Tobin Titus Blog : IIS 7

IIS Security – Past and Present

TobinTitus — Tue, 28 Apr 2009 08:24:00 GMT

This topic has been covered many times both by Microsoft and non-Microsoft employees. However, I’ve recently been asked what the main features of IIS 7 are and have seen a great deal of misinformation about IIS security on twitter, blog posts and forums.

I think, therefore, the issue deserves yet another look. In this post, I’m going to go over security in the past for IIS and then move on to talk about security features in IIS 7. These are not in any particular order. This post is not meant to diminish the many thoughtful works already created by others – both complimentary and critical. This is just meant to bring the subject back up for discussion again in hopes that you can be properly equipped with the decision making information you may need.

Ghosts of IIS Security Past

The reason for so much misinformation about the current state of security in IIS is likely due to the earned reputation the product had in versions previous to IIS 6.0. A quick search on the web for IIS 5 security vulnerabilities may be like a walk down memory lane for some of the more veteran administrators and IT staff across the globe. The search results are littered with critical vulnerabilities related to buffer overflows, ISAPI extensions, exploits on rarely-used features, or features that were available by a default installation. We are haunted by names like “Code Red” and “Nimda”. I don’t know about you, but those very names send shivers down my spine. I was consulting as a developer and web administrator for a very large property management company when these hit. We were lucky enough to avoid these as we had patched our services. That said, many whom I did business with on a regular basis were not very happy. So, to be clear, I feel the misinformation that is spread today is built on an element of experience with previous versions. Secunia reports 16 advisories and 6 vulnerabilities with IIS 5. And so started the reputation , perhaps deservedly so, that IIS was not secure unless you really knew what you were doing with security.

Bill Gates was apparently visited by the ghosts of security past, present and future when he laid his head on his pillow January 14th, 2002. I say that because on January 15th, 2002 Mr. Gates sent out the now-famous trustworthy computing memo to every employee at Microsoft. This set off a major revamp of products from the ground up. Standards were set for test planning and testing. Writing Secure Code was mandatory reading for every Microsoft developer and tester. The results have been staggering.

Security drastically improved in Microsoft products over the years, and IIS was definitely no exception to this. IIS 6 saw 5 security advisories and 4 vulnerabilities reported since 2003. Not to get ahead of myself, but IIS 7 has exactly 1 advisor and 1 vulnerability from Secunia. Compare this against Apache 2.0.x which has had 39 advisories and 23 vulnerabilities (4 of which are still unpatched as of this writing) and Apache 2.2.x which has had 10 advisories and 16 vulnerabilities (2 of which are still unpatched as of this writing) in the same period. Now I have seen attempts ([1], [2]) to quantify or otherwise explain these numbers further. You can read those articles for yourself and determine how much weight you want to give them. However you skew it, the facts should speak for themselves – IIS has dramatically improved and taken a leadership roll in security in IIS 6 and 7. Our ghost of IIS past still haunts the product’s reputation today, despite obvious strides taken. Even if you feel you like Apache better I think it is only fair to give credit where it is due.

Improvements in IIS 6

The IIS team took the four tenants of Microsoft’s Trustworthy Computing initiative to heart: Secure by Design, Secure by Default, Secure in Deployment and Secure Communication. Since we are already on the next version, I won’t spend a great deal of time talking about the security improvements in the last version other than a brief overview so you know how they relate to changes in our current version, IIS 7.

IIS 6 took vast strides to improve security. During upgrade installations, IIS 6 was disabled by default if the previous server had not been secured by the IIS lockdown tool. The architecture was completely revamped to separate kernel-mode HTTP listening from user-mode application execution. Changes were made to application pools, authentication, access control, encryption and certificate handling, auditing, logging and patch management that made the product far superior to its predecessors. You can find a detailed list of these features on TechNet. SecurityFocus did a comparison of these features in March of 2004.Server Watch wrote an article in December of 2003. By most accounts, everything accomplished in IIS 6 was a huge step in the right direction.

Despite the massive steps already taken in IIS6, IIS 7 took these all a bit further. Let’s go ahead and investigate these now.

Improvements in IIS 7.x

Customizable Installation

Continuing with the tenant of being secure in deployment, IIS 7 has made installation a wonder to behold. In IIS 6, you could reduce your attack surface by disabling features native to web server. However, these features were still loaded into the process. This carried not only a security factor, but also a performance and memory footprint issue. IIS 7 has a completely modular architecture. That means that features which you do not want are not only NOT loaded into the process, you can leave the bits for those features off of your disk completely.

Limitable Attack Surface

This is a bit dubious and is essentially part of the customizable installation. By reducing the modules that are available on disk or loaded into a process, you significantly reduce the attack surface for your specialized web servers. If all you intend to do is serve static content with caching and no default documents, you can simply install the static file handler and caching module and leave the rest of the IIS modules off of your server. Additional controls and limitations will also reduce your attack surface and I’ll cover those below.

IUSR account

Anyone who has tried to migrate an IIS installation from one machine to another or attempted to recover your installation on a new machine, previous to IIS 7, has likely run into an issue with the local “IUSR_<machine_name>” account. IIS 7 now uses a built-in IUSR account that allows you to easily copy your security settings from one machine to the next. This is great news for those using distributed configuration in web farms, recovery, restoration, or replication.

IIS_IUSRS group

IIS 6 introduced the IIS_WPG group. Application pool security identities had to be assigned to this group in order to host the w3wp.exe process. Like the IUSR account, IIS 7 now creates a built-in security group (IIS_IUSRS) and assigns application pool identities to the group automatically. You can find more information about the built-in user and built-in group for IIS 7 on IIS.NET (Understanding the Built-In User and Group Accounts in IIS 7.0).

