Server: Microsoft-IIS/7.0\r\n : IIS Links

Security Alerts - December 2009

qbernard — Fri, 11 Dec 2009 03:36:00 GMT

Recently, Microsoft released the December security bulletin , and one of the patches related to IIS. Meant to blog about this earlier but Nazim from IIS team beat me to it :) Been seeing lot of discussions online and patch management related mailing list...(read more)

Warning: Authorization - Cannot verify access to path (C:\inetpub\wwwroot\).

qbernard — Wed, 04 Nov 2009 09:51:00 GMT

I'm sure you have seen the below warning message many times with IIS 7+ The server is configured to use pass-through authentication with a built-in account to access the specified physical path. However, IIS Manager cannot verify whether the built...(read more)

IIS DebugDiag x64 is out

qbernard — Fri, 30 Oct 2009 09:07:00 GMT

Previously, the x86 version you are able to debug 32bit worker processes running on 32/64bit OSes, with this release - you can now debug a full 64bit worker processes. Here's the link at Microsoft download, and addtional note for x64 release Notes...(read more)

WebDav Encoding Vulnerability - Fixed

qbernard — Wed, 10 Jun 2009 05:32:00 GMT

Today, Microsoft released patch update for IIS 5.0/5.1/6.0 WebDav encoding issues with "/" character discovered last month , you can get the hotfix here ....(read more)

Security Alert - Vulnerability in Internet Information Services Could Allow Elevation of Privilege

qbernard — Tue, 19 May 2009 23:04:00 GMT

Two days ago, a new vulnerability was found in WebDav for IIS, although few have make a big deal out of it, personally I think the impact is 'quite' minimum or at least zero in my environment coz I got no WebDav at all :) LOL... anyway - here...(read more)

How to Detect, Identify and Defend against SQL Injection?

qbernard — Wed, 25 Jun 2008 12:40:00 GMT

SQL Injection has been around for many years :) and you probably get over 3 million results when you googled the term. so why is it so HOT now? Well, not so long ago some folks (don't ask me who!!, go read) were claiming that it was an IIS exploit, etc. Hence, all IIS web servers are subjected to this exploit, but the fact is that it has nothing to do with IIS, it is Web application related, so if you have a web/database application that running on Apache or even IBM Websphere, etc, you are subjected to the attack as well when user inputs are not properly validated. In short, the attack uses these input as the command window/line to issue specify command to the database that "not suppose" to happen via the application interface. For example, user can easily manipulate the database scheme and data, or user can even gain further access via the database system to the actual operating system level access.

Anyway, Microsoft just released a security advisory on how to detect via a free scanner from HP, how to protect at IIS level via URLSCAN 3.0 :) take note that this is still beta and how to identify it at coding level via Microsoft Source Code Analyzer for SQL Injection, take note this analyzer only works for ASP.

While the above is useful and helpful, you probably want to educate your developers on secure coding by implementing proper input validation before the input is process by the web or database system. The advisory contains a lot more information about the attack technique, best practices and more. So make sure you forward the details to your developers!!!

Improving Web Service Security: WCF

qbernard — Wed, 11 Jun 2008 10:19:00 GMT

The Microsoft Patterns & Practices team just published a beta copy of Improving Web Service Security for WCF or code name Indigo last week. This is another great playbook from the team that gives us many great guides and practices in using Microsoft technologies. If you are into Indigo, this is a must read :)

