the third version released in less than a year!),Microsoft quickly touted version 3 of IIS as “40 percent faster than IIS 1” based on testsconducted by Shiloh Consulting and Haynes & Co. using SGI’s WebStone performancetool. Other tests showed that it also outperformed Netscape’s FastTrack Server and





Novell’s NetWare Web Server, two other popular platforms used in enterpriseenvironments.

Perhaps the most significant development with version 3 was the release ofMicrosoft’s server-side web scripting engine called Active Server Pages (ASP). ASPenabled developers to build dynamic web applications that had all the functionality ofstandard client/server applications while using a standard web browser for its clientinterface. Together with Microsoft’s powerful new ActiveX component technology(developed in reaction to the rising popularity of Sun’s Java programming environment)and two new scripting languages, Visual Basic Scripting Edition (VBScript) and JScript,essentially a knock-off of Netscape’s JavaScript, ASP was quickly embraced by the largeMicrosoft developer community as the wave of the future with regard to applicationdevelopment. ASP also supported connectivity with databases using the Open DatabaseConnectivity (ODBC) standard and Microsoft’s new ActiveX Data Objects (ADO)technology. Because of the ease of developing ASP-enabled websites using VBScriptand ODBC compared with the difficulty of creating ISAPI applications using C++ andthe limitations of older Common Gateway Interface (CGI) technology, ASP became(and still is) the dominant development platform for writing dynamic web applicationsfor IIS.

Version 3 represented a quantum leap forward for IIS, from web server to webapplication development platform, and it was widely embraced by businesses for thispurpose. Netcraft’s statistics suggest that the popularity of IIS continued to rise afterversion 3 was released, while Apache began to plateau and other web servers declinedin use. Other enhancements to Microsoft’s web platform strategy that appeared inversion 3 included

• Microsoft Transaction Server (MTS), for providing the underlying “plumbing”for distributed web applications

• Microsoft Visual InterDev (part of Microsoft Visual Studio), for developingweb applications using Visual Basic, Visual J++, and Visual C++

• Microsoft NetShow, to provide streaming audio and video support for IIS

• Microsoft FrontPage 97 Server Extensions, to enable FrontPage to be used asa development tool for websites on IIS

Microsoft had gone from offering a bare-bones web server to a full web applicationdevelopment platform and associated tools in under a year. Not bad for a big company!Who says inertia is proportional to size?

At that time, Microsoft also expanded its line of Internet server products with therelease of the initial versions of Microsoft Site Server (now Content Management Server)and Merchant Server (now Commerce Server), both of its BackOffice line of serverproducts (now replaced by the newer .NET Enterprise Server family of products).However, these products are beyond the scope of this book.



IIS 4Microsoft soon improved on version 3 with the Windows NT 4 Option Pack, releasedin March 1998. The Option Pack provided a number of enhancements both to theunderlying Windows NT 4 Server operating system and to the IIS platform, including

• Version 4 of IIS itself

• Version 2 of Microsoft Transaction Server (MTS)

• Version 1 of Microsoft Message Queue Server (MSMQ), which provided theunderlying plumbing for asynchronous communications within distributedapplications on a network

• Version 2 of Index Server

• Version 1 of Microsoft Certificate Server, a tool for establishing a public keyinfrastructure (PKI) to support secure e-commerce

• Site Server Express 2, a tool for helping manage large amounts of web contenton IIS machines

• Microsoft Internet Explorer 4.01, which helped Microsoft finally win theBrowser Wars with Netscape

• Personal Web Server (PWS), a scaled-down version of IIS for the MicrosoftWindows 95 platform

• Service Pack 3 for Windows NT 4

• Microsoft Management Console (MMC) version 1, Microsoft’s first attempt atcreating a single unified interface for administering all aspects of their WindowsNT 4 Server platform (and later the basic administration interface for Windows2000, Windows XP, and Windows .NET Server family)

IIS 4 marked a watershed in IIS development, with many administrators balkingat the frequent upgrades and large numbers of new features they needed to cope withwhen deploying IIS. Many chose to stay with IIS 3 since it was stable and ran smoothly,rather than take the chance of upgrading to version 4 and seeing something break.Others saw the Option Pack enhancements as so many bells and whistles and alsodecided to stick with IIS 3. There were just too many service packs coming out ofRedmond in the opinion of many people, though in fact all Microsoft was trying to dowas make the Windows NT 4 platform more secure and reliable. Nevertheless, thosewho were forward-looking could see the writing on the wall and chose to upgrade,and in most cases this went smoothly enough.