ASP.NET / IIS Unified Security Architecture

Previous versions of IIS did not provide a unified approach to security with ASP.NET. The IIS 7 unified request pipeline that supports both Windows and non-Windows principals and provides one place to do all authentication and authorization. Apart from simplification and performance improvements, this also reduces the attack surface and allows for greater flexibility in authentication / authorization scenarios with custom modules.

Request Filtering / URL Rewriting

IIS 7.0 includes a request filtering module that is based on the URLScan ISAPI Filter for IIS 6.0. The module helps you tighten security of your Web servers.

The IIS team has also released an add-on URL rewrite module for IIS 7.0, which provides functionality for rule-based URL manipulation. Even though the primary purpose of the URL rewrite module is to rewrite URL paths for requests, the rewrite module can also be used as a security enforcement tool that helps prevent access to Web site content.

Application Pool Identities

On top of Application Pool Isolation, IIS introduces a new security feature in Service Pack 2 of Windows Server 2008 and Windows Vista. It's called Application Pool Identities. Application Pool Identities allows you to run Application Pools under an unique account without having to create and manage domain or local accounts. The name of the Application Pool account corresponds to the name of the Application Pool.

Kernel mode SSL

The implementation of SSL has changed from IIS 6.0 to IIS 7.0. On Windows Server 2003, all SSL configuration was stored in the IIS metabase and encryption/decryption happened in user mode (required a lot of kernel/user mode transitions). On Windows Vista and Windows Server® 2008, HTTP.sys handles SSL encryption/decryption in kernel mode, resulting in up to 20% better performance for secure connections.

Configuration Improvements

IIS 7.0 allows locking and unlocking configuration settings in various levels and scopes. Locking down configuration means that it cannot be overridden (or set at all) at lower levels in the hierarchy. Unlocking configuration can only be done at the level where it was locked. This is useful, for example, when creating different configuration for different sites or paths, and only some of sites and paths are allowed to override it. Locking can be done at the section level or for specific elements, attributes, collection elements and collection directives within sections.

Dynamic IP Restriction

IIS 7 provides a new module that allows dynamic, temporary IP address restriction. This module prevents brute force attacks and HTTP clients that make unusually high number of concurrent requests or a large number of requests over a short period of time.

Summary

A verbose list of security features in IIS 6 and IIS 7 might be nearly impossible. Apart from the obvious features, there were numerous improvements to code made over these two versions that make the product far more secure than IIS 5 and earlier. That said, this should give you a summary start on information. I’ve listed some reference documents that may help you understand these features better. In general, I would encourage you to ask questions of the product team and or other users on the IIS.NET forums if you hear something that sounds negative regarding IIS. If the feedback is true, the product team has the benefit of improving the next release. If the feedback is unfounded, the product team has the benefit of helping you find the information you need to make an informed decision.

Installing CakePHP on IIS 7

TobinTitus — Fri, 03 Apr 2009 14:15:00 GMT

Recently I spoke with someone on Twitter who was having issues running CakePHP on IIS. With all the talk about ASP.NET MVC on IIS, folks forget that the MVC pattern works in other languages as well. CakePHP provides MVC development on PHP. That said, I wanted to dive in and see what the issues were involved in getting this project up and running on IIS 7. I managed to get it installed pretty quickly, but it does take a little tweaking to get you up and running. I've chronicled my adventures with CakePHP below in case anyone else is having issues. That said, I must first say that I am not an expert working with CakePHP. This was my first experience with the project, so this information is provided "as-is" and should be taken with a grain of salt. With this demo, I’ll be walking through the "Cake Blog Tutorial” offered on cakephp.org, and modifying it as needed to work with IIS 7. That said, let's get started.

Prerequisites

Install: IIS 7 on Windows 2008 Server or Windows Vista
- Install: PHP for IIS 7.0. Use the Web Platform Installer for easiest experience.
- Install: URL Rewriter module. Use the Web Platform Installer for easiest experience.
Install: A database supported by CakePHP. This post uses MySQL.
Download: CakePHP source code
- Unzip: CakePHP (entire contents) to the intended path

Yes, there ARE a lot of Prerequisites, but these are pretty typical for any MVC app on any platform.

Assumptions / Conventions

For the purposes of this post, I will use the convention/assumption that you have unzipped CakePHP to c:\inetpub\CakePHP\ . You should have the following paths now:

c:\inetpub\CakePHP\
- \app
- \cake
- \vendors
- .htaccess
- index.php
- version.txt

I will also use the assumption that this is being installed on the "Default Web Site". This is unlikely what you are doing, so you'll want to replace the "Default Web Site" instances in the steps below with your site or application path.

Lastly, I will assume that you are using and have already installed MySQL. You may use another database if you please, but this blog will reference MySQL.

Installing the Blog Sample

Pointing IIS to the cake document root

First, you'll need to configure your website to point to the correct location. Using the assumptions above, the correct location would be c:\inetpub\CakePHP\app\webroot\ .

Creating a Blog Database

Second, configure your database connection. To do this, you’ll need to create a blog database, and then point your configuration to that new catalog.

Start by creating a new MySQL Catalog using your favorite tool. I used MySQL Administrator. Simply right click in the catalogs and click “create new schema.”

