Managing Multiple Web Servers from IIS Manager

It is possible to manage multiple web servers from a single instance of IIS Manager. To allow a system to be remotely managed, from IIS Manager (Figure 15-1) on the remote system, select the server name in the navigation pane; from the Management group select Management Service. From the resulting feature (Figure 15-2) check the box “Enable Remote Connections” and select how IIS Manager authenticates users. Remote users that attempt to connect to IIS can be authenticated with their user credentials; it is also possible to create separate IIS Manager users with their own credentials. Access to the management service can be restricted by IP address. Once the changes have been made, apply the result and start the service; this automatically opens the proper firewall port (TCP/8172) with a rule named Web Management Service (HTTP Traffic-In).

Though this process starts the web management service, it does not configure the service to start on boot. To do so on Windows Server 2012 or later, launch Services from the Tools menu on Server Manager. On Windows Server 2008 R2, from the Start Menu navigate Administrative Tools ➤ Services. In either case, choose the entry for Web Management Service, and change the Startup type to Automatic.

To manage a remote system, from IIS Manager on the local system, select File ➤ Connect to a Server. Provide the required credentials for the remote server, specifying the domain for the user name if appropriate. In the default setting, the server uses SSL/TLS with a self-signed certificate to protect the communication. A user that connects may be warned that the certificate was issued to a different server. The user has the option of connecting to the remote server; the user can also view the remote certificate and install it locally as trusted. Depending on the remote server, the user may be prompted to add one or more additional features, including the Microsoft web management client. Connections can be saved; from the File menu select File ➤ Save Connections. Once the connection is made, a node for the new web server appears in the IIS Manager navigation pane (cf. Figure 15-5).

Web Sites

Microsoft IIS includes a default web site when it is installed with the name “Default Web Site”; it appears in the IIS Manager navigation pane under the Sites node (Figure 15-1). The web site name can be changed by right-clicking on the site in IIS Manager then selecting Rename.

The contents of a web site can be seen by changing IIS Manager to content view at the bottom of the page. The contents of the default web site are stored in the directory C:inetpubwwwroot. One of the entries in the action pane for a web site in IIS Manager is Explore; this brings up Windows File Manager opened to the directory in the file system that contains the web site. User access controls (UAC) prevent most simple techniques to edit the contents of the default directory. Even a domain administrator cannot simply right-click in File Explorer to create a new file in C:inetpubwwwroot, nor can they edit an existing document in that directory in Notepad and save it back.¹

Adding a Second Web Site

An administrator that wants to configure IIS to serve a second web site can start from IIS Manager, right-click on the name of the server in the navigation pane, and select Add Web Site. In the resulting dialog box (Figure 15-3), a name for the web site needs to be chosen; this is the name that appears in IIS Manager. The physical path is the location of the web site in the file system. This directory needs to be manually created; one reasonable location is inside the directory C:inetpub. When a web site is created, IIS can be configured to access the web site as a particular user; however, the default, which uses pass-through authentication, is reasonable.

A site’s bindings include the protocol (http or https), IP address, port, and hostname. All must match a request for the page to be served.

Bindings can be configured with wildcards. If the host name is omitted in a binding, it matches any hostname. When specifying an IP address, the administrator can select “All Unassigned, ” which matches any IP address not in use by another site. Once a web site is created, it is possible to modify the bindings by right-clicking on the web site in IIS Manager and selecting Edit Bindings. A single web site can have multiple bindings.

Creating a web site on a non-standard port (like TCP/8080 as in this example) does not automatically open the port in the firewall; this needs to be done manually.

If a server has multiple external IP addresses, then IIS can serve separate web sites on each address. Suppose, for example, that a host has two IP addresses: 10.0.5.112 with the DNS name ananke.ad.jupiter.test, and 10.0.5.114 with the DNS name thebe.ad.jupiter.test. To create a web site for thebe.ad.jupiter.test, right-click on the name of the server in the IIS Manager navigation pane, select Add Web Site, then add a new site, specifying the site name (Thebe), physical path (C:inetpubwww-thebe), binding type (http), the IP address (10.0.5.114), and the port (TCP/80). A client that browses to ananke.ad.jupiter.test gets the IP address 10.0.5.112 from their DNS server and then gets the web page for ananke; a client that browses to thebe.ad.jupiter.test gets the IP address 10.0.5.114 from their DNS server and then gets the web page for thebe.

Default Documents

If no document is specified in a URL, then IIS attempts to return a default document. There are five default documents; in order, they are Default.htm, Default.asp, index.htm, index.html, and then iisstart.htm. When IIS looks for a default document, it looks through this list in the specified order. It does not go on to the next item in the list until it is satisfied that the current list item does not exist. An administrator can change the default documents and their order, either server-wide or for a web site. From IIS Manager, navigate to either the server or the site, double-click on Default Document, and make the desired changes.

Directory Requests

If a directory is requested and no default page exists, then IIS returns a 403 error. This behavior can be changed at the server or site level through IIS Manager via Directory Browsing. IIS allows the administrator to return a directory listing instead of the 403 error and can select which information is included in the directory listing, including the date, time, size, and extension for each file.

