IIS 6: The Complete Reference

IIS 6: The Complete Reference Hethe Henrickson Scott Hofmann HLllHB DarmStddt McGraw-Hill/Osborne New York Chicago San Francisco Lisbon London Madrid Mexico City urn1111 iiurnii, f H 15905980 Seoul Singapore Sydney Toronto

Contents Acknowledgments Introduction xvii xix D3I IIS Fundamentals 3 About Windows Server 2003 4 Hardware Support in Windows 2003 4 Installing Windows 2003 5 Installing IIS 6 The IIS Subcomponents 6 IIS Services 8 The IIS Directory Structure 9 The Administration Web Site 9 IIS Help Files 10 The Inetpub Directory 10 Accounts Used by IIS 10 IUSR_COMPUTERNAME 10 IWAM_COMPUTERNAME 10 IIS WPG 10

Mf IIS 6: The Complete Reference Navigating IIS 11 The Microsoft Management Console 11 The Metabase 13 Metabase History 14 Backing Up and Restoring the Metabase 14 Editing the Metabase 16 The Metabase Schema 17 IIS 6 Architecture 17 Worker Process Isolation Mode 18 Application Pools 19 Health Monitoring 19 Orphaning Worker Processes 20 Scalability 20 Web Gardens 20 D1I 2 The WWW Service 21 Using the IIS MMC 22 Web Site Directories 22 Creating Virtual Directories 23 Saving a Web Site Configuration to a File 24 Creating a New Site 25 Accessing Configuration Tabs 26 The Web Site Properties Tabs 26 Web Site Tab 26 The Performance Tab 31 The ISAPI Filters Tab 32 The Home Directory Tab 34 The Documents Tab 44 The Directory Security Tab 46 The HTTP Headers Tab 56 The Custom Errors Tab 60 The BITS Server Extension Tab 62 The Server Extensions 2002 Tab 64 Global Web Sites Properties Tabs 70 The Service Tab 70 Other Tabs 73 Directory Level Properties Tabs 74 File Level Properties Tabs 74 Application Pools 75 Creating an Application Pool 75 Application Pool Properties 76

Contents vff IZJII 3 The FTP Service 83 Managing the FTP Service 84 Viewing FTP Service Status 86 Starting and Stopping FTP Sites 87 Current Sessions 88 Managing FTP Site Contents Using the MMC 89 Refresh 91 Creating and Configuring FTP Sites 91 FTP Site Creation Wizard 92 Creating FTP Sites Using the iisftp Script 97 Using Export Definition Files 100 Creating Virtual FTP Directories 102 FTP Sites Node Configuration 103 Advanced IIS MMC Configurations 103 Connections 104 Directory Security IP Address Restrictions 104 Directory Listing Style MS-DOS or UNIX 105 Messages 105 Logging Configuration 105 4 The SMTP Service 109 Managing the SMTP Service 110 Viewing SMTP Virtual Server's Status Ill Starting, Pausing, and Stopping SMTP Virtual Servers... Ill Starting, Pausing, and Stopping SMTP Service 112 Creating and Configuring SMTP Virtual Servers 114 New SMTP Virtual Server Wizard 115 Configuring an SMTP Virtual Server 118 Connection Settings 119 Logging Configuration 120 Managing Inbound Messages 121 Managing Message Delivery 123 SMTP Server Access Security 128 User Administrative Permissions 128 Authenticating Incoming Connections 128 Restricting Based on IP Address or Domain Name 129 LDAP Routing 130 SMTP Domains 131 Creating Domains 131 Configuring Domains 133

viii US 6: The Complete Reference CI3ifi 5 TheNNTPService 135 Installing the NNTP Service 136 Administering NNTP 138 Administering NNTP Service 138 Administering an NNTP Virtual Server 139 Configuring an NNTP Virtual Server 141 General Tab Settings 142 Access Tab Settings 144 Settings Tab 148 Security Tab 150 Creating a New NNTP Virtual Server 151 Newsgroups 153 Limit Groups Enumeration 153 Create a New Newsgroup 153 Configuring Newsgroup Properties 154 Administering Newsgroups 154 Expiration Policies 154 New NNTP Expiration Policy Wizard 155 Configuring Expiration Policies 156 Virtual Directories Node 157 New NNTP Virtual Directory Wizard 158 Configuring an NNTP Virtual Directory 158 Current Sessions 160 IIS Administration Dll 6 Security 165 Internet Security Background 166 Why Vulnerabilities Happen 166 How You Can Protect Your System 167 Common Types of Security Issues 167 Viruses 167 Trojan Horses 168 Worms 168 How to Protect Yourself from Attack 170 The Secure Windows Initiative 170 Patching Your System 171 Securing IIS 174 Don't Install Components You Don't Need 174 Don't Turn On Directory Browsing 175 Lock Down cmd.exe 175 Set Execute Permissions for Your Web Site 175