Create a schema named “CakeBlog”. Once the schema is created, click on the “Tools” menu and select “MySQL Query Browser” and execute the following script:

/* First, create our posts table: */
CREATE TABLE posts (
    id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
    title VARCHAR(50),
    body TEXT,
    created DATETIME DEFAULT NOT NULL,
    modified DATETIME DEFAULT NOT NULL8.);

/* Then insert some posts for testing: */
INSERT INTO posts (title,body,created)
    VALUES ('The title', 'This is the post body.', NOW());
INSERT INTO posts (title,body,created)
    VALUES ('A title once again', 'And the post body follows.', NOW());
INSERT INTO posts (title,body,created)
    VALUES ('Title strikes back', 'This is really exciting! Not.', NOW());

* This SQL code copied verbatim from tutorial found here:

http://book.cakephp.org/view/326/The-Cake-Blog-Tutorial

You’ve now created your database and a blog posts table with some default posts. Time to configure CakePHP to read from the database:

Cake Database Configuration

We’ll need to let CakePHP know where the database is. Copy database.php.default in c:\inetpub\CakePHP\app\config\ to database.php

Open c:\inetpub\cakephp\app\config\database.php and change the $default variable to point to your database:
var $default = array('driver'       => 'mysql',
                                'connect'   => 'mysql_connect',
                                'host'         => 'localhost',
                                'login'        => 'CakeBlog',
                                'password' => 'c4ke-1z-k00l',
                                'database' => 'CakeBlog',
                                'prefix'      => '');

* This PHP code copied nearly verbatim from tutorial found here:

http://book.cakephp.org/view/326/The-Cake-Blog-Tutorial

You should not be able to open your browser to your application and see the default cake configuration page.

Setting up Rewriting Rules

CakePHP uses mod_rewrite, but also provides the ability to use Cake’s built-in ‘pretty URLs’. We’ll be importing the mod_rewrite rules from the .htaccess files from the default cakephp installation into the IIS URL Rewrite module. We’ll then have to modify those rules.

Start this process by opening the IIS Management Console. Open your application path. In this instance, we are using “Default Web Site”.

Click on the “Default Web Site”
Open the “URL Rewrite” module
Click on “Import Rules…” in the Actions pane
Click the “…” button next to the “Configuration file” textbox.
Select the c:\inetpub\cakephp\.htaccess file and click “OK”
Click the “Import” button
Click the “Apply” button in the “Actions” pane
Repeat steps 4, 5, 6 and 7 for c:\inetpub\cakephp\app\.htaccess and c:\inetpub\cakephp\app\webroot\.htaccess files.

The rules are imported, but now you’ll need to edit the rules.

Click the “Back to Rules” button in the “Actions” pane
Edit the two rules with the action starting with “webroot/”
Remove the “webroot” portion of the “Rewrite URL”. Your paths should now look as follows:

Creating your MVC Application

The remainder of your application setup should follow the steps found in the original “Cake Blog Tutorial”. There is nothing different between IIS and Apache at this point, so copying the steps would be a bit redundant. Start with the step named “Create a Post Model”. Much like ASP.NET MVC, Cake provides an MVC pattern for developing PHP applications.

Once you have completed the steps, you should have a default site that looks something like the following:

Summary

Installing CakePHP on IIS is actually not much different from installing on Apache. The main difference lies in the implementation of mod_rewrite on Apache vs URL Rewriter in IIS. Obviously the installation of PHP differs from Apache. IIS makes the installation of PHP simple with Web Application Installer. If you are using CakePHP on IIS, I would be interested to hear if your experience was different than mine.

IIS logging UI module sample added to CodePlex

TobinTitus — Fri, 03 Oct 2008 19:21:00 GMT

For those of you that remember that far back, I released a sample that also filled a need for Windows Vista. Since the original version of Windows Vista did not ship with a user interface for managing logging, and we needed samples of how to build UI modules available to the public, I released the Logging UI module. For some time, I've been hosting that downloadable release on my private web site (tobint.com). As I plan to make some major changes to my personal site over the next few months, I wanted to make sure the release was still reliably available. That said, I've now added the source code to CodePlex.

You may find the project at http://www.codeplex.com/iis70loggingui .

I have worked with our source asset management team and made this available under the <a href="http://www.codeplex.com/iis70loggingui/license">MS-PL</a>. I hope that this makes the download reliably available. I'm looking forward to developing more samples that I will also be releasing in the same manner.

Enabling VS.NET 2008 to work with IIS 7.0

TobinTitus — Mon, 22 Sep 2008 06:08:14 GMT

This is likely old ground for some, but I thought I’d cover it again just in case. As you may know Visual Studio allows you to create a new web site on IIS. However, there are some minor steps that you need to complete before it will work appropriately.

Let’s walk through this.

Open Visual Studio .NET 2008
Go to File | Web Site…
Click the Browse… button to choose a Location
Click on the Local IIS button on the left

You’ll notice the IIS 6 Metabase and IIS Configuration Compatibility need to be installed as well as ASP.NET. The next steps we’ll go through will enable this for you.
Go to Start | Control Panel and click on the Programs and Features applet
Click on the Turn Windows features on or off button on the left
From the Windows Features window, select the IIS Metabase and IIS 6 configuration compatibility option under IIS 6 Management Compatibility as well as ASP.NET under Application Development Features
Click OK and wait as Windows configures the service
Once Windows is done configuring IIS, it may ask you to restart. Click Restart Now.
After rebooting, you should be able to walk through steps 1-4 again and create a Web site with the Local IIS option.

This should be all you need to do to enable Local IIS integration with VS.NET 2008.

