Jump to content

Internet Information Services: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
Line 58: Line 58:
# [[Data logging|Logging]] and [[Diagnostic program|Diagnostics]] Modules
# [[Data logging|Logging]] and [[Diagnostic program|Diagnostics]] Modules
# Constructive Processing
# Constructive Processing
Authorization Module Extended Enhancing Nerds

Writing extensions to IIS 7 using [[ISAPI]] has been deprecated in favor of the module [[Application programming interface|API]], which allows modules can plug in anywhere in the request processing pipeline. Much of IIS's own functionality is built on this API, and as such, developers will have much more control over a request process than was possible in prior versions. Modules can be written using C++, or using the IHttpModule interface from a [[.NET Framework]] [[Programming language|language]]. Modules can be loaded globally where the services provided by the module can effect all sites, or loaded on a per-site basis. IIS 7 has an integrated mode application pool where .NET modules are loaded into the pipeline using the module API, rather than ISAPI. As a result [[ASP.NET]] code can be used with all requests to the server.<ref>{{cite web | url = http://weblogs.asp.net/scottgu/archive/2007/04/02/iis-7-0.aspx | title = IIS 7.0 | author = [[Scott Guthrie]] | accessdate = 2007-07-20}}</ref> For applications requiring strict IIS 6.0 compatibility, the Classic application pool mode loads asp.NET as an ISAPI.
Writing extensions to IIS 7 using [[ISAPI]] has been deprecated in favor of the module [[Application programming interface|API]], which allows modules can plug in anywhere in the request processing pipeline. Much of IIS's own functionality is built on this API, and as such, developers will have much more control over a request process than was possible in prior versions. Modules can be written using C++, or using the IHttpModule interface from a [[.NET Framework]] [[Programming language|language]]. Modules can be loaded globally where the services provided by the module can effect all sites, or loaded on a per-site basis. IIS 7 has an integrated mode application pool where .NET modules are loaded into the pipeline using the module API, rather than ISAPI. As a result [[ASP.NET]] code can be used with all requests to the server.<ref>{{cite web | url = http://weblogs.asp.net/scottgu/archive/2007/04/02/iis-7-0.aspx | title = IIS 7.0 | author = [[Scott Guthrie]] | accessdate = 2007-07-20}}</ref> For applications requiring strict IIS 6.0 compatibility, the Classic application pool mode loads asp.NET as an ISAPI.


Revision as of 22:00, 21 February 2008

Internet Information Services
Developer(s)Microsoft
Stable release
7.0
Operating systemMicrosoft Windows
TypeServer
LicenseProprietary
WebsiteMicrosoft Internet Information Services homepage

Microsoft Internet Information Services (IIS, formerly called Internet Information Server) is a set of Internet-based services for servers using Microsoft Windows. It is the world's second most popular web server in terms of overall websites, behind Apache HTTP Server. As of October 2007 it served 37.13% of all websites and 38.23% of all active websites according to Netcraft.[1] The servers currently include FTP, SMTP, NNTP, and HTTP/HTTPS.

Versions

History of IIS

IIS was initially released as an additional set of Internet based services for Windows NT 3.51. IIS 2.0 followed adding support for the Windows NT 4.0 operating system and IIS 3.0 introduced the Active Server Pages dynamic scripting environment.

IIS 4.0 dropped support for the Gopher protocol and was bundled with Windows NT as a separate "Option Pack" CD-ROM.

The current shipping version of IIS is 7.0 for Windows Vista, 6.0 for Windows Server 2003 and IIS 5.1 for Windows XP Professional. Windows XP has a restricted version of IIS 5.1 that supports only 10 simultaneous connections and a single web site.[2] IIS 6.0 added support for IPv6. A FastCGI module is also available for IIS5.1, IIS6[3] and IIS7.[4]

Windows Vista does not install IIS 7.0 by default, but it can be selected among the list of optionally installed components. IIS 7.0 on Vista does not limit the number of connections allowed but restricts performance based on active concurrent requests.

Security

Earlier versions of IIS were hit with a spate of vulnerabilities, chief among them CA-2001-19 which led to the infamous Code Red worm; however, version 7.0 currently has no reported issues that affect it. In perspective, as of 11 September 2007, the free software Apache web server has one unpatched reported issue,[5] affecting only MS Windows systems, and rated "less critical". In IIS 6.0, Microsoft has opted to change the behavior of pre-installed ISAPI handlers,[6] many of which were culprits in the vulnerabilities on 4.0 and 5.0, thus reducing the attack surface of IIS. In addition, IIS 6.0 added a feature called "Web Service Extensions" that prevents IIS from launching any program without explicit permission by an administrator. With the current release, IIS 7.0, the components were modularized, so that only the required components have to be installed, thus further reducing the attack surface. In addition, security features such as URLFiltering were added that rejects suspicious URLs based on a user defined rule set.

