Entries tagged with iis7 - TechNet Edge

Feature of the Week: URLScan 3.0 for IIS 7.0

Joey — Thu, 28 Aug 2008 07:01:00 GMT

Back in April there were reports that surfaced stating that web sites running on Internet Information Services (IIS) had been compromised by an automated attack that used vulnerabilities in web pages that did not follow security for best practices. These websites were taken advantage of via SQL injection attacks. While the only way to completely prevent SQL injection attacks is by following proper development best practices, URL Scan 3.0 is an updated IIS feature that will allow server administrators to help mitigate SQL injection attacks until the web application can be updated to protect against SQL injection. This post will provide more details on the latest version of this technology.

URL Scan 3.0

Who’s it for? IT Professionals and Website Administrators.

When does it ship? URL Scan 3.0 was released to the Web on 8/21/08 and can be downloaded from the following locations:

· 32 Bit: http://www.iis.net/go/1697

· 64 Bit: http://www.iis.net/go/1698

(Wow looking at those nice clean URL’s makes me want to post about another new IIS feature. I guess more on that later.)

What does it do? When installed and configured on a server running IIS 5.1 or higher, URLScan can scan incoming http requests and if the request contains content that is undesirable (like a SQL injection attack), that request can be rejected. By filtering these requests, URLScan helps prevent unwanted requests from potentially damaging the web application or even the web server.

How is URLScan different than the request filtering module that ships with IIS 7? The request filtering module does not have the ability to filter based on query strings like URLScan 3.0 does. Also you cannot specify rules applying to multiple parts of an HTTP request.

So didn’t URLScan exist before? Yes. URLScan 2.5 was originally released as part of the IIS Lockdown Tool and if you are using URLSCan 2.5, you can use your existing configuration file with URLScan 3.0 and everything will function fine. Plus you get the added URLScan 3.0 features!

What are the new URLScan 3.0 features? While the configuration format of URLScan 3.0 is the same as it’s predecessor, there are a number of new sections in the configuration to support the following new features:

· Deny rules can be independently applied to a query string, all headers, a particular header, a URL or a combination of the above.

· Configuration change notifications are propagated to the IIS worker processes so configuration changes don’t require worker process restarts.

· The global DENYQUERYSTRING section of the configuration file allows you to add deny rules for query strings and include an option to check the un-escaped version of the query string.

· The global ALWAYSALLOWEDQUERYSTRINGS section allows for the specification of safe query strings that will bypass all query string checks. (This feature was not in the previously released URLScan 3.0 beta).

· Descriptive configuration errors are now available in W3C formatted logging. This feature was also not available in the beta.

· Escape sequences like (%0A%0D) can now be used in deny rules allowing to deny CTRLF and other sequences involving non-printable characters.

How can URLScan be setup? URLScan can be setup up either as a global filter or a site level filter. A global filter is triggered for every HTTP request sent to the server. Site level filters are only invoked for HTTP requests sent to particular sites on a IIS server. Starting with URLScan 3.0 site filters can be used in conjunction with global filters.

Where can I get more information?

URLScan 3.0 FAQ

Using URLScan

Common URLScan Scenarios

IIS and Powershell

AdamBomb — Sun, 24 Aug 2008 15:01:00 GMT

Rimantas Malinaukas is a Solution Architect for Propensity International in Sydney, Australia. Our own Jeff Alexander sat down with him to talk about a recent project where they built a solution on a pre-release of IIS7 and used Powershell to save the day when they discovered an issue in the product.
It's a great story about offering Software as a Service and a hosted solution.

Easy Steps to Get your Web Site to Support IE8

neil — Thu, 21 Aug 2008 06:59:00 GMT

Any users accessing your site using the Internet Explorer 8 (IE8) browser ( currently in Beta ) will typically not get a very good rendering experience if your site was designed for Internet Explorer 7 (IE7) because of new standards that IE8 is supporting around HTML and CSS formats. There are two ways to resolve this.

1) The longer term option is to re-write your web application to render IE8 correctly - However this would not be my first choice.