Error Messages

When IIS needs to return an error to the client, by default it returns different error messages for local requests and remote requests. This behavior is configured through IIS Manager, in the Error Pages feature. The action pane hyperlink Edit Feature Settings allows the administrator to use detailed errors, custom errors, or vary depending on the request source. The main body in the setting links to the various, language-specific custom error pages. By default, these are in C:inetpubcusterr, with separate subdirectories depending on the language.

Because detailed errors provide so much information, they should be used judiciously. Consider Figure 15-4 that shows what is provided when a user makes a request of a directory without a default document on a site where directory browsing is not enabled.

Virtual Directories

A virtual directory is a URL path that is mapped to a portion of the file system. One way to create a virtual directory for a site is to select the site from the navigation pane of IIS Manager, then use the hyperlink View Virtual Directories from the action pane. This presents a page that shows the virtual directories for the site; the action pane then has hyperlinks to view the settings for existing virtual directories or to create a new virtual directory.

To create a new virtual directory, choose the location in the file system, as well as the alias for the virtual directory. This is the path clients take to reach the directory. As an example, if an administrator on the site server.test creates a virtual directory with the physical path C:WebData and the alias Subdirectory, then the URL http://server.test/Subdirectory/page.htm serves its content from the file C:WebDatapage.htm.

It is possible that a single directory in the file system is mapped to multiple virtual directories in multiple web sites, all with different URLs.

Command-Line Tools

Windows includes the command-line tool appcmd.exe to administer Windows IIS from the command line. This tool is not located in the system path but resides in the directory C:WindowsSystem32inetsrvappcmd.exe. The tool requires administrative privileges and must be run from an elevated command prompt.

This server is running three web sites. The first is the default, listening on all unassigned addresses on TCP/80. The second is the alternate web site listening only on 10.0.5.112, TCP/8080. The third web site is listening on the server’s second IP address 10.0.5.114 on TCP/80.

From IIS Manager, navigate to the Thebe web site and view the list of default documents to see that home.html has been added to the top of the list.

Navigate to alternate web site in IIS Manager and examine the settings for directory browsing to confirm that the changes have been made.

Access Control

An administrator can deny access to the server, a web site, or a directory (including a virtual directory) by IP address range. This is done via the IP and Domain Restrictions role; this role must be manually added during IIS installation. Navigate to the component (server, site, or directory) in IIS Manager, then select IP Address and Domain Restrictions.

The action pane hyperlink Edit Feature Settings is used to determine the default response; this is set to allow access by unspecified clients by default. Access can be allowed or denied, either by IP address or by IP address range.

Care must be taken when using this feature. Figure 15-5 shows a Windows Server 2012 R2 server configured to deny access to all systems on the 10.0.2.0/24 subnet and to allow access to clients at 10.0.2.28. Windows applies these rules in order from first to last, and so an administrator might expect that this configuration allows access to clients at 10.0.2.28. In fact, Windows may or may not allow access. Although Windows does apply the rules in order, the default screen in Figure 15-5 does not show that order. An administrator must use the action pane hyperlink View Ordered List to see the actual ordering of the rules. If the deny rule is first in the ordered list, then access from 10.0.2.28 is denied, while if the allow rule is first then access from 10.0.2.28 is allowed.

On Windows Server 2008 R2 systems, if IP address and domain restrictions deny a request, then the client receives a 403 Forbidden error. On Windows Server 2012 and later, the Edit Feature Settings hyperlink in the action pane allows the administrator to set the deny action type as well as the default access policy. Choices include Unauthorized (returns 401 Unauthorized), Forbidden (returns 403 Forbidden), Not Found (returns 404 Not Found), or Abort (which resets the connection).

Windows Server 2012 and later also allow for dynamic IP address restrictions. A client’s IP address can be blocked if they exceed a specified number of concurrent requests, or if they exceed a number of requests in a specified time period. These settings are available from the action pane through the hyperlink Edit Dynamic Resolution Settings.

Request Filtering

An administrator can configure IIS to filter requests based on the URL, the HTTP verb (e.g., GET, POST, HEAD, PUT) or even portions of the file system using request filtering.

To use request filtering, navigate IIS Manager to the server, the site or directory, then select Request Filtering (Figure 15-6). In the default configuration, IIS includes one hidden segment, with the value web.config. The file web.config is the XML file that contains the settings for the web site if they are different from the default; it is located in the same directory as the contents of the web site. This request filter prevents this configuration file from being served to clients; requests for the file are met with a 404 Not Found error.

Authentication

Whenever a client makes a request of IIS, the server makes an authentication decision to determine if the client is granted access to the resource. These settings can be managed at the server, site, or directory level from IIS Manager using the Authentication settings. Navigate IIS Manager and select a server, site, or directory, then open the Authentication feature. Provided they were added as IIS server roles, anonymous authentication, basic authentication, and Windows authentication are available; Windows server 2012 or later also includes ASP.NET impersonation. At least one authentication mechanism must succeed for a client to be granted access to a requested resource.

