Sukesh's IIS Blog : IIS7

How to configure SSL on IIS7 under Windows 2008 Server Core

sukesh — Wed, 21 May 2008 06:16:00 GMT

Due to the popularity of Windows 2008 Server Core I have seen frequently questions about how to configure SSL on IIS7 with only command-line. Since I wandered that path few months back I thought of putting this article/guide together.

http://www.awesomeideas.net/post/2008/05/18/How-to-configure-SSL-on-IIS7-under-Windows-2008-Server-Core.aspx

IIS7 Mobile Admin now on codeplex !!!

sukesh — Thu, 20 Mar 2008 09:35:00 GMT

IIS7 Mobile Admin is a simple web application to administer IIS7 remotely using a mobile phone browser. I provided few screenshots of IIS7 Mobile Admin in my previous blog post here http://www.awesomeideas.net/post/2008/03/04/IIS7-Mobile-Admin.aspx

And I promised to get it on codeplex for your download pleasure and finally it's ready and available

Project Home (Screenshots,FAQ) - http://www.awesomeideas.net/page/IIS7-Mobile-Admin.aspx
Download & Discussion - http://www.codeplex.com/iis7mobileadmin/

What are the features available in this release (called R1)?
Search Application Pools & Web Sites

Application Pool
- Show Requests (Top 10 requests sort in descending order of 'Time Elapsed'
- Show Applications
- Recycle Application Pool
- TODO:Your wishes...
Web Sites
- Show Configuration (Show all bindings for the website)
- Start Website
- Stop Website
- TODO:Your wishes

Get more screenshots on Project Home http://www.awesomeideas.net/page/IIS7-Mobile-Admin.aspx

IIS7 Mobile Admin

sukesh — Thu, 06 Mar 2008 08:37:00 GMT

I wanted to introduce something I’ve been working during last couple of weekends. Yes you guessed it “IIS7 Mobile Admin” to show some love to our web server administrators who keeps our Web 2.0 world up and running!

Ingredients

IIS7 Hosted Web core Service (which I wrote in C++, just like WMSVC IIS Management Service)
http://www.awesomeideas.net/page/IIS7-Hostable-WebCore.aspx
ASP.NET website specifically designed for use on browser of a cell phone using LINQ + IIS7 managed API (Microsoft.Web.Administration)

I would like to know what are some of the “must have” features you expect from this application.
(Keep in mind this is not developed to replace or even be on par with desktop IIS7 manager)

Please add your suggestions/comments/ideas under the following blog post and check out more screenshots.
http://www.awesomeideas.net/post/2008/03/04/IIS7-Mobile-Admin.aspx

Plan is to get this complete package (both binary & source) on http://www.codeplex.com by next weekend!
Picture is worth a “how many words do they say?” so a picture below showing how it looks when it runs inside Pocket IE in full-screen.

Differences in SSL request/response flow on IIS6 vs IIS7 (Kernel mode SSL)

sukesh — Mon, 26 Nov 2007 12:08:00 GMT

There are so many things which has changed in IIS7 for the better and one of them is about the way SSL works. Although IIS6 allowed kernel mode SSL (starting with Windows 2003 SP1) that wasn't the default option. As far as I know (AFAIK) not many customers used it or knew about it.

Starting with IIS7 kernel mode SSL is going to be the default setting and the only setting. This was primarily for performance reasons. So let us see how it differs.

IIS6 SSL request/response flow

1. Request
2. HTTP.SYS
3. HTTPFilter
4. HTTP.SYS
5. Worker process
6. HTTP.SYS
7. HTTPFilter
8. HTTP.SYS
9. Response

(Encrypted Request from client)
(Kernel Mode driver for HTTP accepts the request)
(Sent to user mode service to decrypt)
(Decrypted request comes back)
(Sent decrypted request to W3Wp => IIS)
(Response comes back from IIS)
(Sent again to user mode to encrypt response)
(Encrypted response arrives from user mode)
(Encrypted response sent back to client)

IIS7 SSL request/response flow

1. Request
2. HTTP.SYS
3. Worker process
4. HTTP.SYS
5. Response

(Encrypted Request from client)
(Kernel Mode driver for HTTP accepts and decrypts using SChannel)
(Sent decrypted request to W3Wp => IIS)
(Response from IIS is encrypted using SChannel)
(Encrypted Response sent back to client)

You know that context switching between kernel mode and user mode is expensive and this new design of how SSL processing is done inside kernel mode increases performance on IIS7.

IIS7 Rocks!!!