2) The best ( to choose first off ) is to instruct any IE8 browsers to browse your site in IE7 emulation mode so that the current rendering is maintained. How do you do this? Simple

On a Per-site basis, site owners and administrators can include the following custom HTTP header to force Internet Explorer 8 to render Web pages like Internet Explorer 7:

X-UA-Compatible: IE=EmulateIE7

To add a custom HTTP response header at the Web site level in Internet Information Services 7 on a Windows Server 2008-based computer, follow these steps:

Click Start, click Administrative Tools, and then click Internet Information Services (IIS) Manager.
Under Connections, double-click the server that you want, and then double-click Sites.
Click the Web site where you want to add the custom HTTP response header.
Under Web site name Home, double-click HTTP Response Headers in the IIS section.
Note In this step, Web site name is the name of the Web site.
Under Actions, click Add.
In the Name box, type X-UA-Compatible.
In the Value box, type IE=EmulateIE7.
Click OK.

You can also modify the IIS7 configuration file with the following details ( or you can check the config after the changes made above )

<system.webServer>
<httpProtocol>
<customHeaders>

<add name="X-UA-Compatible" value="IE=EmulateIE7" />

</customHeaders>

</httpProtocol>
</system.webServer>

To add a custom HTTP response header at the Web site level in Internet Information Services 6 and earlier versions, follow these steps:

Click Start, click Run, type inetmgr.exe, and then click OK.
Expand the server that you want, and then expand Web Sites.
Right-click the Web site that you want, and then click Properties.
Under Custom HTTP headers, click Add.
In the Custom header name box, type X-UA-Compatible.
In the Custom header value box, type IE=EmulateIE7.
Click OK two times.

Per-page basis

Site owners and administrators can include the following special HTML tag after the <Head> tag on the page:

<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />

The following example shows use of this Internet Explorer 7 compatibility mode tag on a per-page basis:

<html> <head> <!-- Use IE7 mode --> <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" /> <title>My Web Page</title> </head> <body> <p>Content goes here.</p> </body> </html>

For more information about the EmulateIE7 tag, visit the IEBlog Web site:

http://blogs.msdn.com/ie/archive/2008/06/10/introducing-ie-emulateie7.aspx

To download IE8 for testing, you can go to the following location

http://www.microsoft.com/windows/products/winfamily/ie/ie8/default.mspx

Streaming Media with Server 2008

extreme — Thu, 08 May 2008 05:14:00 GMT

I’ve always been intrigued on the idea of streaming my own music collection from my home server, so I decided to write this post on technology which can make this happen. If you’re running any version of Server 2008 other than the version for Itanium-based systems, you have the capability of using Windows Media Services and/or IIS7’s Media pack to stream your audio / video (media) content. What’s the difference and which should I use?

Windows Media Services – This enables you to stream media using the “mms” prefix in your player of choice and this method is commonly referred to as a media streaming server. You have the ability to broadcast media or setup on-demand publishing. To make this work, you must install the Media server role and after this download and install media services.

Some key benefits over IIS7 Media pack

Stream content using multi-cast
Proxy/Cache the stream and other options for bigger scale streaming operations
Broadcast media in addition to on-demand playback
More efficient utilization of network bandwidth by adjusting to network conditions

File formats supported : .asf, .wma, .wmv, .mp3 (with use of the MP3 media parser plug-in & doesn’t support VBR files), .jpg, .nsc, .wsx

Media Pack for IIS7 – This enables you to stream media using a method referred to as progressive download (or using a web server), This means the media is downloaded to the client machine, playing via some type of a client such as Windows Media Player, and often beginning to play before the file is completely downloaded. This method only allows you to setup on-demand playback.

The media pack includes two components: Bit Rate Throttling and Web Playlists; both of which must be installed separately on top of IIS7.

Benefits over Windows Media Services

Additional file formats officially supported for .avi, .flv, .mov, .rm, .mp4, and .rmvb with throttling, but any file format could potentially work.
Easily push out the configuration using the shared hosting capabilities of IIS7
Granularly configure bit rates for specific files/folders
Delegate permissions for others to modify the settings for specific files/folders

File formats supported: .asf, .avi, .flv, .mov, .mp3, .mp4, .rm, .rmvb, .wma, .wmv.