Contents : IX Don't Set Up Write for Your Web Site 176 Avoid Basic Authentication 176 Set Up Logging 176 Unmap Unneeded IS API Application Extensions 176 Hide the Fact that You're Using Scripting 177 Use SSL for Sensitive Web Sites 177 Always Use NTFS Permissions 178 Be on the Lookout for Hackers 178 Try to Hack In 178 Control IIS Servers 178 Security Policies in Windows Server 2003 178 Creating a Local Security Policy 179 Using the Local Security Policies 180 User Account Security 181 Force Strong Passwords 181 Enable Account Lockout 182 Force Periodic Password Changes 183 Remember Past Passwords 183 Set a Minimum Password Age 184 Use One-Way Encryption for Password Storage 185 Don't Create User Accounts with Easy Passwords 185 Web Service Extensions 185 Allowing Web Service Extensions to Run 186 Prohibiting a Web Service Extension from Running 186 Adding a New Web Service Extension 187 Allow All Web Service Extensions for a Specific Application 187 Prohibit All Web Service Extensions 187 Modifying the Properties for a Web Service Extension... 188 Authentication 189 Anonymous Authentication 190 Logon Types 191 Subauthentication in IIS 191 Basic Authentication 192 Basic Authentication Tokens 192 User Accounts and Basic Authentication 193 Digest Authentication 193 Advanced Digest Authentication 194 Integrated Windows Authentication 196 About Microsoft Negotiate 196 About NTLM Authentication 196 About Kerberos Authentication 197

IIS 6: The Complete Reference.NET Passport Authentication 198 Establishing.NET Passport Service 199 Setting Up the Site for.net Passport 202 Using Multiple Authentication Schemes 203 8 TCP/IP and DNS 205 The History of TCP/IP and the Internet 206 The ARPANET 206 Architectural Models for Communications Protocols 206 The DoD Protocol Model 207 The OSI Protocol Model 208 Communicating Across the Layers 209 Encapsulation 209 Addressing in TCP/IP 210 MAC Addresses 210 IP Addresses 210 IP Protocol Versions 211 IPv4 211 IPv6 212 The TCP, UDP, and ICMP Protocols 213 Using TCP/IP 213 Choosing an IP Address 214 Configuring IPv4 214 The IP Settings Tab 214 The DNS Configuration Tab 217 The WINS Configuration Tab 218 The Options Tab 220 Configuring IPv6 221 Installing IPv6 221 Using the NETSH Interface 222 Changing the Primary DNS Suffix 222 DNS and Windows Server 2003 223 History of DNS 223 ABrief Overview of DNS and TLDs 223 How DNS Names Are Resolved 226 DNS Zone Storage 227 Storing Your Zone Information in a Text File 227 Storing Zone Information in Active Directory 229 DNS Dynamic Updates 230 Regular Dynamic Update 231 Secure Dynamic Update 231 Windows Server 2003 as a Caching Server 231 Resource Record Types in DNS 231

Contents x! Installing DNS on Your WS03 Server 234 The DNS MMC 235 Event Viewer 235 Forward Lookup Zones 235 Reverse Lookup Zones 236 Using Round Robin DNS 240 Using a Hosts File for Name Resolution 241 DI3 9 Administration Tasks 243 Editing the XML Metabase File 244 Editing While the Server Is Running 244 Editing While the Server Is Stopped 245 Using the ADSI Provider 245 IIS ADSI Objects 245 IIS ADSI Properties 246 IIS ADSI Methods 247 Using the WMI Provider 248 WMI or ADSI? 248 Scripting with WMI 249 Using the VBScript Utilities Provided with IIS 251 Remote Administration with the HTML Interface 253 Using the Remote Administration Site 254 10 Encryption 259 About Digital Certificates 260 Certificate Keys 260 Who Are Certificate Authorities? 265 How Server Certificates Work with SSL 265 How Client Certificates Work 266 Creating Your Own CA 267 Choosing Which Type of CA to Install 267 Installing the Certificate Services on Your Server 268 Creating a Certificate Request with IIS 272 Sending a Request to Your Own CA 273 Sending an SSL Certificate Request to a Commercial CA 275 Sending a Request for a Client Certificate from the Certification Authority MMC Snap-in 277 Sending a Request for a Client Certificate from the Web 278 Issuing or Denying Certificates from a Standalone CA... 278 Downloading a Web Browser Certificate from the Web 278 Installing an SSL Certificate 279

xil IIS 6: The Complete Reference Configuring SSL Settings 280 Requiring Secure Communication 281 Mapping Client Certificates to User Accounts 281 Backing Up and Restoring a Certificate 285 Dli 11 Logging 289 Log File Formats 291 Enabling Logging for Your Site 291 Log File Formats 295 W3C Extended Log File Format 295 Microsoft IIS Log Format 302 NCSA Common Log File Format 303 ODBC Logging 306 Using Custom Logging Modules 312 Setting Up a Custom Logging Module with IIS 312 Centralized Binary Logging 315 Setting Up Centralized Binary Logging 315 Crunching the Data 315 IIS Programming 12 ASP Programming 319 Overall Architecture of ASP 320 Editing ASP files, 321 Setting Up IIS to Host ASP 324 ASP Fundamentals 327 ASP Objects 328 Response Object 329 Application Object 329 Request Object 330 Session Object 338 Server Object 343 Using XML 356 Making a Transformation Using XSL 357 13 COM Web Programming 363 Introduction to VB6 365 Setting Up an ActiveX DLL Project 366 Creating a Class Interface in an ActiveX DLL 369 Object Browser 369 Building a Test Harness 372