Here's the chapter outlines:
Chapter 01 - Security Fundamentals for Web Services
Chapter 02 - Threats and Countermeasures for Web Services
Chapter 03 - Security Design Guidelines for Web Services
Chapter 04 - WCF Security Fundamentals
Chapter 05 - Authentication, Authorization and Identities in WCF
Chapter 06 - Impersonation and Delegation in WCF
Chapter 07 - Message and Transport Security in WCF
Chapter 08 - WCF Bindings Fundamentals
Chapter 09 - Intranet – Web to Remote WCF Using Transport Security (Original Caller, TCP)
Chapter 10 - Intranet – Web to Remote WCF Using Transport Security (Trusted Subsystem,HTTP)
Chapter 11 - Intranet – Web to Remote WCF Using Transport Security (Trusted Subsystem TCP)
Chapter 12 - Intranet – Windows Forms to Remote WCF Using Transport Security (Original Caller, TCP)
Chapter 13 - Internet – WCF and ASMX Client to Remote WCF Using Transport Security (Trusted Subsystem, HTTP)
Chapter 14 - Internet – Web to Remote WCF Using Transport Security (Trusted Subsystem, TCP)
Chapter 15 - Internet – Windows Forms Client to Remote WCF Using Message Security (Original Caller, HTTP)

Don't forget to check out more publications at the project directory (tag = patterns & practices) of the site for more practices and guildlines written by Microsoft and external experts from time to time.

IIS 7 Shared Hosting Summary

qbernard — Wed, 14 May 2008 08:47:00 GMT

Damn! I love this blog post from Thomas, and you can easily noticed that IIS team has put lot of effort in shared hosting environment, from shared to delegated configuration, and all the way to process model improvements. The dynamicIdleThreshold for example is a fantastic feature for shared hosting, at first I got confused (while working on the IIS 7.0 Reskit Book) with the formula implementation, then Bill hooked me up with Fabio - the main guy behind the logic to give me the full picture about the idea/logic/formula about it. It actually took me a while to understand :) LOL, getting old...

Anyway, another related feature is called Process Gating, well this is not new and was actually in IIS 6.0, but not many know about it. Process gating grants you the ability to specify the maximum worker processes that allow to run concurrently in a machine, this prevent that too many worker processess running and eventually slow down / kill the entire server especially in high density hosting setup. Similar to number of web sites a particular box can support, you need to perform stress testing and trend analysis to understand the usage model,etc before deciding on the reasonable numbers of worker processes to limit and prevent too many worker processess choking the server.

How it works....
Similar to IIS 6.0, IIS 7.0 always performs a demand start for Web application, worker processes only invokes by Windows Process Activation Service (WAS) when the application pool receives the first incoming request. Before WAS initializes the new worker process, it first checks the total number of current running worker processes. If the total amount of worker processes (current + new one) is more than the maximum worker processes allowed, then the new worker process is not started and IIS keeps the request in the queue and wait until the number of worker processes drop below the limit and starts the new worker process.

How to configure....
There is no user interface to enable demandStartThreshold in RTM releases. But with the IIS 7.0 Admin Pack, I think it should be listed as one config item in the new configuration editor, my Vista box is not with me now, so can't verify this. Anyway, you can always configure this via AppCmd.exe. For example, to limit a total of 100 worker processes for a particular IIS 7.0 web server, try

appcmd set config /section:webLimits /demandStartThreshold:100

Upon successfully executing the command syntax, you will see the output shown as below.
Applied configuration changes to section "system.applicationHost/webLimits" for "MACHINE/WEBROOT/APPHOST" at configuration commit path "MACHINE/WEBROOT/APPHOST"

When WAS detects that it hits the demandStartThreshold limit, it writes a warning entry into the System event log. Take note that by default, process gating feature is not enabled, in the sense that the default total number of worker processes allowed is 2147483647 processes, which technically equivalent to no limit.

IIS FTP PassivePortRange

qbernard — Wed, 14 May 2008 08:33:00 GMT

Years ago, I wrote the KB on passive port range at MSKB site -
How To Configure PassivePortRange In IIS
http://support.microsoft.com/?id=555022

Lazy to update the article for IIS 7.0 FTP detail, and I'm not going to add that here :)
Coz you can get it from Microsoft Support Team -
http://blogs.msdn.com/webtopics/archive/2008/05/14/limiting-passive-ftp-port-range-on-iis-7-0-iis-6-0-iis-5-0.aspx

One thing I recalled during testing in the past is that port range only valid from 5001 to 65535.

