The foundation on which IIS will rest is very important. The major steps required are:

Before starting the installation process, review the default installation options and determine if this installation requires additional services and options. Services and options can be added during or after installation. Optional items include services, administration tools, and subcomponents. Table 12-2 lists and describes the IIS services that may be installed.

Installation of IIS is hidden beneath the more generic Application Server, which is a collection of components. If the Application Server is selected for installation and no changes are made during the process, the following subcomponents of the Application Server are installed:

The following subcomponents of IIS are enabled:

To install IIS, begin by opening the Control Panel → Add or Remove Programs → Add/Remove Widows Components. Select the Application Server, as shown in Figure 12-1.

Click the Details button and continue to expand components and select those required for a specific installation. Only install essential components. Components can be installed later if necessary. Click OK until returned to the Windows Components page of the wizard. Click Next. If prompted, provide the installation CD-ROM. Click Finish when installation is complete.

After installation, inspect changes to the server. Note, for example, that the World Wide Web Service is installed and started, as are other services if you selected them during the installation. Note the creation in the filesystem of a webroot folder and Administrative

Figure 12-1. To install IIS, select the Application Server

scripts folder underneath the inetpub folder. This is the default location for the default web site, as well as any other default virtual servers. If installed, an ftproot and mailroot exist as well. The Administrative Scripts folder contains two files: adsutil.vbs (which uses VBScript with Active Directory Service Interfaces, or ADSI, to manipulate the metabase) and synciwam.vbs (used to synchronize the identity of the IWAM account, the identity for out-of-process applications). These are useful learning administrative tools, but the scripts should be removed from the web server. Furthermore, they are unsupported scripts. Supported scripts are installed in the %systemroot%system32 folder. A list of supported scripts can be viewed at http://www.microsoft.com/resources/documentation/IIS/6/all/techref/en-us/iisRG_TAS_37.mspx.

To inspect changes to the server, click Start → Administrative Tools, and open the Internet Information Server (IIS) Manager console. Expand and select the Default Web Site. Note the location of a default .htm file, as shown in Figure 12-2.

Browse to the file location C:inetpubwwwroot and double-click on the iisstart.htm file to open in Internet Explorer. This file is shown in Figure 12-3 and is the page seen by any user who is able to access the default web site at this time. It is simply a placeholder page that tells everyone that the site is “Under construction” This allows you to test connectivity to the web site. The default web site is mapped to the default AD domain. To use other domains, create new web sites. Creating new web sites is described in the section "Creating a Web Site" later in this chapter.

Figure 12-2. Files in the home directory folder are displayed in the IIS Manager console

Figure 12-3. A default home page is created for the default web site

Each web site must have a home directory , which is the central location of published web pages (including a home page or index file to serve as a portal to other pages). The home directory includes subfolders that contain application code or content. The home directory is mapped to domain name of web site or name of the web server. Web sites can also store web content in a virtual directory. Web site content can be located in folders underneath the home directory, or in folders elsewhere. When folders outside of the home directory path are used, they are called virtual directories.

To create a web site, begin by creating a folder in the NTFS filesystem on a disk volume other than the system volume. Open the Internet Information Services (IIS) Manager. Right-click the Web sites folder, select New, and then “Create a web site.” Enter a description for the site and click Next. Select the IP address and port number to be used for the site, and then click Next. (Each web site hosted on a single server must have either a unique IP address, a unique port or a unique host header. Host headers let you identify multiple domains on a single web server.) Enter or browse to the file folder location that will be used for the web site and click Next. If anonymous access to the site will not be allowed, clear the “Allow anonymous access” checkbox. Click Next. Modify the default “Web permissions” for the site. Table 12-3 explains the permissions shown in Figure 12-4. Click Next, followed by Finish.

Figure 12-4. Set permissions during install; they can be modified later as well

A virtual directory is a folder that is not a subfolder of the home directory, but is configured so that it can be addressed using a folder name. The virtual directory can be a physical directory on the web server, or in a Uniform Naming Convention (UNC) addressable location. Figure 12-5 provides an example of a virtual directory. In the figure, the home directory of the peaceweaver.com web site is the file folder peaceweaver on drive F of the server. Another folder on the same server, the p-catalog folder, represents a virtual directory. When created, it was given an alias of products. Its content can be accessed using the http://peaceweaver.com/products address. You should use an alias (or assigned name) for the virtual directory because it hides the directory name and because it may make it easier to use. Ease of use might mean an alias that better fits the content, or an alias that is shorter than the directory name. In this case, virtual folders containing other catalogs for other web sites can be created and might use an abbreviated first-letter hyphenated catalog name. In addition to the http://peaceweaver.com/products address, another alias and its server address might be http://somewebsitename.com/products. You can use the same alias name for multiple virtual directories if they are located on different web sites. In this case, the alias for each can be products, since the complete address for each will include a different web site.

To create a virtual directory, you should first create the folder in the NTFS filesystem on a disk volume other than the system volume. This improves security and performance.