Contents! xiii Deploying a COM DLL 374 Using regsvr32 375 Using Component Services 375 Unit Test a COM DLL 386 Using VB in COM 388 Building a COM Object in VB6 with Data Access Support 389 Properties in Classes 391 Database Connection Credentials 391 Error Handling 395 Writing to Database 397 Serializing into XML 406 Enhanced Test Harness 408 Deploy to COM+ with Constructor String 410 Integrating XML and XSL 412 II 14 ASP.NET Web Forms 421 Overview of the Web Forms Architecture 422 Getting Started in Visual Studio.NET 424 Web Form File ASPX 426 Web Form Codebehind File aspx.cs 430 Assemblylnfo.es File 433 Project File csproj 433 Project Weblnfo File csproj.webinfo 434 Discovery Information File vsdisco 434 Web Configuration File web.config 435 Building Web Forms 436 Editing Code for a Data-Oriented Web Form 438 Data Form Wizard 449 Using XML 453 Ii 15 ASP.NET Web Services 457 Web Services Architecture 458 Creating a Web Service Using Visual Studio.NET 459 Using the Component Designer 462 Event Log Component 480 Application Security 482 Testing the Web Service 486 Writing a Test Harness 489 II 16 ATLServer 493 ATL Server Architecture Overview 494 Create a Simple ATL Server Project 497

xiv. IIS 6: The Complete Reference Using the ATL Server Project Wizard 503 Project Settings 503 Server Options in the ATL Server Project Wizard 504 Application Options in the ATL Server Project Wizard... 509 Developer Support Options in the ATL Server Project Wizard 512 ATL Server Project Wizard Completion 514 Server Response Files 514 Tags in Server Response Files 514 Request Handler DLL 518 17 ISAPI Extensions 523 ISAPI Architecture Overview 525 URL Anatomy 525 ISAPI Extensions Interacting with IIS 526 ISAPI Compared to ATL Server 528 Building a Simple ISAPI Extension 528 Definition Export File 533 ISAPI Extension Main Entry Point 534 Deploy the HelloWorld ISAPI 538 Extracting Information from IIS 542 Building XML Representing the Server Variables Values 545 Special Case of ALL_HTTP Server Variable 545 Parsing the Header-Value Pair 555 Assembling the Remaining XML Elements 557 ISAPI Project Template Wizard 563 Creating an ISAPI Extension in Visual Studio.NET 564 ;j:y ':.,,; IIS Extras,.,., : _J 18 Software Process and Methodology for Web Applications 571 Definition of Terms 572 The Unified Process 573 An Adaptation of the Unified Process 574 Define Project Scope 576 Statement of Work 577 Scope Estimate 578 Scope Project Plan 578

Contents XV Define Functionality 581 Functional Specification 582 Gathering Functional Requirements 590 Define the Design 591 What Is a Facade? 592 Produce the Facade 594 Presenting the Facade 595 Write the Technical Specification 597 Technical Specification Template 598 Functional Test Scripts 600 Build the Solution 601 Test the Solution 603 Deploy the Solution 604 After the Project Completion 605 19 Bringing It All Together: Creating Your Own Web Site Using IIS 607 Get a Domain Name 608 Get an IP Address 609 Set Up DNS 610 Prepare the Server 612 Checking Server Hardening 612 Setting Up the Directory for the Web Site 613 Securing the NTFS Permissions for the Site 613 Add the Web Sites to IIS 616 Enable ASP 616 Configure the Application Pool 616 Make the Code 617 Make a Database 622 Get a Certificate for the Test Site 623 Get a Certificate for the Production Site 625 Set Up the Web Site Security 626 Create a User Account 626 Set Up NTFS Permissions 627 Set Up the Authentication Options 628 Test the Code 629 Roll into Production 629 20 Troubleshooting 631 Log Files 632 About W3C Logging 632 The Windows Event Viewer 636 MIME Mappings 638

xvi MS 6: The Complete Reference Dynamic Web Content 639 Permissions Issues 640 Worker Processes 640 Worker Process Identity 640 Worker Process Recycling 641 Web Service Shutdown 641 Performance Monitoring 642 Real-Time Monitoring 644 Using Counter Logs 644 Using Alerts in Performance Monitor 648 The General Tab 648 The Action Tab 650 The Schedule Tab 651 GH Appendix: XML Escape Values 653 H Index...'. 675