IIS 7.0 Error Support

TobinTitus — Sun, 21 Sep 2008 04:48:00 GMT

I know that most of you reading the blogs on this site have already seen how handy the errors are in IIS 7.0 as compared to previous error conditions. This weekend, I was playing with BlogEngine.NET and thought I'd put it on my personal site (tobint.com) to try it out. I downloaded the software and tried setting it up on my server. After following the brief instructions, I hit an error:

HTTP Error 500.22 - Internal Server Error
An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode.

In previous versions of IIS, this might have been all that I had to go on. I'd then search one or several search engines for that exact error and read through blog posts, forums, knowledge base articles and FAQ's before I found what I needed. In IIS 7.0, I found the friendly error page awaiting me:

I looked at the "Things you can try" and a picked the first "fix" on the list. Since my application was not in the Default Web Site, I ran the appcmd for my application in "tobint.com/".

As you can see, the error page correctly identified that my configuration needed to be migrated, and gave me the steps I needed to migrate it effectively. No searching the web. No trying to trace the problem down. No turning on tracing for ASP.NET pages.

I love this feature. It's a huge time saver and I don't think it gets bragged on enough.

Accessing Custom Configuration at Runtime with Microsoft.Web.Administration

TobinTitus — Fri, 13 Jun 2008 19:07:00 GMT

I've been working on a series of posts and Webcasts in my "spare time" directed at some of the areas in which I am most frequently asked questions. I am currently working on developing topics dealing with IIS configuration. It seems logical that this...(read more)

Silverlight and Expression and Bears, oh my!

TobinTitus — Mon, 30 Apr 2007 16:53:00 GMT

I just watched some of the coolest demos I've seen in a while. Ray Ozzie gave the opening keynote address for Mix 07. I hate to say it but he stated nothing more than the obvious direction of technology, IMHO. Ray's address was quickly followed by Scott Guthrie who received a very warm greeting -- and rightly so! Scott was there to deliver the goodies which were also received very warmly. There were plenty of announcements about Silverlight and the driection we are headed there. The big impressive thing we announced was our cross-platform CLR support and the integration of .NET into Silverlight as a programming model. I loved watching the demo's of using Expression to create the user experience and Visual Studio to provide the remote debugging support -- on a Mac none-the-less!

This is already all too cool for words. I can't wait to see what else is coming up next. Oh wait, that would be Bill Staples demonstration of IIS 7 for developers. If you are at Mix, come join me in room 4101A to learn what IIS 7 has to offer developers.

Logging UI for Vista v1.1 Released

TobinTitus — Thu, 01 Feb 2007 20:45:00 GMT

I have completed the final pieces of the Logging UI for Vista and posted them on the DownloadCENTER. I've completed functionality to allow you to configure central binary logging, central W3C logging, and site defaults. I've modified the look and feel of some of the pages and I've even added tool tips that show what configuration is being changed with each control.

The source code for this project is also available in C#. If I get a few more moments of time and/or many requests in the next few weeks, I may also port the source to VB.NET and C++/CLI.

In the mean time, if you have any questions, feel free to contact me.

You can find the download containing both the source code and the MSI here: http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1328

UPDATE: You can find screenshots of the UI module here: http://blogs.msdn.com/photos/tobint/category20627.aspx

Logging UI for IIS 7.0 on Vista: Available for download

TobinTitus — Tue, 30 Jan 2007 20:25:00 GMT

As many of you already know, the management console for IIS 7.0 on Windows Vista does not have a UI for logging. Since this was a pain point for several customers, I decided to test out the extensibility APIs by creating a logging UI module.

I've posted a preview version of my logging UI on the newly opened IIS Download Center. I will be releasing a few updates throughout the week with changes. The module also contains the source code for my UI module under the Microsoft Permissive License. This code will also be updated in future releases.

You can find the download at: http://www.iis.net/downloads/default.aspx?tabid=34&i=1328&g=6

If you have any questions, please feel free to contact me.

Extending Microsoft.Web.Administration through PowerShell (Part II)

TobinTitus — Fri, 01 Dec 2006 17:03:00 GMT

In my previous post, I showed you how easy it was to leverage your knowledge of the IIS 7 managed SDK in Windows PowerShell. We loaded the IIS 7 managed assemblies and then traversed the object model to display site information and stop application pools. While this in itself was pretty cool, I don't think I quite got my point across about how powerful IIS 7 and PowerShell are together. As such, I wanted to show you some more fun things to do with PowerShell in the name of easy IIS 7 administration.

First, our examples still required a great deal of typing and piping and filtering. Let's modify our profile script from my previous post by adding at least one new global variable that will give us access to the ServerManager without much typing. Add the following line to your profile script from my previous post.

new-variable iismgr -value (New-Object Microsoft.Web.Administration.ServerManager) -scope "global"

(if you don't have a profile script yet, go back to my previous post to learn how to create one).

Note: If you signed your script before, you'll have to do it again after modifying the script

Open a new instance of PowerShell and now you can access the site collection just by typing:

PS C:\> $iismgr.Sites

That's considerably smaller than our previous examples. But let's not stop there. What happens if I want to search the site collection? PowerShell has some fun syntax for this as well. I simply pipe the output of my SiteCollection to a "Where-Object" cmdlet and then specify what site I'm looking for:

$iismgr.Sites | Where-Object {$_.Name -match "^Default*"}

This is still quite a bit of typing when all I really want to do is find the default website. You may ask "Wouldn't it be easier if we could just add a "Find" method to the SiteCollection object?" Well I'm glad you asked *cough*! Next, we are going to do just that! Open up another instance of notepad and add the following XML to it:

<?xml version="1.0" encoding="utf-8" ?>
<!-- *******************************************************************
Copyright (c) Microsoft Corporation.  All rights reserved.