Some of the enhancements that were rolled into version 4 included

• An entirely new version of Internet Service Manager, implemented as a seriesof snap-ins for the new Microsoft Management Console (MMC) interface. This





was probably the biggest change from the point of view of IIS administration,as it meant learning an unfamiliar interface for performing familiar tasks.

• Implementation of the new HTTP 1.1 standard from the IETF, which madeHTTP transfers more reliable and efficient.

• Upgrading SSL to the new version 3 standard for greater security and supportfor 128-bit encryption (where allowed).

• Use of MTS for developing transactional ASP applications that employedpersistence to maintain state information across multiple HTTP requests.This allowed for much more complex web applications to be developedusing ASP/IIS.

• Improved browser-based administration of IIS using an ASP application calledHTML Administrator (HTMLA).

• The ability to manage certain aspects of IIS configuration by running scriptsfrom the command line or desktop shortcuts. These scripts were typicallywritten using JScript and executed using the new Windows Script Host (WSH).

• The metabase, a new binary file that was used instead of the Registry for storingIIS configuration information. The most common question most administratorshad after installing IIS 4 was, “Where’s the metabase, and how can I edit itdirectly?”

• Host headers that actually worked, enabling multiple websites to be hosted ona single IIS machine using a single IP address and the default TCP port 80 (hostheaders were introduced into version 2 of IIS but needed support for HTTP 1.1to work effectively).

• Bare-bones support for two additional Internet standard protocols, Simple MailTransport Protocol (SMTP), which was implemented in IIS 4 as an SMTP mailforwarder for use by ASP applications, and Network News Transport Protocol(NNTP), which forms the basis of USENET but was implemented in IIS 4 mainlyto provide discussion group functionality for advanced websites.

There were various other enhancements as well, including a new Website Operatorsgroup for assigning users privileges for administering IIS, per-site bandwidth throttling(important in multihoming environments), configuration backup and rollback for greaterreliability when IIS configurations were modified, W3C Extended Logging format (anindustry standard finally adopted by Microsoft), the ability to run an ASP applicationin a separate memory space from the web server and from IIS itself (this helped ensurethe stability of a web server running an unstable application), an improved MicrosoftVirtual Machine to provide better Java support, a script debugger to facilitate debuggingof ASP applications, domain blocking to restrict access to content based on domain orIP address, custom error messages for greater user usability, and so on.





IIS 5Development of IIS on the Windows NT platform basically halted after the OptionPack was released (though several more service packs appeared for the platform tocorrect bugs and fix things that didn’t work in IIS). Instead, the next development inthe history of the platform was version 5, which was released as part of the newWindows 2000 Server operating system two years later. The biggest difference betweenversions 4 and 5 was the name change: previously IIS stood for “Internet InformationServer” and was considered almost a separate server application in Windows NT(though in fact it was really just an optional component), but with Windows 2000 theacronym now represented “Internet Information Services,” probably to indicate moreclearly that Internet functionality was something that Microsoft had built into theirnew operating system from the ground up (just like Internet Explorer was supposedto be an “integrated” part of the operating system).