Security Alerts - March 2008

qbernard — Thu, 13 Mar 2008 02:23:00 GMT

In this month security bulletin, although all critical fixes are related to MS Office, one of the bulletin is related to Office Web Component and hence if you utilizing OWC in your web application, you need to apply the patch asap. Details:

Vulnerabilities in Microsoft Office Web Components Could Allow Remote Code Execution (933103)
http://support.microsoft.com/?id=933103

Affected software: Office2k (SP3), OfficeXP (SP3), VS.NET 2k2 (SP1), VS.NET 2k3 (SP1)
server: Biztalk 2k + 2k2, Commerce 2k, ISA 2k (SP1)

Take note that Office2k3 SP2/SP3 are not affected.

IIS 7 Released !!!!

qbernard — Thu, 28 Feb 2008 07:32:00 GMT

It is official now :) lazy to type.... head over to Bill Staples blog post for more info :)
Together with many great stuff from IIS team, including the new FTP component, FPSE, and Web Playlist :) (errr.. related to media server if you are in to media streaming)

Last but not least..... the IIS 7 Resource Kit book, well - this one still with the printing company :) should be at your major book store next month. I have the opportunity to write along with many IIS Gurus including Brett Hill, Mike Volodarsky and lot more. Be sure you get a copy asap!.

Security Alerts - February 2008

qbernard — Wed, 13 Feb 2008 02:34:00 GMT

In this month security bulletin, there are two important bulletins related to IIS, depend on your environment setup, though it is rated as important, you might want to patch it asap. Here's the bulletin details.

Vulnerability in Internet Information Services Could Allow Elevation of Privilege (942831)
http://www.microsoft.com/technet/security/bulletin/ms08-005.mspx

Take note that for 08-005, it affects IIS 5.0, 5.1, 6.0 and even 7.0 :) (except if you got Vista SP1 or W2k8 RTM), per the bulletin article, IIS 6.0 the vulnerability point is via MSFTPSVC and NNTPSVC.

Vulnerability in Internet Information Services Could Allow Remote Code Execution (942830)
http://www.microsoft.com/technet/security/bulletin/ms08-006.mspx

For 08-006, affected IIS version include IIS 5.1 and 6.0. IIS 5.0 running on W2k SP4 is not affected, same apply to Vista and W2k8. The exploit works via on ASP component.

It is worth mention that, together with two bulletins - IIS 6.0 patches/fixes are still relatively low :) I mean you can count it with one hand ? 1, 2, 3, 4! I lost track a bit as this doesn't happen from time to time so not sure when is the last one. Anyway, per search result. IIS 6.0 related - we got 4. The two above + MS06-034 and MS04-030.

There's no critical bulletin for IIS 6.0 up to date and per information from Microsoft, the latest two vulnerabilities are discovered in-house, and not by the bad guys out there.

IIS Admin Blog - Paul Lynch

qbernard — Sat, 08 Sep 2007 14:22:00 GMT

Paul is one of the IIS MVP that used to take care of IIS-Resources.com with me. IIS-Resources.com has been down, while I still have not heard any news from Jeffery (the owner), I certainly hope he is doing well, I mean for those that are close to Jeffery, you should know he was having some pretty bad health issue, in and out of hospital many times. Unfortunately I lost his mobile number, hence no way to reach him now.

Anyway, been busy as usual :) This post is just to update you that Paul has started to blog about his experience with IIS.... ya he is one of the few IIS guys that loves PHP + MySQL which I'm a totally noob for those two techs.

TechNet Events - IIS 7.0

qbernard — Wed, 29 Aug 2007 07:51:00 GMT

If you can't wait till next month for the IIS 7.0 Webcasts series, you can watch the TechNet briefing which covers the same topics :) Of coz, these are recorded demos, you can't ask questions realtime compare to live webcasts. Here's the list of technet briefings available.