THIS SAMPLE CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY 
OF ANY KIND,WHETHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO 
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
PURPOSE. IF THIS CODE AND INFORMATION IS MODIFIED, THE ENTIRE RISK OF USE
OR RESULTS IN CONNECTION WITH THE USE OF THIS CODE AND INFORMATION 
REMAINS WITH THE USER.
******************************************************************** --> 
<Types>
  <Type>
    <Name>Microsoft.Web.Administration.SiteCollection</Name>
      <Members>
        <ScriptMethod>
          <Name>Find</Name>
          <Script>
          $rtr = "";
          if ( $args[0] ) 
          { $name = $args[0];
            $rtr = ((New-Object Microsoft.Web.Administration.ServerManager).Sites | Where-Object {$_.Name -match $name}) 
          } 
          else 
          { 
            $rtr = "No sites found." 
          };
          $rtr
          </Script>
        </ScriptMethod>
      </Members>
  </Type>
</Types>

What we've done is identified that we want to add a scripted method to the Microsoft.Web.Administration.SiteCollection object. In our case, I've added a "Find" method by using the same cmdlet that we typed before to search the site collection. The difference is, this type I use the $args array variable to check for a parameter and use it if one is available. Now, save this file into your %windir%\system32\WindowsPowerShell\v1.0\ directory as "iis.types.ps1xml". Once you've saved the file, sign it the same way you signed your profile script. Keep in mind that these xml files contain code, so signing your xml is required to keep your PowerShell experience a secure one. Now, open your profile script (again) and add the following lines to the end:

new-variable iissites -value (New-Object Microsoft.Web.Administration.ServerManager).Sites -scope "global"
new-variable iisapppools -value (New-Object Microsoft.Web.Administration.ServerManager).ApplicationPools -scope "global"
update-typedata -append (join-path -path $PSHome -childPath "iis.types.ps1xml")

Note: Once again, you'll have to re-sign this profile if your execution policy requires signed scripts.

Notice that I added two more variables: $iissites and $iisapppools. These variables allow me to access the site collection and application pool collection with a simple keyword. Lets try them out in PowerShell. Make sure you open a new instance of PowerShell so your profile script and xml type data are updated properly. Once your new instance of PowerShell is open, type the following:

PS C:\> $iissites.Find("^Default*")

PowerShell will do all the work for you and you have MUCH less typing to do.

Another alternative to using xml files is to simply create a function and add it to your profile. For instance, we can create a function called "findsite" that provides the same functionality as our previous example. Either type the following command into PowerShell or add it to your profile script:

PS C:\> function findsite { $name=$args[0]; ((New-Object Microsoft.Web.Administration.ServerManager).Sites | Where-Object {$_.Name -match $name}); } }

Now you can search for a site using the following syntax:

PS C:\> findsite default*

Whatever way we choose to extend Microsoft.Web.Administration and/or PowerShell, we can use our output as we did before:

PS C:\> (findsite default*).Id

The previous line should display the Id of the default web site. We can also stop the website:

PS C:\> (findsite default*).Stop()

We can keep taking this to extremes and truncate every operation that we perform on a semi-regular basis. These scripts are not one-offs. Each script function we create or append to an existing object model can be reused and piped as input to another function. The possibilities are endless and completely customizable to your needs.

Accessing Microsoft.Web.Administration through PowerShell (Part I)

TobinTitus — Fri, 01 Dec 2006 04:09:00 GMT

I've caught the PowerShell bug. In between stints with my ever-expanding code samples, I play with PowerShell a lot. I thought I'd share a quick example of how to load Microsoft.Web.Administration.dll and use it to perform some basic tasks.

Note: I'm running these samples on Windows Vista RTM, but I have no reason to believe this will not work on the PowerShell release candidates for the Vista RC* builds that are available now.

So let's get started.

First, PowerShell has no idea where Microsoft.Web.Administration.DLL is so you have to tell it how to load it. Anyone who has written code to dynamically load an assembly should be familiar with this syntax. Type the following command

PS C:\> [System.Reflection.Assembly]::LoadFrom( "C:\windows\system32\inetsrv\Microsoft.Web.Administration.dll" )

The path to your assembly may change depending on your install. I'll show you later how to use environment variables to calculate the correct path. In the mean time the out put of the line above display something like the following:

GAC Version Location

--- ------- --------

True v2.0.50727 C:\Windows\assembly\GAC_MSIL\Microsoft.Web.Administration\7.0.0.0__31bf3856ad364e35\Microsoft....

Once the assembly is loaded you can use PowerShell's "New-Object" command to create a ServerManager object that is defined in Microsoft.Web.Administration.

PS C:\> (New-Object Microsoft.Web.Administration.ServerManager)

This doesn't give you much except the list of properties the ServerManager exposes:

ApplicationDefaults      : Microsoft.Web.Administration.ApplicationDefaults
ApplicationPoolDefaults :
ApplicationPools         :
SiteDefaults             : Microsoft.Web.Administration.SiteDefaults
Sites                    : {Default Web Site}
VirtualDirectoryDefaults : Microsoft.Web.Administration.VirtualDirectoryDefaults
WorkerProcesses          : {}

To get more detail, you need to use the properties and methods of the ServerManager object to drill down and get the information we want. The ServerManager provides access to all of the sites on your machine through a SiteCollection object. This SiteCollection is made available through the "Sites" property of the ServerManager.