Apart from the name change, the most important enhancements in version 5 included

• A new application model called Pooled Process that allowed multiple webapplications to run within a shared memory space separate from the In Processspace of Inetinfo.exe

• CPU throttling, which allowed administrators to specify the share of CPU timethat could be assigned to a site

• Integration with Windows 2000’s Active Directory service, which providedgreater security and the ability to delegate IIS administration at a moregranular level than earlier versions

• New wizards to simplify the job of setting up and managing IIS, includingpermissions wizards for securing access to sites

• Support for Web Distributed Authoring and Versioning (WebDAV), anextension to HTTP 1.1 that allowed users to share documents over the Internetmore easily

In addition, there were a few other enhancements, such as new ASP capabilities,support for the U.S. Government’s Fortezza security architecture, enhancements inscalability, and so on. IIS 5 was clearly nothing revolutionary, but it did represent apolishing and fine-tuning of the product that led some to upgrade from earlier versions.

IIS 5.1Before I get to version 6, which is what this book is all about, we’ll briefly mention aninterim release called IIS 5.1. This version is essentially a scaled-down and slightlyenhanced version of IIS 5 and is available only on the Windows XP Professional desktopplatform. It’s a little hard to know why Microsoft released this version, as few peopleneed a stripped-down web server on their desktop machine. Web developers usingFrontPage 2002 are probably about the only ones who would use this version, but any





real web production company would prefer tying their developers into a real IIS 5server. Basically, IIS 5.1 on Windows XP is to IIS 6 on Windows Server 2003 as PersonalWeb Server (PWS) on Windows NT Workstation is to IIS 4 on Windows NT Server. Inother words, IIS 5.1 is about as unnecessary for the Windows XP/ 2003 platform asPWS was for the Windows NT platform. For the sake of being complete, I should mentionthat Windows 2000 Professional also had a scaled-down version of IIS 5 included withit, which was unfortunately also called IIS 5.

FEATURES OF IIS 6This brings us to the current incarnation of IIS, version 6, which is what the rest of thisbook is about. Having surveyed the evolution of IIS up to the present, let’s now take alook at some of the exciting new features and enhancements that make version 6 amust-have upgrade for any serious Microsoft shop.

Improved ArchitectureThe biggest changes in IIS 6 are hidden from view under the hood of the product. Theseare changes in the basic architecture of how IIS serves out content in response to HTTPrequests, and they have a significant impact on how IIS performs. In IIS 5 there wasone main service called Inetinfo.exe, and web applications could either run In Process(together with Inetinfo.exe) or Out of Process (isolated from Inetinfo.exe and runningin a separate memory space). In IIS 6 this architecture has been completely redesignedby moving all HTTP listening into the kernel for greater performance and reliability.Incoming HTTP requests are now handled by a kernel-mode component called Http.sys,which responds to each request by placing it into the appropriate queue for each websiteor application on IIS. Because of the isolation of Http.sys within the kernel, it is no longerpossible for the failure of one web application to bring down other applications on theserver. And because Http.sys runs in kernel mode, it can handle greater numbers ofHTTP requests more efficiently than the previous architecture in IIS 5. I’ll talk moreabout Http.sys and other aspects of the new IIS 6 architecture in the next chapter.

New ModePrevious versions of IIS separated web applications into different memory pools,including In Process (runs within the context of the main Inetinfo.exe service), Out ofProcess (runs in isolation from Inetinfo.exe within the context of a helper dllhost.exeprocess), or Pooled Process (runs collectively as a group of applications within anisolated helper dllhost.exe process). With IIS 6, this distinction between in-process andout-of-process execution no longer applies. Instead, all user-developed applicationcode is now run within isolated processes in a mode of operation called worker processisolation mode. In other words, all third-party application code is completely isolatedfrom the core web server processes (such as Http.sys). As a result, the failure or crash





of one web application cannot affect the operation of other applications on the server orcorrupt any of the core IIS configuration information and bring down the server itself.In addition, multiple applications can be grouped together if needed into separateapplication pools, with each pool being serviced by a separate Http.sys queue. Workerprocess isolation mode also means that management of IIS applications is simplified,since sites can now be taken offline or brought online independently and can be modifiedor debugged without affecting other sites running on the server. This is a great featurein today’s web development environment where application development cyclesare measured in weeks instead of years, with the result that bugs are often nevercompletely worked out of a program before the next release appears. I’ll talk moreabout Worker Process Isolation Mode and application pools in Chapter 2 and inChapter 8, “Configuring Applications.”