Redirecting from http to https in IIS7 (http2https Updated)

sukesh — Wed, 05 Sep 2007 07:07:00 GMT

I had written a sample to redirect all http traffic to https (secure) in September 2006 http://www.awesomeideas.net/post/2006/09/03/Redirecting-from-http-to-https-in-IIS7.aspx

In one of our internal discussion alias the question came up that this method does not work when SSL is forced on the website. Step 5 below handles that scenario by checking the "403.4 SSL required" response and handling it during OnEndRequest event.

So let us get into action (I'm using C# for this sample)

Download and Install IIS7 Managed Module Starter Kit
(Not really a requirement but it would make developing IIS7 modules easier)
Rename the default class name created to "redir.cs" and rename project/solution/namespace to "http2https"

Add the following code in "Init" method

// register for the BeginRequest event
application.BeginRequest += new EventHandler(OnBeginRequest); 
application.EndRequest += new EventHandler(OnEndRequest);

Add the following method to implement "BeginRequest" event

//BeginRequest implementation
public void OnBeginRequest(Object sender, EventArgs e)
{
HttpApplication app = (HttpApplication)sender;
string HttpUrl = app.Request.Url.ToString(); 

   if (HttpUrl.StartsWith("http:"))                           //Redirection done only if URL starts with http:
   {
   HttpUrl = HttpUrl.Replace("http:", "https:");
   app.Response.Redirect(HttpUrl.ToString(), true);           //Redirecting (http 302) to the same URL but with https
   app.Response.End();                                        //We don't want to any further so end
   }
}

Add the following method to implement "OnEndRequest" event

//This is for scenario where SSL is forced on the site
public void OnEndRequest(Object sender, EventArgs e)
{
  HttpApplication app = (HttpApplication)sender;
  if (app.Response.StatusCode == 403 && app.Response.SubStatusCode == 4)
  { 
    string HttpUrl = app.Request.Url.ToString();

    if (HttpUrl.StartsWith("http:"))
    {
        HttpUrl = HttpUrl.Replace("http:", "https:");
        app.Response.Redirect(HttpUrl.ToString(), true);
        app.Response.End();
    }
}

Make sure you have the following in your web.config inside configuration tag

<system.webServer>
<modules>
   <add name="redir" type="http2https.redir" />
</modules>
</system.webServer>

Your http to https redirection sample is ready and also works if you force SSL!!!

How to deploy the HttpModule
There are multiple ways you can deploy this component (I'm assuming that it's being deployed for "default website")

Method 1
Create a folder called "App_Code" inside "%systemdrive%\inetpub\wwwroot"
Copy "redir.cs" file into "App_Code" folder
Copy "web.config" file inside "%systemdrive%\inetpub\wwwroot"

Method 2
Create a folder called "bin" inside "%systemdrive%\inetpub\wwwroot"
Compile "redir.cs" into "redir.dll" and copy it into "bin" folder (to compile -> csc.exe /out:redir.dll /target:library redir.cs)
Copy "web.config" file inside "%systemdrive%\inetpub\wwwroot"

If you open IIS7 UI and go to Modules you can see your HttpModule listed there.

Source code @ http://www.awesomeideas.net/page/IIS7-http2https.aspx

Redirecting from http to https in IIS7

sukesh — Sun, 03 Sep 2006 18:22:00 GMT

I was thinking to write an HttpModule for IIS7 and wanted a simple, useful and easily understandable scenario. Working with IIS customers for last 3 years one of those common scenario came into my mind, Redirecting http traffic to https. Although this is pretty straight forward requirement, till IIS6 it was difficult to achieve. Check the following KB 839357 (specifically for OWA scenario) which explains the cumbersome steps .

(If you are looking for same functionality in prior versions of IIS, find it at the bottom of this post)

HttpModules are not something new if you are an ASP.NET developer. But there are some differences. In IIS7 because of integrated pipeline, HttpModule applies to any request not just ASP.NET and that includes htm,jpg,asp,aspx,asmx,php,jsp...