PS C:\> (New-Object Microsoft.Web.Administration.ServerManager).Sites

Which will produce a list view of all the sites and their associated property names/values.

ApplicationDefaults        : Microsoft.Web.Administration.ApplicationDefaults
Applications               : {DefaultAppPool, Classic .NET AppPool}
Bindings                   : {}
Id                         : 1
Limits                     : Microsoft.Web.Administration.SiteLimits
LogFile                    : Microsoft.Web.Administration.SiteLogFile
Name                       : Default Web Site
ServerAutoStart            : True
State                      : Started
TraceFailedRequestsLogging : Microsoft.Web.Administration.SiteTraceFailedRequestsLogging
VirtualDirectoryDefaults   : Microsoft.Web.Administration.VirtualDirectoryDefaults
ElementTagName             : site
IsLocallyStored            : True
RawAttributes              : {name, id, serverAutoStart}

ApplicationDefaults        : Microsoft.Web.Administration.ApplicationDefaults
Applications               : {DefaultAppPool}
Bindings                   : {}
Id                         : 2
Limits                     : Microsoft.Web.Administration.SiteLimits
LogFile                    : Microsoft.Web.Administration.SiteLogFile
Name                       : Test Web Site 1
ServerAutoStart            : False
State                      : Stopped
TraceFailedRequestsLogging : Microsoft.Web.Administration.SiteTraceFailedRequestsLogging
VirtualDirectoryDefaults   : Microsoft.Web.Administration.VirtualDirectoryDefaults
ElementTagName             : site
IsLocallyStored            : True
RawAttributes              : {name, id, serverAutoStart}

Of course, this isn't the easiest view to read, so let's say we just list the site names by piping our site list to the "ForEach-Object" command in PowerShell and display a list of site names only:

PS C:\> (New-Object Microsoft.Web.Administration.ServerManager).Sites | ForEach-Object {$_.Name}

This looks much more concise:

Default Web Site
Test Web Site 1

We could also use the Select-Object syntax to query the list into a table format:

PS C:\> (New-Object Microsoft.Web.Administration.ServerManager).Sites | Select Id, Name

        Id Name
        -- ----
         1 Default Web Site
         2 Test Web Site 1

Now lets use PowerShell to manage application pools. We can fit several commands on one line by using the semi-colon. The following command-line is actually four different operations: Storing the application pool collection into a variable, displaying the name and runtime status of the first application pool, stopping the first application pool, then displaying the name and status again.

PS C:\> $pools=(New-Object Microsoft.Web.Administration.ServerManager).ApplicationPools; $pools.Item(0) | Select Name, State;$pools.Item(0).Stop(); $pools.Item(0) | Select Name, State

Running this sample should display the following:

Name                                         State
----                                         -----
DefaultAppPool                               Started
Stopped
DefaultAppPool                               Stopped

This is nice, but we can do this already with appcmd.exe right? Well, to some extent. We don't get the features of PowerShell that allow us to format our output the data to our liking. Also, as a developer, I find it much easier to use the API syntax I'm already familiar with than to remember appcmd.exe syntax. Furthermore, PowerShell allows us to use WMI alongside our managed code calls, and unlike appcmd.exe, you can extend PowerShell and cmdlets. PowerShell gives you the ability to easily manage multiple servers from one command prompt on one machine. Watch the PowerShell/IIS 7 interview on Channel9 if you want to see this remote administration in action.

One last thing that PowerShell brings to the table is the ability to "spot-weld" our object models (as Scott Hanselman quipped). You can create/modify/extend type data and formatting to your hearts desire. For more information on this, check out the PowerShell documentation found in the PowerShell install, or in the PowerShell documentation set.

So, I would be remiss in this post if I didn't try to make your PowerShell / IIS 7.0 life easier. As such, I've created a profile script that loads all the IIS 7.0 managed assemblies for you. The script is simple and contains more echo commands than actual working script lines.

To install this script run the following command inside PowerShell:

PS C:> if ( test-path $profile ) { echo "Path exists." } else { new-item -path $profile -itemtype file -force }; notepad $profile

This will create a profile path for you if you don't already have one, then open up your profile in notepad. If you haven't added anything to the file, it will obviously display an empty file. Paste the following in notepad when it opens:

echo "Microsoft IIS 7.0 Environment Loader"
echo "Copyright (C) 2006 Microsoft Corporation. All rights reserved."
echo " Loading IIS 7.0 Managed Assemblies"

$inetsrvDir = (join-path -path $env:windir -childPath "\system32\inetsrv\")
Get-ChildItem -Path (join-path -path $inetsrvDir -childPath "Microsoft*.dll") | ForEach-Object {[System.Reflection.Assembly]::LoadFrom( (join-path -path $inetsrvDir -childPath $_.Name)) }

echo " Assemblies loaded."

Now, save the profile and close notepad. You will likely have to sign this script or change your script execution policy to something very weak to make this script run properly (obviously I'm not recommending the latter). To find out more about signing scripts, type "get-help about_signing" in PowerShell. The instructions to create a self-signed certificate found in that help file are as follows:

In an SDK Command Prompt window, run the following commands.
The first command creates a local certificate authority for your computer.
The second command generates a personal certificate from the certificate authority:

makecert -n "CN=PowerShell Local Certificate Root" -a sha1 `
   -eku 1.3.6.1.5.5.7.3.3 -r -sv root.pvk root.cer `
   -ss Root -sr localMachine
makecert -pe -n "CN=PowerShell User" -ss MY -a sha1 `
   -eku 1.3.6.1.5.5.7.3.3 -iv root.pvk -ic root.cer
   MakeCert will prompt you for a private key password.