Web GardensJust as IIS 6 allows multiple web applications to run within the same application pool(for example, applications that need to share information with each other), it also letsyou configure multiple worker processes to service a single application pool. A workerprocess is a host process that contains the web service DLLs used to service the needsof a web application. The executable associated with a worker process is w3wp.exe,and it handles tasks like processing of HTTP requests forwarded from the kernel,loading and unloading ISAPI extensions and filters, performing authentication andauthorization, andso on. Normally, each application pool has a single worker processassigned to it to service the needs of the applications within the pool, but IIS 6 also letsyou configure an application pool to be serviced by multiple worker processes. It’s sortof like a web farm where multiple physical web servers can respond to incoming HTTPrequests, except here multiple worker processes respond to requests submitted to a singlehttp.sys queue. The end result is reliability, because if one worker process becomescongested or fails, other processes take up the load and the responsiveness of theapplication is unaffected. I’ll talk more about this feature in Chapters 2 and 8. Note thatIIS 6 even allows you to assign worker processes to individual CPUs on SMP systems!

IIS 5 CompatibilityFor applications that work well under IIS 5 but break when run within the new workerprocess isolation mode, IIS 6 gives you the option of switching to the old model of IIS 5using an emulation called IIS 5 isolation mode. In this mode, the underlying architecturewith kernel mode HTTP listening and response cache is still the same as IIS 6, but theuser mode architecture changes to that of IIS 5 to ensure that applications developedfor that platform still work in IIS 6.

New MetabaseThe IIS metabase was the bane of administrators in earlier versions of this product. Themetabase was designed to improve upon the Registry as a location for storing IISconfiguration information. The Registry itself is a hierarchical structure that replaced





the earlier System.ini and Win.ini files, which were plain text files in good oldWindows 3.1. The problem with the metabase in IIS 4 and 5 was that it was a binary filethat was not directly modifiable by administrators (even the Registry could be modifieddirectly using Regedit.exe or Regedt32.exe). The reason for having a metabase at allwas to speed up access to IIS configuration information by isolating this informationfrom the Windows Registry. Searching the Registry on disk was too slow, and the Registrywas often quite large and would have been unwieldy to load into memory just to havefast access to the IIS portion of it. So a hierarchical binary structure called the metabasewas created and stored in the \system32\inetsrv directory, and this metabase.bin wasthen loaded by IIS into memory to give it fast access to its properties. To be fair, Microsoftdid later provide a command-line tool called Mdutil for directly editing metabaseproperties, with the caveat that it was just as dangerous to do this as edit the WindowsRegistry by hand using Regedit. They also provided a GUI version of this tool calledMetaEdit in the Windows 2000 Resource Kit.

Well, with IIS 6 we’ve come full circle with regard to the metabase: namely, it’s atext file once again! Shades of Win.ini! The proprietary binary format of the IIS 4 and 5metabase has been abandoned in favor of plain text files formatted using ExtensibleMarkup Language (XML), the wave of the future as far as interprocess communicationsis concerned. This makes it easy to edit the metabase using tools as simple as Notepad(something you want to be careful about doing, however, because one slip up and yourmetabase is corrupted and your web server may not start). I’m assuming you can readnative XML directly, of course—but perhaps in a few years, children will learn XML inkindergarten, right after they learn how to draw the letters of the alphabet!

There are other enhancements besides the basic format of the metabase:

• A metabase history feature that keeps track of all changes made to themetabase, creating a version history of different Metabase.xml files for yourserver. This is terrific in case you need to revert to a previous stable metabaseconfiguration if you mess up your web server settings.

• The ability to edit the metabase while IIS is still running without having to stopand restart websites or services. This is cool.

• The ability to programmatically export and import branches of the metabase.This feature allows you to copy a directory, site, or entire server collection fromone physical machine to another using the admin scripts included with IIS 6,Active Directory Services Interface (ADSI) scripts, or Windows ManagementInstrumentation (WMI) tools.