Conclusion: If you have a very large amount of content you want to stream, then you’ll definitely want to use Windows Media Services due to the options available to scale and save bandwidth. However, IIS7’s media pack may be the right option for you if you’d like to stream the additional file formats and gain all of the benefits of being integrated with IIS7. For another great comparison between the two media streaming methods, see Chris Knowlton’s blog post.

Get started

IIS7 Media Pack - Bit Rate Throttling
IIS 7 Media Pack – Web Playlists
Windows Media Services Deployment Guide
Changes in Functionality from Windows Server 2003 with SP1 to Windows Server 2008 (http) (doc version)

External Web Application Management Using IIS 7

Joey — Mon, 17 Mar 2008 07:01:00 GMT

One service that typically requires remote administration by external consultants or application developers are web servers. In this 7 minute screencast MVP Corey Hynes takes us through the new managment service in IIS 7 that addresses the need to delegate remote administration while maintaining the security of your web server.

MSCOM OPS with Microsoft.com, WS08, IIS7, and the Lone Server

extreme — Wed, 23 Jan 2008 17:14:00 GMT

I sat down with Jeff Toews, a member of the Microsoft.com Operations (MSCOM OPS) Engineering Team which is responsible for managing, maintaining, and deploying all of the servers which host Microsoft.com and thousands of other MS websites.

In this interview, you get to learn a little bit about Microsoft's hosting environment and configuration, some good tips on migrating from WS03 / IIS 6, knowledge into some of the new IIS 7 features, and we learn the truth behind the Lone Server!

Because this one is a little bit long, I'm providing the breakdown for what is where in the video:
00:00 - Who Jeff is and what he and his team does
04:29 - What the environment & hardware config is like
06:20 - Steps they took to migrate from the start

Get it to install (worked with it in alpha)
Feedback / work with IIS7 product team
Configuration to test server
Performance testing & tuning (i.e. with WCAT, etc)
Move to single production box

12:32 - Challenges they had in the migration
14:37 - Specific tips on how to migrate from IIS6 to IIS7
18:18 - Migration from classic to integrated mode difficult?
19:30 - Benefits of Integrated Mode
28:58 - Performance Tips: Caching/compression/tuning dynamic content
33:15 - Does the Lone Server really exist?
35:40 - A final summary and information about failure request event buffering (FREB).
37:56 - Over the Edge

For "Over the Edge", learn about special edition Jimi Hendrix vodka, KEXP, see liquid which is "the size of a small infant" and the Beatles, and get Jeff's IIS7 book recommendations.

Getting PHP to perform on IIS7

Daven — Wed, 02 Jan 2008 16:00:00 GMT

I've been showing this demo to people in Ireland for while now & thought I'd better share it with a wider audience before I lose it (I'm going to wipe my demo laptop soon & reload it with Windows Server 2008).

Enjoy,

Dave.

Failed Request Tracing in IIS7

neil — Fri, 23 Nov 2007 17:00:00 GMT

In this screencast, Ryan Dunn configures IIS7 server for Failed Request Tracing (sometimes called FREB). Failed Request Tracing is a powerful new capability in IIS7 that allows us to easily set rules on our web applications, that once triggered will log that request to disk and pull in all the relevant trace information. This feature is immensely useful for troubleshooting running applications where attaching a debugger is impractical.

Installing PHP Applications on IIS7

neil — Thu, 22 Nov 2007 17:00:00 GMT

In this screencast, Ryan Dunn shows how easy it is to get PHP up and configured on your IIS7 webserver using FastCGI. The popular PHP-based blogging application, Wordpress, is used to demonstrate.

Additionally, we see how quickly and easily we can integrate a PHP app with IIS7's integrated pipeline as we convert Wordpress to use IIS7's built-in Forms Authentication.

Remote Administration and Delegation in IIS7

neil — Wed, 21 Nov 2007 23:27:00 GMT

In this screencast, Ryan Dunn configures a IIS7 server for remote administration and delegation. The remote administration service in IIS7 is a new and powerful feature that allows us to connect securely to our remote IIS server using a firewall-friendly SSL connection. Additionally, we can choose to use traditional Windows accounts for authentication or choose the new IIS Manager user accounts instead.

We will walk through the steps you must perform as the IIS administrator as well as the experience for a remote administrator using delegated features.