1. Internet Information Server 6.0

2. IIS 6.0 Enhancements  Fundamental changes, aimed at: Reliability & Availability Reliability & Availability Performance Performance Manageability Manageability Security Security

3. IIS 6.0 Reliability & Availability

4. INETINFO.EXE Metabase ISAPI Filters and Extensions INETINFO.EXE Metabase ISAPI Filters and Extensions Review of IIS 5 Architecture TCP/IP kernel user WinSock 2.0 DLLHost.EXE ISAPI Extensions DLLHost.EXE ISAPI Extensions DLLHost.EXE ISAPI Extensions

5. IIS 6 Architecture Web Admin Service Worker Process W3 Core web app HTTP.SYS kernel user

6. HTTP.SYS  What is it? Kernel-mode HTTP stack/listener Kernel-mode HTTP stack/listener Always running Always running  What does it do? HTTP Listener and Parser HTTP Listener and Parser Process routing based on URL namespace Process routing based on URL namespace Request queues: kernel-mode queuing Request queues: kernel-mode queuing Response cache for static requests Response cache for static requests

7. Web Admin Service - WAS  What is it? Configuration, Application and Process Manager Configuration, Application and Process Manager  What does it do? Configures HTTP.SYS for listening and routing Configures HTTP.SYS for listening and routing Periodic Recycling Periodic Recycling Time, Hit, Memory, Schedule-based, and on- demand Time, Hit, Memory, Schedule-based, and on- demand Health Monitoring Health Monitoring Pinging, Crash detection Pinging, Crash detection Rapid fail protection Rapid fail protection Better debugging support Better debugging support Orphan Web Processing Core Host Processes Orphan Web Processing Core Host Processes

8. Web Processing Core W3WP.exe  What is it? Main web processing core responsible for handling web requests Main web processing core responsible for handling web requests  Self–contained web server Contains all web request processing functionality Contains all web request processing functionality Loads ISAPI’s – filters and extensions Loads ISAPI’s – filters and extensions ASP, ASP.NET, FrontPage® Server Extensions ASP, ASP.NET, FrontPage® Server Extensions  Delivers complete isolation from system components and other web apps

9. IIS 6.0 Availability: Applications Isolating Applications From Each Other  Applications grouped into Application Pools Applications defined by URL namespace Applications defined by URL namespace One or many applications per Application Pool One or many applications per Application Pool Configure Processing features by Application Pool Configure Processing features by Application Pool One or many Worker Processes per Application Pool One or many Worker Processes per Application Pool Service Level Support Service Level Support CPU accounting CPU accounting Bandwidth throttling Bandwidth throttling

10. Worker Process Web app W3 Core Recycl e time! Worker Process Web app W3 Core IIS 6 Architecture: Managing worker processes kernel user HTTP.SYS Worker Process Web app W3 Core Worker Process Web app W3 Core Web Admin Service Worker Process Web app W3 Core

11. Working with Application Pools

12. Recycling  Recycle periodically to ensure reliability  Recycle based on: Uptime Uptime # of requests # of requests Schedule Schedule Virtual memory consumption Virtual memory consumption On-Demand On-Demand

13. Application Pool Performance  Goal = Support 2000 pools concurrently. IIS5 Isolated OOP total was 80. IIS5 Isolated OOP total was 80.  Scaling Features of Pools Idle Timeout Idle Timeout CPU Accounting CPU Accounting Demand Start Demand Start

14. Web Gardens  Multiple Processes serving an application pool Reliability and fault-tolerance Reliability and fault-tolerance Allows another already initialized worker process to take over the current load Allows another already initialized worker process to take over the current load Can affinitize worker processes to a set of processors Can affinitize worker processes to a set of processors Some throughput gains for applications that rely on process global resources Some throughput gains for applications that rely on process global resources

15. App Pool Health & Debugging Features  Worker process health monitoring/gating Process pinging Process pinging Startup/Shutdown limits Startup/Shutdown limits Kernel Mode Request Queuing Kernel Mode Request Queuing  Rapid Fail Protection  “Orphan” worker processes in failure

16. Configurable Worker Process ID  Worker process can be started as: Network Service (default) Network Service (default) Local System Local System Local Service Local Service Configured ID Configured ID

17. ** ASP.NET  If ASP.NET runs on IIS 4.0, IIS 5.0, or IIS 6.0 in IIS 5.0 isolation mode, it uses its own process model and configuration settings in the Machine.config file  If IIS is running in worker process isolation mode, ASP.NET disables its own process model and utilizes the worker process architecture of IIS 6.0.