So let us get into action (I'm using C# for this sample)

Download and Install IIS7 Managed Module Starter Kit
(Not really a requirement but it would make developing IIS7 modules easier)
Rename the default class name created to "redir.cs" and rename project/solution/namespace to "http2https"
Add the following code in "Init" method
// register for the BeginRequest event
application.BeginRequest += new EventHandler(OnBeginRequest);
Add the following method to implement "BeginRequest" event
//BeginRequest implementation
public void OnBeginRequest(Object sender, EventArgs e)
{
HttpApplication app = (HttpApplication)sender;
string HttpUrl = app.Request.Url.ToString();
if (HttpUrl.StartsWith("http:"))                                       //Redirection done only if URL starts with http:
{
   HttpUrl = HttpUrl.Replace("http:", "https:");
   app.Response.Redirect(HttpUrl.ToString(), true);      //Redirecting (http 302) to the same URL but with https
   app.Response.End();                                                   //We don't want to any further so end
}
}
Make sure you have the following in your web.config inside configuration tag
<system.webServer>
<modules>
<add name="redir" type="http2https.redir" />
</modules>
</system.webServer>

Your http to https redirection sample is ready!!!

How to deploy the HttpModule
There are multiple ways you can deploy this component (I'm assuming that it's being deployed for "default website")

Method 1
Create a folder called "App_Code" inside "%systemdrive%\inetpub\wwwroot"
Copy "redir.cs" file into "App_Code" folder
Copy "web.config" file inside "%systemdrive%\inetpub\wwwroot"

If you open IIS7 UI and go to Modules you can see your HttpModule listed there.

Redirection options for prior versions of IIS below (you need to search for these)

- ASP.NET URL mapping capability (HttpContext.RewritePath)
- IIS v6.0 Resource Kit includes the UrlRemap tool
- IISRewrite
- ISAPI_Rewrite - includes a "lite" version available for free.
- Mod_Rewrite 2
- Ionic's ISAPI Rewrite Filter

ABC's of Appcmd (command line administration in IIS7)

sukesh — Fri, 02 Jun 2006 20:42:00 GMT

So what is Appcmd.exe?

This is "one" command line tool to administer IIS7. In IIS6 several of admin task were done using several scattered VBS script files. This made it difficult to find out what script needs to be run for eg. to get list of worker processes.

So IIS7 is powered with Appcmd.exe which provides all the options you need to administer IIS7.

Following are the options/categories available from a high level

SITE	Administration of virtual sites
APP	Administration of applications
VDIR	Administration of virtual directories
APPPOOL	Administration of application pools
CONFIG	Administration of general configuration sections
WP	Administration of worker processes
REQUEST	Administration of HTTP requests
MODULE	Administration of server modules
BACKUP	Administration of server configuration backups
TRACE	Working with failed request trace logs

Lets see how we can use it with an example

When I installed LH Server Beta (I rebuild my box quite frequently) I wanted to see how it's like to have 1000 websites running on IIS7.

So I created 1000 websites on my box.

Good scenario to use Appcmd.exe and also my MS-DOS experience. No I'm not gone nutts to create it using the UI :)

Steps required

Wanted separate folders for each website
Wanted to use same IP address and port for all websites
Type a command and leave the box to create all the websites

Keep in mind I'm not talking about Server but my desktop machine. Yea its got 2GB RAM though.

Steps below

Created a folder - E:\Websites
I wrote a batch file (createsite.cmd) with the following
MD E:\Websites\Site%1
appcmd add site /name:"Site%1" /id:%1 /bindings:http/:*:80:site%1 /physicalPath:"E:\Websites\Site%1"
appcmd start site "Site%1"
Now the command to trigger the batch file where my MS-DOS experience came handy
C:\FOR /L %i IN (2,1,5) DO createsite.cmd %i

FOR command is a batch file loop which simply works like 'for' loop in your favorite language

FOR /L %i IN (2,1,1000) DO createsite.cmd %i

is equivalent to the following in C

for ( i=2; i <= 1000; i++ )
createsite( i );

I started value of 'i' from 2 because "Default Website" has Site ID 1.

Hit enter and wait till the folders and websites are created for each iteration.

Bingo !!! 1000 websites ready to be administered or tested.

So the result would be
E:\Websites folder would have folders called Site2, Site3 etc... and in IIS there would be sites with name Site2, Site3 etc...

Lets revisit the appcmd command above once again

appcmd add site
/name:"Site%1" // website name
/id:%1 // Site ID
/bindings:http/:*:80:site%1 // site would have "All Unassigned" including host header with the site name
/physicalPath:"E:\Websites\Site%1" // Pointing to the physical folder for that site

appcmd start site "Site%1" // pretty straight forward, it starts the website

What else can I do to extend this scenario?