ADD-120: End-to-End Overview of Microsoft's New Web Application Server IIS7
ADD-121: Getting the Most Out of New Delegation and Configuration Capabilities with IIS 7
ADD-122: An In-Depth Look into Web Application Administration with IIS 7
ADD-123: IIS 7: Under the Hood for Web Request Tracing and Diagnostics
ADD-124: Building Custom IIS7 Web Server Extensions

Oh ya, you can download the videos in either ZUNE, WMA or MP3 format

Website Property page mapping between IIS 6 and IIS 7.

qbernard — Sun, 12 Aug 2007 05:36:00 GMT

Ever wonder where to configure HTTP KEEP-ALIVE in IIS 7.0, or where to configure detail error message to be sent from ASP scripting engine. When I started to learn about the new IIS 7.0 IIS Manager, I always get frustrated coz it is quite different from the normal 'right mouse - property' configuration theme in IIS 6. But now, after I get used to the new interface, when I go back to my IIS 6 box, I got lost again :)

So how much different in term of IIS UI between the two versions? I took a few minutes to do a quick mapping from IIS 6 website property page to the new IIS 7.0 IIS Manager:

Task	IIS 6.0	IIS 7.0
IP Bindings and port	Web site – Properties – Web site tab	Actions pane - Bindings
Connection timeout	Web site – Properties – Web site tab	Actions pane - Limits
HTTP Keep-Alive	Web site – Properties – Web site tab	Features View pane – HTTP Response Header – Set Common Headers
Logging	Web site – Properties – Web site tab	Features View pane – Logging
Bandwidth Throttling and Connection limits	Web site – Properties – Performance tab	Actions pane - Limits
ISAPI Filters	Web site – Properties – ISAPI Filters tab	Features View pane – ISAPI Filters
Home Directory	Web site – Properties – Home Directory tab	Actions pane – Basic Settings / Advanced Settings
UNC Resource	Web site – Properties – Home Directory tab	Actions pane – Basic Settings / Advanced Settings
Redirection	Web site – Properties – Home Directory tab	Features View pane – HTTP Redirect
IIS Permissions – Scripts source access, Read, Write, Directory Browsing, Log Visits, Index this resource	Web site – Properties – Home Directory tab	Scripts source access: Feature depreciated.
		Read, Write: NTFS permissions and Features View pane – Authorization Rules
		Directory Browsing: Features View pane – Directory Browsing
		Log Visits: Features View pane - Logging
Application Name	Web site – Properties – Home Directory tab	Features View pane – View Applications
Execute Permissions (None, Scripts Only, Scripts and Executable)	Web site – Properties – Home Directory tab	Features View pane – Handler Mappings – Edit Handler Permissions
Application Pool	Web site – Properties – Home Directory tab	Actions pane – Basic Settings / Advanced Settings
Application Extensions Mapping	Web site – Properties – Home Directory tab – Configuration – Mapping tab	Features View pane – Handler Mappings
ASP Configuration (session timeout, buffering, parent paths)	Web site – Properties – Home Directory tab – Configuration – Options tab	Session timeout: Features View pane – ASP – Sessions Properties
		Buffering and Parent Paths: Features View pane – ASP - Behavior
ASP Debugging Flags (server-side and client side debugging, error message handling.	Web site – Properties – Home Directory tab – Configuration – Debugging tab	Features View pane – ASP – Debugging Properties
Default documents	Web site – Properties – Documents tab	Features View pane – Default Document
Document footer	Web site – Properties – Documents tab	Feature depreciated from UI. Configure via AppCmd.exe instead. For example - appcmd set config “Fabrikam HR” /sections:staticContent /enableDocFooter:true /defaultDocFooter:”d:\foot.html” /isDocFooterFileName:true to configure document footer.
Authentication	Web site – Properties – Directory Security tab	Features View pane – Authentication
IP address and domain name restriction	Web site – Properties – Directory Security tab	Features View pane – IPv4 Address and Domain Restrictions
Secure Communication (SSL)	Web site – Properties – Directory Security tab	Features View pane – SSL Settings
HTTP Headers (content expiration, HTTP Headers, content rating, MIME Types	Web site – Properties – HTTP Headers tab	Content expiration and HTTP Headers: Features View pane – HTTP Response Headers
		Content Rating: Feature depreciated from UI, However, you can try to configure the P3P policy via AppCmd.exe
		MIME Types: Features View pane – MIME Types
Custom Errors	Web site – Properties – Custom Errors tab	Features View pane – Error Pages