18. DEMO: IIS Recycle

19. IIS 6.0 Performance

20. Designed for high throughput  Kernel mode cache for static, unauthenticated content No transition to user mode for cache hits No transition to user mode for cache hits  User-mode worker processes No user mode to user mode process hop No user mode to user mode process hop Talk directly to HTTP.SYS to get requests Talk directly to HTTP.SYS to get requests Ability to affinitize worker processes to CPUs Ability to affinitize worker processes to CPUs  Support for 64-Bit

21. IIS 6.0 Scalability Scale up, out and in  SSL up to 900% faster  ISAPI up to 800% faster  CGI up to 100% faster  Support 20,000 sites and more per system Improved Startup/Shutdown times (<2min) Improved Startup/Shutdown times (<2min) Improved Scalability of Application Isolation (2000 Isolated Application Pools) Improved Scalability of Application Isolation (2000 Isolated Application Pools)  Improved Processor Scalability 3x on a 4-processor box, 5x on an 8-way 3x on a 4-processor box, 5x on an 8-way

22. IIS 6.0 Management

23. Installation

24. Management Enhancements  XML Metabase  WMI Provider  Command-Line Interface  New Web-based Administration Console

25. IIS Commands  Create web and FTP Sites c:\>iisweb /create c:\webroot “My Site” /b 169.254.36.174 c:\>iisweb /create c:\webroot “My Site” /b 169.254.36.174  Create web and FTP V-Dirs  Backup/Restore  Export/Import Configuration c:\>iiscnfg /import /f MySiteConfig.xml c:\>iiscnfg /import /f MySiteConfig.xml /sp /lm/w3svc/1 /sp /lm/w3svc/1 /dp /lm/w3svc/4 /dp /lm/w3svc/4

26. IIS 6.0 Security

27. IIS 5.0 Security Issues  Code Red, Nimda, etc., etc.  Weaknesses Windows 2000 Installed As An Application Server – Huge attack surface Windows 2000 Installed As An Application Server – Huge attack surface Soft Defaults Soft Defaults High Privilege Accounts High Privilege Accounts No automated way to install patches No automated way to install patches Result: Fixes out for months but not uniformly applied Result: Fixes out for months but not uniformly applied Many companies survived Code Red & Nimda Many companies survived Code Red & Nimda  IIS Lockdown Wizard & URLSCAN for IIS 4/5  Improved Patch Management

28. IIS 6.0 Security Secure Out of the Box  Change in approach: Clean up code, improved tools for defect detection Clean up code, improved tools for defect detection Secure defaults, minimize attack surface (static files only by default) Secure defaults, minimize attack surface (static files only by default) Customer ‘enables’ server features after setup Customer ‘enables’ server features after setup An infrastructure that by default installs security hot fixes (customer opts out, not in) An infrastructure that by default installs security hot fixes (customer opts out, not in)  Educate the Customer

29. IIS 6.0 Security Reduced Attack Surface  IIS is not installed by default As well as 20+ other services As well as 20+ other services  Server Lockdown: Serve HTM files only Only Web service gets installed Only Web service gets installed IsapiRestrictionList IsapiRestrictionList CGIRestrictionList CGIRestrictionList Template-based feature activation Template-based feature activation  Web service disabled on upgrade for benefit of non-IIS users  Prevent IIS6 install with group policy

30. Managing Web Service Extensions

31. Support or no support ASP

32. Web Server Security Enhancements  URLscan implemented by default  Clean code  Architectural changes Process isolation Process isolation Configurable identity Configurable identity Application pool management Application pool management  General OS hardening  New tools AutoUpdate, SUS, Qchain, MBSA AutoUpdate, SUS, Qchain, MBSA

33. Passport Authentication  Integrated with Windows server 2003  Can ACL resources with passport accounts  Map passport credentials with AD accounts  Must register with Passport.com  Use Passport Manager Administration Utility to configure

34. URL Authorization

35. FTP User Isolation  FTP server 6.0 included in Windows Server 2003  Isolation levels Compatibility / no isolation Compatibility / no isolation Small business / stand alone isolation Small business / stand alone isolation Enterprise isolation using AD integration Enterprise isolation using AD integration

36. Questions ?