Create Application Pools separately for each website
Create a simple ASP page and drop it in every folder created
Use TinyGET utility (available with IIS6 Resource Kit) to simulate request

Some other useful command options

Create Backup
C:\>appcmd add backup "backup before screwup"
BACKUP object "backup before screwup" added

List Backup
C:\>appcmd list backup
BACKUP "backup before screwup"

Restore from Backup
C:\>appcmd restore backup "backup before screwup"
Restored configuration from backup "backup before screwup"

Currently Executing Requests
C:\>appcmd list request
REQUEST "fa00000080000487" (url:GET /highcpu.asp, time:1903 msec, client:localhost)

Will add more of this later...

Evolution of HTTP on Windows Platform

sukesh — Fri, 02 Jun 2006 19:58:00 GMT

Before the boom of web and internet, HTTP was not so common is everyday life. When internet became more and more widely used, HTTP also grew in usage.

Basic web server serves static HTML type contents and then was the era in which there came several ways to extend the web server and its features. Because of the popularity of the web, on internet most of the companies connected to the web have port 80 (which is the default HTTP port) open on firewalls. Which simply means that to use HTTP most of the companies didn’t have restrictions and thereby became the default and uninterrupted way of global communication?

HTTP on Windows platform was initially used only by IIS for serving web sites. Gradually because of the simplicity and availability (of open port 80) of HTTP several other applications started using HTTP as a medium of transport. Then came the wave of all HTTP based protocols and having another protocol tunnel through HTTP.

RPC over HTTP (I would call it as “RPC through HTTP” rather) for Exchange and SQL to name a few. SQL started supporting HTTP so that you can expose a database over the web using HTTP and SQL queries can be executed using query string and the results returned as XML. Once, more and more application platforms started using HTTP, it became important that we have a uniform & consistent way on Windows platform to use HTTP protocol. So the kernel mode driver called HTTP.SYS was born. Since it’s a kernel mode driver, it gives us a lot of advantages (mainly on 64bit machines with a huge amount of memory for kernel mode caching and getting higher performance) and creates a layer which gives a consistent way of utilizing HTTP protocol. HTTP.SYS also provides API’s if we need to use HTTP protocol directly and bypass IIS. This route would obviously lack other features provided by IIS like health monitoring, easy management etc… but can be utilized for specific needs.

Next big leap – IIS7

Before we look at some of those upcoming features in IIS7, let us see what we lack till the current version of IIS i.e. IIS6.

· Delegation of administration (very important for website hosting and also for hosting department websites with its own admin)

· Extensibility (A thorough understanding of IIS is required in order to write high performance ISAPI Filters or Extensions)

· You can add features but not replace features

· Managing IIS was not possible when it comes to higher number of websites simply because the MMC style of interface is not efficient.

· Even if you use ASP.NET (handlers or modules) it works at a lower level than ISAPI Filters/Extensions.

· Debugging or tracing (A fair amount of tracing features were introduced in IIS6 and more with SP1 but still we resort to post-mortem dumps for 60% of our cases)

· XCopy deployment of websites.

Now “few” of the highlights from IIS7 features list

· Delegation of administration to granular level (like attribute level) and users can be either from Active Directory / SAM (workgroup) or custom database

· You have managed and unmanaged API's to access IIS or for admin purposes (e.g. showing a list of pages currently running and how much CPU each of them are taking). This is possible in IIS6 with SP1 (Windows 2003 SP1) but with extra tools, but in IIS7 it’s available inside the MMC itself.

· You can search or book mark a website when you have too many sites, for easy administration.

· Now with the new Integrated Pipeline, you can write managed or unmanaged ISAPI

· A lot of tracing functionalities are included e.g. Failed Request Tracing etc... Even specifics like “only requests failed with authentication” etc...

· Since website related details (like default page etc...) are stored inside web.config (not necessarily ASP.NET application) you can deploy sites using XCopy and it simply works.

· You can enable admin service with a different secure port which can be used for administering IIS remotely (http). This is not an admin website like before but a separate service.

· You can replace existing IIS components by replacing the dll name in the application.config file. Example custom logging, custom authentication. This simply means that everything is pluggable and only required features are installed or loaded into the process. For example you don't want "Basic Authentication" you don't even install it. This would reduce attack surface and enables better performance also.

· My favorite feature, you can enable forms authentication with a single page (uses .NET 2.0) for htm / asp / asp.net / php / cgi / images or any application web site.

You can see some managed code snippets of IIS7 Admin API’s from the following link

http://blogs.msdn.com/carlosag/archive/2006/04/17/MicrosoftWebAdministration.aspx

Make sure you see the piece of code titled “Getting list of executing requests” which is my favorite.