Go ahead and make a certificate for yourself following those instructions. To sign your profile, within PowerShell type the following:

PS C:\>Set-AuthenticodeSignature $profile @(get-childitem cert:\CurrentUser\My -codesigning)[0] 

So far, you've created a certificate and signed your script. Now, you will have to change your script execution policy down at least one level from the default. The default doesn't allow scripts at all. To get scripts to execute, at the minimum you'll have to set it to "AllSigned" to allow only signed scripts to execute. In this mode, each time you execute a script from a new publisher, you'll be asked what level of trust to assign to the publisher (unless you respond to the prompt to "Always Run" or "Never Run" scripts from that publisher)

Do you want to run software from this untrusted publisher?
File C:\Users\TobinT\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 is published by CN=PowerShell User
and is not trusted on your system. Only run scripts from trusted publishers.
[V] Never run [D] Do not run [R] Run once [A] Always run [?] Help (default is "D"):

Now, each new instance of PowerShell that you run will automatically load the IIS 7.0 managed assemblies. I know it seems like a great deal of work, but it really isn't once you've made a few rounds around inside PowerShell. Consider that you only have to create the script once and then you have full the full range of the managed IIS 7.0 SDK at your fingertips inside PowerShell.

If you have problems, feel free to leave comments and I'll do my best to help you.

Adding performance

TobinTitus — Thu, 30 Nov 2006 11:38:00 GMT

Some of you may have found the title to this blog post as amusing as I do. Throughout my career, I've been called into many a meeting asking that I "add" performance to a complete or nearly-complete product. No matter how many scowls I got, I could never resist joking about just adding the IPerformance interface. "And, while you are at it, just add the IScalable one too", I would quip. (OK, I know some of you are doing searches for these interfaces -- don't bother). Laugh as hard as I may, I'm embarrassed to say that I am trying to do this very thing now.

A few weeks ago, I started playing around with a small sample that shows off some of the fun features of IIS 7. As I started coding, I added more features to the sample. Scope creep is a no-no, but this was something I was doing on my own time so I didn't have a problem with it. However, the sample got so large that I had to actually stop and design a public API to support it. By the time I was done, my "sample" had a set of providers, a common API, localization support, utilities, and most notably, performance issues.

Last year on my personal blog, I talked about "engineering for usability". In that post, I declared that the simplest design is sometimes (and probably most often) the best approach. That said, performance should have been considered very early on, and the sample should have been kept simple. Performance, as many of you know, is not something you add as an afterthought. Starting my sample the way I did, I never considered code performance to be an issue.

Now I'm forced to decide: do I scale back my sample knowing full well that it doesn't have a security model or provide easy extensibility, or do I redesign the sample with the current feature set and design for performance up front? I'm leaning toward the latter despite reciting "keep it simple, stupid" in my head over and over again.

Where can I find in IIS 7.0 ?

TobinTitus — Tue, 10 Oct 2006 21:40:00 GMT

Question: Where can I find Windows Authentication in IIS 7.0?

I've seen this question or questions like this asked numerous times so I thought it would make a nice quick -- and hopefully useful -- blog post.

In previous versions of IIS, administrators were able to enable or disable features on their servers by simply checking or unchecking a box in the IIS management console. However, when an administrator unchecked a feature in IIS, the feature still existed on the machine and was even loaded. Unchecking a box allowed the administrator to disable a feature -- but it didn't physically remove anything from the machine.

This all changes with IIS 7.0. Currently, when you install IIS 7.0 on Windows Vista (or Longhorn server for that matter), you must select the features that you want installed. Each feature in IIS 7.0 is componentized into its own module library. The features you select at installation, and ONLY the features you select, will be copied to disk under the "%windir%\system32\inetsrv\" directory. If you do not install the feature, it simply won't exist on your machine. This obviously makes the server more robust and performant at the sime time -- providing a high amount of customization as well as security.

Another thing to note is that once a feature module has been installed to the proper directory, it must also be added to the IIS configuration system. For more information on how to install and uninstall modules, see: Getting Started with Modules.

If you are having a hard time getting WindowsAuthentication, DynamicCompression, or some other feature of IIS to work. A good place to start looking is your installation. Make sure you've installed the features you need for your purposes.

SDK Sample: Changing the runtime version of an application pool in IIS 7

TobinTitus — Thu, 29 Jun 2006 03:03:00 GMT

The following quick SDK sample demonstrates how to list and change the managed runtime version of application pools programatically in IIS 7.

[VB]

Imports System
Imports Microsoft.Web.Administration

Public Class AppPoolSample
    Shared manager As ServerManager = New ServerManager()

    ' Main application processing
    Public Shared Sub Main(ByVal args As String())
        ' Get the apppool to change
        Dim iPool As Integer = GetAppPool()

        ' Get the framework version desired
        Dim rtVersion As String = GetVersion()

        ' Set the apppool runtime
        Dim poolToSet As ApplicationPool = manager.ApplicationPools(iPool)

        Console.WriteLine("Setting application pool '{0}' to runtime version: {1}...", _
            poolToSet.Name, rtVersion)
        poolToSet.ManagedRuntimeVersion = rtVersion

        ' Commit the changes and recycle the application pool
        manager.CommitChanges()
        poolToSet.Recycle()