Netcraft: IIS is picking up...

qbernard — Wed, 11 Jul 2007 03:21:00 GMT

According to Netcraft Web Server Survey, Microsoft IIS web server continue to gains more market shares for the past three months. In July, up to date with 1.01% improvements, while 0.34% and 0.36% gained in previous two months :)

With the latest figures, IIS is now at 33% while Apache is still leading at 53%, and the rest go other players. I'm expecting more and more IIS deployment in IIS 6, as well as IIS 7 with W2k8 when it debuts.

Beta 3 - IIS 7

qbernard — Thu, 26 Apr 2007 09:44:00 GMT

Yes! the moment is here! The real IIS 7 is out! I mean the one with all the promising features. New FTPS, Shared configuration, Web Manager, etc. Zzzz.. but I'm traveling now :( why pick the date when I'm not with my test machine! Anyway, wait no more, this beta 3 will also grant you the Go Live! license for production deployment. There's also ton of new/updated articles at IIS.net - the official site for IIS7 community, but that's not all !! don't forget to visit the forum section, where you will have direct forum support from IIS developers, PMs and all the way to Lead PM.

How To Install WordPress on IIS 6.0

qbernard — Wed, 25 Apr 2007 03:19:00 GMT

Meant to post weeks ago :) but been very busy. Will be traveling again for the next three weeks.
Anyway, You have to check out the latest article from Paul Lynch over at IIS-Resources.com - Installing WordPress on IIS 6. Among other writeup including getting PHP and MYSQL on IIS 6 as well.

AppcmdUI for IIS 7

qbernard — Sun, 15 Apr 2007 04:38:00 GMT

OMG, Ksingla @ forums.iis.net is either crazy or lazy :) he just released an UI tool for appcmd.exe, which provides autocomplete + sort of intellisense features. Well I'm not sure about you, I'm a lazy person and hate to do /? or try to guess what's the section config name I try to configure. Check out this lovely tool here.

What's not supported in IIS 7

qbernard — Fri, 02 Mar 2007 07:18:00 GMT

Gong Xi Fa Cai :) to those celebrating Chinese New Year. As usual, been busy, will be traveling again next week. Just read this from iis.net. While IIS 7 offers is completely redesign and offers many cool features, please be aware that the following features NO longer support/exist in IIS7:

a) IIS 6 URL Authorization - Never configure before :p, do you use this?
b) FPSE Support - Bad news for those that use this for web publising, I don't really like it. I'm happy with Ftp.
c) WebDav - Ouch...not on Vista, but you should see add-on support for Longhorn
d) NNTP - Errr... traditionaly not with client OS, but I do use it for IIS 6 for internal newsgroups, etc. Longhorn will not support this as well :(
e) Digest Auth - This will now required W2k3 or Longhorn domain controller, W2k not supported
f) Sub-authentication - They have finally clear this out, no more sub-auth support for IIS 7.
g) Content Rating - Hehehe... again. so far I only see one posting out of many years for this feature.
i) Passport Auth - Another feature that I don't think many uses, do you ?
j) IIS Users recreation - This focus on iwam/iusr _computername account. This changed in IIS7, you will see iusr built-in account instead.
k) VBS scripts - all iis*.vbs is gone, and adsutil.vbs is there but very limited since IIS7 no longer store config in metabase.
l) Pause Website - Mm.. I don't get this. The article claimed there's another way to do this. So it is still pausing the website, right?

To get more detail and other changes, read this article.