I’ll talk more about the metabase and its new features in Chapter 18.

Enhanced SecurityLack of security has probably been the number one issue brought against the MicrosoftWindows platform, and against IIS in particular. In part this was due to the high visibilityof Microsoft, which made its products a tempting target for hackers and disaffectionados.





The reality is that IIS is probably the most secure web server platform around, simplybecause it has been hacked from this way through Sunday. The result is that most of itssecurity vulnerabilities have been exposed and are well known and easily fixed usingservice packs and hot fixes available from Microsoft. Nevertheless, in one aspect of thesecurity issue, Microsoft really did fall down: when you installed earlier versions of IISout of the box it was basically "wide open" instead of "locked down." This meant everyservice was enabled and started, permissions were assigned their least restrictivevalues, and service accounts had high system privileges. The result was that when aninexperienced administrator set up IIS sites on a server, these sites were likely to beeasily compromised or taken down by knowledgeable hackers. In response to this,Microsoft began to get serious about security, and in late 2001 they released a SecurityToolkit on their website that contained some important additions to IIS 4 and 5—namely, the IIS Security Lockdown Wizard, a tool that implemented the securityrecommendations Microsoft previously published in its Security Checklists for theseproducts, and UrlScan, an ISAPI filter that blocked malicious HTTP requests thatattempted to destabilize IIS through buffer overflows and other programming tricks.

What’s new with IIS 6 is that the functionality of the Lockdown Wizard has nowbeen incorporated into the product in the form of a new feature called Web ServiceExtensions (WSE). Furthermore, IIS is now installed in a locked-down state instead of awide-open configuration, with ASP and FrontPage extensions disabled, permissions setat high levels, no ISAPI extensions or filters installed, and sample content that consistsonly of harmless static HTML pages. In fact, you need to use WSE after you install IIS,not to lock it up further, but to open it up to the degree necessary to meet your needs.This is a big improvement, and Microsoft deserves kudos for finally taking this stepbecause it flies in the face of their common goal of giving users “features, features,features!” That goal might be acceptable for end users and desktop applications, butthe server room is something far different.

SECURITY ALERT! We’ll examine WSE in more detail later in Chapter 7, “Creating and ConfiguringWeb Sites,” and Chapter 10, “Securing IIS”; but if you’ve already installed and started playing with IIS6 and find that the web applications you’ve migrated to this new version no longer work, try playingwith the WSE node in IIS Manager. Out of the box, IIS 6 will only serve up static HTML files to clients;in order for ISAPI, CGI, or ASP.NET applications to work, these features must first be unlocked usingthe wizard.

There are other security improvements Microsoft made in IIS 6, including

• Configurable worker process identity, a method for ensuring that anadministrator of one web application deployed on IIS is completely isolatedfrom and cannot interfere with the configuration or operation of web applicationsmanaged by other administrators on the same server.





• Low privileges for IIS 6 worker processes, which by default use a specialbuilt-in identity called NetworkService as the context in which they run, insteadof the more-powerful LocalSystem account used in previous versions of IIS.

• Digest Authentication, an authentication method that sends a hash value acrossthe network and can work through firewalls and proxy servers. IntegratedWindows Authentication is also still available (as are Basic Authentication andAnonymous Access) when less security is required.

• Integration with Microsoft .NET Passport to allow IIS to use Passport as anauthentication method.

• The ability for cryptographic processing to be offloaded to a suitablecryptographic service provider (CSP) for strong security.

• The ability to configure the metabase to cause IIS to respond with an AccessDenied message when requests for files with unknown file extensions are received.

• In an Active Directory environment, Group Policy can be used to block IISfrom being installed in order to prevent users from deploying unauthorizedweb servers on a company’s network.

I’ll cover these various security features in more detail later in Chapter 10.

Improved PerformanceI’ve already talked about how moving the HTTP listener into the kernel dramaticallyincreases performance of IIS and allows more applications and websites to be hostedon a single machine (which means lower costs). IIS 6 includes other enhancements thatalso contribute to improved performance over earlier versions, including

• Large memory support for caching up to 64GB of data on 32-bit Intel platforms.Cached data can now be retrieved more quickly, and this boosts the performanceof the web server.