Anonymous authentication is the simplest; it provides an identity for anonymous users. If a portion of a site is not meant to be accessed by anonymous users, then anonymous authentication must be disabled for that portion of the site.

Basic authentication is the same RFC 2617 method described in Chapter 14 for Apache systems. Credentials are passed by in essentially plain text by Base64 encoding <user name>:<password>. Basic authentication provides two options; the first is the authentication realm that plays the same role it did on Apache. The second is the default domain used for authentication. If no domain is specified, then windows domain users may need to include their domain name (domainusername) when authenticating.

Windows authentication uses Windows techniques (NTLM or Kerberos) for authentication; these use a challenge-response system that make them more resistant to sniffing and replay attacks.

Managing Web Server Certificates

To see the collection of available web server certificates, from IIS Manager, navigate to the server (not a site or directory) and select Server Certificates (Figure 15-7). By default, one certificate is present, issued to the host. On Windows Server 2012 and 2012 R2, it is named WMSVC; on Windows Server 2016, it is named WMSVC-SHA2, while on Windows Server 2008 R2 it is unnamed.

Creating a Self-Signed Certificate

To create a self-signed certificate, select Create Self-Signed Certificate from the action pane (Figure 15-7). On Windows Server 2008 R2, all that needs to be specified is the name of the certificate. Windows Server 2012 and later allow the certificate to be stored either in the Personal store or a Web Hosting store. Although a server can listen on multiple IP addresses with different DNS names, the process of generating a self-signed certificate only generates a certificate for the system’s Windows hostname.

Windows System Certificates

Windows uses certificates for many purposes beyond IIS servers. The collection of certificates on a Windows system can be managed through the Microsoft management console (MMC), C:WindowsSystem32mmc.exe. Start MMC, and from the main menu navigate File ➤ Add/Remove Snap-in. From the list of snap-ins, select Certificates, then Add. Microsoft manages certificates for the computer account, service accounts, and user accounts separately; when the certificates’ snap-in is added, the user selects which collection of certificates to manage. Manage the certificates for the computer account, then navigate Certificates (Local Computer) ➤ Trusted Root Certification Authorities ➤ Certificates to see the self-signed certificate (Figure 15-8). Double-click on a certificate to see the details; to export the certificate to a range of other formats, right-click on the certificate, selecting All Tasks ➤ Export. These options are both also available from the server certificates component of IIS Manager.

Trusting a Signing Server

To create an SSL/TLS web site that uses a certificate signed by a local signing server (Chapter 14), the Windows server must first trust the signing server. Copy the certificate (named ca.crt in Chapter 14) from the signing server to the web server. From the certificates’ MMC snap-in for the local computer account, right-click on Trusted Root Certification Authorities, then navigate All Tasks ➤ Import to start the Certificate Import Wizard. Select the certificate from the signing server and import the certificate into the Trusted Root Certification Authorities. On Windows Server 2012 and later, this can also be accomplished by right-clicking on the certificate and selecting Install Certificate; be sure to choose the local machine as the store location. Right-clicking on the certificate in Windows Server 2008 R2 also allows the certificate to be installed, but only for the current user rather than the local machine; this is insufficient for what follows.

Creating a Signed Certificate

To create a signed certificate for SSL/TLS on IIS, from the server certificates page for the server in IIS Manager, select the hyperlink Create Certificate Request from the action pane. The administrator provides the data for the request, beginning with the common name, which should match the DNS name of the server. The administrator chooses a cryptographic service; RSA with 2048 bits is a reasonable choice.

Once the certificate is signed, return it to the server. To complete the process, from the server certificates page for the server in IIS Manager, select the hyperlink Complete Certificate Request. Provide the certificate file (Thebe.crt in the example) and a name for the certificate. This certificate can be used in a new SSL protected web site, or by editing the bindings it can replace an already existing certificate, self-signed or otherwise.

Managing Remote Servers

The situation for a remotely managed Windows Server is more complex, because Server Certificates is not included in IIS Manager for remotely managed systems.

Choosing SSL/TLS Protocols and Ciphers

It is possible to customize the protocols and cipher suites used by Windows Server. The configuration information is stored in the registry, in the key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurityProvidersSCHANNEL. For example, to disable the use of SSL 2.0 by default on the server, set the value of HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0ServerDisabledByDefault to the DWORD 1. However, many of the registry values that control these settings are not included by default and must be manually added; this is the case for the previous value.

Fortunately, there is a free graphical tool named IIS Crypto (Figure 15-9) available from Nartac Software² that provides a graphical way to set the protocols, ciphers, hashes, and key exchange methods. It includes a best practices template.

Redirection

An administrator running a site exclusively on SSL/TLS can redirect requests made to the server for http sites to the SSL/TLS protected https site. To do so, the administrator creates a web site running on port 80. From IIS Manager, navigate to the port 80 web site and then select HTTP Redirect (Figure 15-10). Redirect requests made on port 80 to the corresponding https server.