        Console.WriteLine("Your changes have been committed.")
    End Sub

    ' Prompts the user to select an application pool
    Public Shared Function GetAppPool() As Integer

        Dim pool As String = String.Empty
        Dim iPool As Integer = 0

        While (Not Integer.TryParse(pool, iPool))
            Console.WriteLine("Available ApplicationPools: Managed runtime version")
            Dim i As Integer
            For i = 0 To manager.ApplicationPools.Count - 1 Step i + 1
                Dim appPool As ApplicationPool = manager.ApplicationPools(i)
                Console.WriteLine("{3}{0,3}.{3}{1}: {2}", i + 1, _
                    appPool.Name, appPool.ManagedRuntimeVersion, vbTab)
            Next
            Console.Write("{0}Choose an application pool to change: ", vbCrLf)
            pool = Console.ReadLine()
        End While
        Return iPool - 1
    End Function

    ' Prompts a user to select the version of runtime they would like
    ' the application pool to use
    Public Shared Function GetVersion() As String
        Dim rtVersion As String = String.Empty
        Dim iVersion As Integer = 0

        While (Not Integer.TryParse(rtVersion, iVersion))
            Console.WriteLine("{0}  1.{0}Framework version 1.0", vbTab)
            Console.WriteLine("{0}  2.{0}Framework version 1.1", vbTab)
            Console.WriteLine("{0}  3.{0}Framework version 2.0", vbTab)
            Console.Write("Choose the new managed runtime version: ")
            rtVersion = Console.ReadLine()
        End While

        Select Case iVersion
            Case 1
                rtVersion = "v1.0"
            Case 2
                rtVersion = "v1.1"
            Case 3
                rtVersion = "v2.0"
        End Select

        Return rtVersion
    End Function
End Class

[C#

using System;
using Microsoft.Web.Administration;

public class AppPoolSample 
{
    static ServerManager manager = new ServerManager();
    
    // Main application processing
    public static void Main(string[] args)  
    {
        // Get the apppool to change
        int iPool = GetAppPool();

        // Get the framework version desired
        string rtVersion = GetVersion();

        // Set the apppool runtime
        ApplicationPool poolToSet = manager.ApplicationPools[iPool];

        Console.WriteLine("Setting application pool '{0}' to runtime version: {1}...",
            poolToSet.Name, rtVersion);
        poolToSet.ManagedRuntimeVersion = rtVersion;

        // Commit the changes and recycle the application pool
        manager.CommitChanges();
        poolToSet.Recycle();

        Console.WriteLine("Your changes have been committed.");
    }

    // Prompts the user to select an application pool
    public static int GetAppPool()
    {
        string pool = String.Empty;
        int iPool = 0;

        while ((!int.TryParse(pool, out iPool)) ||
                (iPool > manager.ApplicationPools.Count || iPool <= 0))
        {
            Console.WriteLine("Available ApplicationPools: Managed runtime version");
            for (int i = 0; i <= manager.ApplicationPools.Count - 1; i++)
            {
                ApplicationPool appPool = manager.ApplicationPools[i];
                Console.WriteLine("\t{0,3}.\t{1}: {2}", i + 1, 
                    appPool.Name, appPool.ManagedRuntimeVersion);
            }
            Console.Write("\r\nChoose an application pool to change: ");
            pool = Console.ReadLine();
        }
        return iPool -1;
    }

    // Prompts a user to select the version of runtime they would like
    // the application pool to use
    public static string GetVersion()
    {
        string rtVersion = String.Empty;
        int iVersion = 0;

        while ((!int.TryParse(rtVersion, out iVersion)) ||
                (iVersion > 3 || iVersion < 1))
        {
            Console.WriteLine("\r\n\t   1.\tFramework version 1.0");
            Console.WriteLine("\t   2.\tFramework version 1.1");
            Console.WriteLine("\t   3.\tFramework version 2.0");
            Console.Write("Choose the new managed runtime version: ");
            rtVersion = Console.ReadLine();
        }

        switch (iVersion)
        {
            case 1:
                rtVersion  = "v1.0";
                break;
            case 2:
                rtVersion = "v1.1";
                break;
            case 3:
                rtVersion = "v2.0";
                break;
        }

        return rtVersion;
    }
}

Tobin Titus Blog : IIS 7

IIS Security – Past and Present

Ghosts of IIS Security Past

Improvements in IIS 6

Improvements in IIS 7.x

Customizable Installation

Limitable Attack Surface

IUSR account

IIS_IUSRS group

ASP.NET / IIS Unified Security Architecture

Request Filtering / URL Rewriting

Application Pool Identities

Kernel mode SSL

Configuration Improvements

Dynamic IP Restriction

Summary

See Also

Installing CakePHP on IIS 7

Prerequisites

Assumptions / Conventions

Installing the Blog Sample

Pointing IIS to the cake document root

Creating a Blog Database

Cake Database Configuration

Setting up Rewriting Rules

Creating your MVC Application

Summary

IIS logging UI module sample added to CodePlex

Enabling VS.NET 2008 to work with IIS 7.0

IIS 7.0 Error Support

Accessing Custom Configuration at Runtime with Microsoft.Web.Administration

Silverlight and Expression and Bears, oh my!

Logging UI for Vista v1.1 Released

Logging UI for IIS 7.0 on Vista: Available for download

Extending Microsoft.Web.Administration through PowerShell (Part II)

Accessing Microsoft.Web.Administration through PowerShell (Part I)

Adding performance

Where can I find in IIS 7.0 ?

SDK Sample: Changing the runtime version of an application pool in IIS 7