• Advanced caching heuristics that determine when content (static or dynamic)should be cached and when it should be discarded. This includes caching ofASP templates (when an ASP file is processed, it is first compiled into an ASPtemplate prior to execution). The most requested ASP templates are held inmemory while others are persisted to disk.

• Web gardens (mentioned earlier) that can reduce blocking by binding workerprocesses to specific processors on SMP machines.

• Improved thread management to make more efficient user of concurrencywhen executing processor-bound requests.

• Improved allocation of resources, now allocated as required instead of beingallocated during initialization.







• Compression of HTTP responses to improve performance on congestednetworks. This feature was first included in IIS 5 but only as a global ISAPIfilter. In IIS 6, however, it can be configured at the server, site, directory, oreven file level.

• Improved management of server resources for individual sites and applicationpools, including configurable connection limits and timeouts, bandwidththrottling, process accounting, memory recycling, and queue length limits.

The net result of all these performance enhancements is that a single IIS 6 machinecan host thousands more sites than an earlier IIS 5 one could. This is especially goodnews for service providers like ISPs and web hosting companies, and it may give themjust the reason they need to migrate their systems away from Apache. I’ll cover theseperformance enhancements in Chapter 2, as well as Chapter 12.

Improved ManagementIn addition to being able to manage IIS using the Internet Services Manager snap-in,there are several other ways you can manage IIS 6 machines:

• A WMI provider is included to allow IIS configuration information storedin the metabase to be remotely accessed and manipulated using WindowsManagement Instrumentation (WMI). This complements the already-existingway of accomplishing this using Active Directory Services Interfaces (ADSI)in IIS 5.

• A collection of administration scripts written in VBScript are included, whichallow administrators to manage IIS from the command line to create, delete,start, stop, and list web and FTP sites; create and delete virtual directories;export and import IIS configuration into a text file formatted with XML; backup and restore IIS configuration information; and so on.

• A brand new browser-based administration tool much superior in ease of useto the old HTMLA of earlier IIS versions(see Figure 1-2 for a peek at this new tool).

You can also administer IIS remotely using Terminal Services, which has beenenhanced and improved in Windows Server 2003. I’ll talk more about these variousadministration tools in Chapter 5, “Administering Standard/Enterprise Edition”;Chapter 6, “Administering Web Server Edition”; Chapter 11, “Working from theCommand-Line”; and Chapter 12, “Performance Tuning and Monitoring.”

Other EnhancementsFew changes were made to the FTP, SMTP, and NNTP services in this version, as IISis really a web application platform. One change that’s worth mentioning is FTP UserIsolation, which isolates users’ top-level FTP directories from each other, making themappear as if they are the root directory of the server. This helps prevent FTP users from





nosing around in other peoples’ home directories and enhances the security of IIS as anFTP server platform. Another FTP improvement is FTP Restart, which allows interruptedfile transfers to be resumed where they left off.

Other enhancements in this version include:

• The ability to restart IIS without rebooting your machine (in fact, very fewreboots are required in Windows Server 2003).

• Enhanced IIS W3SVC logging feature that supports Unicode and UTF-8 andnot just ASCII.

• Improved custom HTTP error messages, which you can further customize ifyou desire.

• Improved ISAPI functionality, including Unicode support, custom errors,COM+ services, and so on. This is pretty heavy stuff and basically of interestonly to high-level programmers.

Figure 1-2. The new browser-based administration tool of Window Server 2003.





WINDOWS SERVER 2003 FLAVORSBefore we conclude this chapter, I’ll talk briefly about the different “flavors” of WindowsServer 2003 because they impact to a degree the capabilities (and sometimes the features) ofthe platform’s IIS 6 component. First, recall that the previous platform in this seriesfrom Microsoft, Windows 2000, came in four flavors:

• Windows 2000 Professional The desktop version of the platform

• Windows 2000 Server A departmental server platform that included IIS 5and supported 4-way SMP and up to 4GB of memory

• Windows 2000 Advanced Server An enterprise-level server that includedeverything Windows 2000 Server had, plus 2-node clustering and network loadbalancing; and it supported 8-way SMP and up to 8GB of memory.