In IIS 5.1 and lower, by default all websites were run in-process and under the System account,[7] a default Windows account with elevated rights. Under 6.0 all request handling processes have been brought under a Network Services account which has significantly fewer privileges. In particular this means that if there is an exploit in a feature or custom code, it wouldn't necessarily compromise the entire system given the sandboxed environment the worker processes run in. IIS 6.0 also contained a new kernel HTTP stack (http.sys) with a stricter HTTP request parser and response cache for both static and dynamic content.

Authentication mechanisms

IIS 5.0 and higher support the following authentication mechanisms:

Internet Information Services 7.0

Debuting with Windows Vista, and also to be included in Windows Server 2008, IIS 7.0 features a modular architecture. Instead of a monolithic server which features all services, IIS 7 has a core web server engine. Modules offering specific functionality can be added to the engine to enable its features. The advantage of having this architecture is that only the features required can be enabled and that the functionalities can be extended by using custom modules.

IIS 7 will ship with a handful of modules, but Microsoft will make other modules available online.[8] The following sets of modules are slated to ship with the server:

  1. HTTP Modules
  2. Security Modules
  3. Content Modules
  4. Compression Modules
  5. Caching Modules
  6. Logging and Diagnostics Modules
  7. Constructive Processing

Authorization Module Extended Enhancing Nerds Writing extensions to IIS 7 using ISAPI has been deprecated in favor of the module API, which allows modules can plug in anywhere in the request processing pipeline. Much of IIS's own functionality is built on this API, and as such, developers will have much more control over a request process than was possible in prior versions. Modules can be written using C++, or using the IHttpModule interface from a .NET Framework language. Modules can be loaded globally where the services provided by the module can effect all sites, or loaded on a per-site basis. IIS 7 has an integrated mode application pool where .NET modules are loaded into the pipeline using the module API, rather than ISAPI. As a result ASP.NET code can be used with all requests to the server.[9] For applications requiring strict IIS 6.0 compatibility, the Classic application pool mode loads asp.NET as an ISAPI.

A significant change from previous versions of IIS is that all web server configuration information is stored solely in XML configuration files, instead of in the metabase. The server has a global configuration file that provides defaults, and each virtual web's document root (and any subdirectory thereof) may contain a web.config containing settings that augment or override the defaults. Changes to these files take effect immediately. This marks a significant departure from previous versions whereby web interfaces, or machine administrator access, were required to change simple settings such as default document, active modules and security/authentication. It also eliminates the need to perform metabase synchronization between multiple servers in a farm of web servers.

IIS 7 also features a completely rewritten administration interface that takes advantage of modern MMC features such as task panes and asynchronous operation. Configuration of ASP.NET is more fully integrated into the administrative interface.

Other changes:

  • PICS content ratings, support for Microsoft Passport, and server-side image maps are no longer included.
  • Executing commands via server-side includes is no longer permitted.
  • IISRESET -reboot has been removed.
  • The CONVLOG tool, which converts IIS log files into NCSA format, has been removed.
  • Support for enabling a folder for "Web Sharing" via the Windows Explorer interface has been removed.
  • IIS Media Pack, which allows IIS to be used as a bare-bones media server, without using Windows Media Services.[10]
  • New FTP module, that integrates with the new configuration store, as well as the new management environment.[11]

See also

References

  1. ^ "Netcraft Web Server Survey, October 2007". Retrieved 2007-10-12.
  2. ^ "Internet Information Services 5.1". Retrieved 2007-07-20.
  3. ^ "FastCGI Extension for IIS6.0 and IIS5.1 - Go Live". Retrieved 2007-09-27.
  4. ^ "FastCGI for IIS7". Retrieved 2007-09-27.
  5. ^ "Apache 2.2.x - Vulnerability Report - Secunia". Retrieved 2007-08-06.
  6. ^ "IIS Installs in a Locked-Down Mode (IIS 6.0)". MSDN. Retrieved 2007-07-20.
  7. ^ "HOW TO: Run Applications Not in the Context of the System Account in IIS#Default Installation". Retrieved 2007-07-20.
  8. ^ "IIS DownloadCenter". Retrieved 2007-09-27.
  9. ^ Scott Guthrie. "IIS 7.0". Retrieved 2007-07-20.
  10. ^ "Introducing new features for delivering digital media with IIS7". Retrieved 2007-09-27.
  11. ^ "Microsoft FTP Publishing Service for IIS 7.0". Retrieved 2007-09-27.
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Internet_Information_Services&oldid=193129373"