• Windows 2000 Datacenter Server A high-availability platform available onlythrough OEM channels that included everything Windows 2000 AdvancedServer had, plus 4-node failover clustering; and it supported 32-way SMP andup to 64GB of memory.

In Microsoft’s new Windows XP/ 2003 Server family platform, which is thesuccessor to the earlier Windows 2000 line, these four earlier products have nowevolved into six new ones:

• Windows XP Home Edition A lightweight successor to both Windows 98/Me and Windows 2000 Professional.

• Windows XP Professional Edition Replaces Windows 2000 Professional onthe corporate desktop.

• Windows Server 2003, Standard Edition Includes IIS 6 and is the naturalsuccessor to Windows 2000 Server as a basic departmental file, print, andapplication server. Standard Server supports four-way SMP and up to 4GB ofmemory.

• Windows Server 2003, Enterprise Edition The natural descendant ofWindows 2000 Advanced Server. Enterprise Server includes everything foundin Standard plus 8-node Edition clustering and support for 8-way SMP and upto 32GB of memory (Windows 2000 Advanced Server supported only 8GB ofmemory).

• Windows Server 2003, Datacenter Edition The super high-end mission-critical platform that you can only buy direct from an OEM. Features aresimilar to Windows 2000 Datacenter Server with advanced clustering support.

• Windows Server 2003, Web Edition A.k.a. “Blade” (with apologies to WesleySnipes), this is the new baby in the evolutionary tree and represents a radical



(and refreshing) departure for Microsoft: it’s a version of their server operatingsystem specifically intended for use as a web server. the Web Edition is easy todeploy and manage and is intended primarily for running on rack-mountable“blade servers” where multiple physical servers, each the size of a peripheralcard, are mounted inside a chassis for greater density of server resources. As aresult of its intended use, the Web Edition lacks many of the features found onthe other Windows Server 2003 family members, such as Internet ConnectionSharing and Services for Macintosh. In addition, the Web Edition cannot bedeployed as a domain controller, does not support clustering, and supports2-way SMP and up to 2GB of memory, making it the most lightweight of theWindows Server 2003 family.

In addition, I should mention that two members of the family—namely, Enterpriseand Datacenter Servers—are also available in 64-bit versions that run on Intel’s newItanium processor architecture. Enterprise Server supports up to 64GB of memory onItanium, while Datacenter Server can go up to 512GB of memory on this platform. Fora closer comparison of the features supported by the four Windows Server 2003 familymembers, see Table 1-1. The hardware requirements for these different platforms willbe specified in detail in Chapter 3, “Planning Deployment.”

NOTE I’ve omitted coverage of Windows Datacenter Edition from Table 1-1 as this is an OEMproduct whose specifications depend in part on hardware support. Because it is unlikely that DatacenterServer would be used as a web application server (it is intended mainly as a back-end database server),it is not covered in this book.



Feature Web Standard Enterprise

Clustering TechnologiesCluster Service Yes

Network Load Balancing (NLB) Yes Yes Yes

Directory ServicesActive Directory Partial Yes Yes

Metadirectory Services (MMS) Support Yes

File and Print ServicesDistributed File System (Dfs) Yes Yes Yes

Encrypting File System (EFS) Yes Yes Yes

Fax Service Yes Yes

Removable and Remote Storage Yes Yes

Services for Macintosh Yes Yes

Table 1-1. Differences Between Web, Standard, and Enterprise Editions





Feature Web Standard Enterprise

Shadow Copy Restore Yes Yes Yes

SharePoint Team Services Yes Yes

Management ServicesIntelliMirror Yes Yes Yes

Remote Installation Services (RIS) Yes Yes

Remote OS Installation Yes Yes Yes

Resultant Set of Policy (RSoP) Yes Yes Yes

Windows Management Instrumentation (WMI)Command Line

Yes Yes Yes

Multimedia ServicesWindows Media Services Yes Yes

.NET Application ServicesASP.NET Yes Yes Yes

Enterprise UDDI Services Yes Yes

Internet Information Services 6 Yes Yes Yes

.NET Framework Yes Yes Yes

Networking ServicesInternet Authentication Service (IAS) Yes Yes

Internet Connection Sharing (ICS) Yes Yes

IPv6 support Yes Yes Yes

Network Bridge Yes Yes

Session Initiation Protocol (SIP) Yes Yes

Virtual Private Networking (VPN) Partial Yes Yes

Scalability64-bit Support for Itanium Platform Yes

Hot Add Memory Possible

Non-Uniform Memory Access (NUMA) Possible

Security ServicesCertificate Services, PKI, and Smart Cards Partial Yes Yes

Internet Connection Firewall Yes Yes

Terminal ServicesRemote Desktop for Administration Yes Yes Yes

Terminal Server Yes Yes

Terminal Server Session Directory Yes

Table 1-1. Differences Between Windows Server 2003 Web, Standard, and Enterprise Servers(continued)



CHECKLIST: FEATURES OF IIS 6The following is a checklist for familiarizing yourself with the new features of version 6of IIS. Read them through and check off which ones are important to you when consideringmigrating your existing IIS 4 and 5 servers to IIS 6:

■ HTTP request handling has been moved to the kernel for greater reliability andbetter performance.

■ User-developed code is completely isolated from core web server processes forimproved stability and reliability.

■ Web applications can be grouped together into multiple application pools forsimplified administration and greater flexibility.

■ Multiple worker processes can be assigned to the same application pool forimproved reliability and greater responsiveness.

■ A special IIS 5 compatibility mode can be used for older applications that havetrouble running under the new IIS 6 architecture.

■ A new XML metabase provides administrators with the flexibility ofconfiguring IIS 6 by manually editing the metabase file using a text editor likeNotepad, even while IIS is running.

■ A metabase history feature allows you to revert to previous metabase versionseasily to recover from problems arising from configuration changes.

■ Portions of the metabase can be imported and exported easily, providingadministrators with the flexibility of copying directories, sites, or entire serversfrom one physical machine to another.

■ IIS 6 installs in a locked-down mode by default that serves up only staticHTML files, and it must be opened up using the Web Service Extensions (WSE)node before web applications can work. This makes IIS 6 a more secure platformthan earlier versions that were installed in a wide-open mode by default.



ChallengeYou are currently running your company’s website on a combination of IIS 4 and5 machines and are considering upgrading to IIS 6. What reasons can you giveyour boss to justify the cost of the upgrade? What benefits do you expect toachieve with IIS 6 over previous versions? How concerned are you about yourlegacy web applications running on the new platform? Which flavors of WindowsServer 2003 would you utilize for running IIS 6?



■ Worker processes are assigned the NetworkService identity as their securitycontext by default. This identity has few privileges in order to make webapplications more secure.

■ Worker process identities can be manually configured to completely isolateweb applications on an IIS 6 machine, providing enhanced security and greaterreliability.

■ IIS 6 supports .NET Passport as an authentication method, providing greaterflexibility for developing secure, scalable web applications.

■ Improved caching heuristics and support for cache sizes up to 64GB allowboth static and dynamic content to be cached by IIS, providing a significantperformance boost over earlier versions.

■ For greater flexibility, IIS 6 can be administered a variety of ways includingMMC console, WMI, ADSI, Terminal Services, scripts, and improvedbrowser-based administration.

■ Fewer reboots are required after configuration changes, resulting in lessdowntime for mission-critical applications running on IIS.

■ Improvements in ISAPI to allow developers to create better web applicationsrunning on IIS.

■ A new “Blade” version of Windows Server 2003 has been designed forhigh-availability rack-mountable servers running in large datacenters.





chapter 1 · including web servers (iis vs. apache), internet mail servers (exchange vs. sendmail),...

Documents