To create a virtual directory using IIS Manager, begin by opening the IIS Manager console. Expand the Web sites folder and expand the web site to which a virtual folder will be added. Right-click the web site or folder. Select New, then click Virtual Directory, and then click Next. Enter a name for the virtual directory in the Alias box, as shown in Figure 12-6, and then click Next.

Figure 12-5. Note that folders must be created prior to virtual directory creation

Figure 12-6. Enter an alias for the virtual directory

Enter (or Browse to) the path of the physical directory to be used and then click Next. Select the checkboxes for the access permission to assign for users and then click Next followed by Finish. (The permissions mentioned here and in the next paragraph are the web permissions explained in the next section, "Managing IIS Permissions.”)

To create a virtual directory using Windows Explorer, begin by opening Windows Explorer. Right-click the folder to be used by the virtual directory and click Properties. Click the Web Sharing tab. Click “Share this folder.” In the Edit Alias box, enter the name for the virtual directory. Select the checkboxes under Access Permissions for the types of access to grant. Click OK twice.

Permissions should be set both at the file level, using NTFS and at the web server level using IIS web permissions. Don’t confuse web permissions with NTFS file permissions. One controls access through web connections, and the other provides control through filesystem access. Both permission sets do impact web access, but only file permissions affect local access. If NTFS permissions and IIS permissions conflict, the more restrictive permission applies. To set web permissions for a web site, right-click on the web site in Internet Information Services Manager and select Properties. Then select the Home Directory tab. The Home Directory tab also provides information on data location and application configuration, things that are not related to setting web permissions. To set permissions directly in the filesystem for a virtual directory, use the Web Sharing tab in Explorer, as described in the previous section. Figure 12-7 displays the Home Directory property page for a web site. Table 12-4 lists and describes IIS permissions. Note that during web site creation, it is possible to configure the web site to allow scripts to run. The “Scripts only” permission must be selected from the “Execute permissions” drop-down list in order to provide the appropriate permissions.

Figure 12-7. Configure permissions on the Home Directory page of the web site properties

Web permissions can also be set on virtual directories and on files in the same manner. If file properties are examined in IIS, the File tab is used (Figure 12-8) instead of the Home Directory tab shown in Figure 12-7. The File tab is located on the properties pages for each file. To configure these permissions, right-click the file in the details pane of the Internet Information Server Manager and select Properties. Since you are configuring permissions for a file and not a web site, the directory browsing permission is not present. Script or program execution and indexing a web site are also possible directory level permissions.

Figure 12-8. Configure file web permissions

There are several possible user authentication methods that are configurable for web sites and applications. These methods should be selected and configured based on the requirements of the applications that are supported. Authentication methods can be anonymous or require the use of individual user accounts. They can also require that user credentials be encrypted and thus protected from possible capture and reuse by unauthorized persons or software. Authentication choices may also be dependent upon the web browser used by the clients. To select and configure the right authentication method for a web site and application, all of these things must be considered. Table 12-5 lists and describes authentication methods that do provide some protection for user credentials.

In addition to these authentication methods, another authentication method that requires the use of user credentials is the Basic authentication method. Requiring Secure Socket Layer (SSL) connection can protect this method, which otherwise passes user credentials in the clear. When SSL is used, the entire session is encrypted including the credentials exchange. Using the combination of Basic authentication and SSL is often the best solution since it does not require a specific client, does not require Active Directory, and only requires that the server have an appropriate certificate and associated private key. Unlike client certificates, it is practical to implement SSL without a PKI as only one certificate is required.

    rundll32 %systemroot%system32iissuba.dall, RegisterIISSUBA

    rundll32 systemrootsyste32iissuba.dll,UnregisterIISSUBA

To configure authentication, obtain any certificates and perform any server-side configuration for the authentication types that will be selected in IIS. Open the IIS Manager console. Right-click the site, directory or file to configure authentication for, and then click Properties. Click the Directory Security tab (click the File Security tab if you are configuring a file). Click Edit in the “Authentication and access control” section. To enable or disable anonymous authentication, click to select or deselect the “Enable anonymous access” checkbox. If anonymous authentication is enabled, enter or browse to the valid user account for anonymous access. To configure other authentication choices, click the checkbox in the “Authenticated access” box, as shown in Figure 12-9.

Web site configuration consists of adjusting a number of properties by using the IIS Manager, directly editing the metabase, or using scripts. While scripting may be a more efficient way to manage multiple web sites, using the IIS Manager is more efficient and less prone to error when managing a single site or when only occasional administration is required. The IIS Manager is opened from Start → Administrative Tools → Internet Information Server. The following administrative tasks are common ones that you should be familiar with:

Figure 12-9. Configuring authentication

Configuring access

To configure access by computer IP address, domain name, or subnet range for web sites, applications, or files, begin by opening the IIS Manager console. To configure IP address and domain name restrictions, click the Directory Security or File Security tab. Click the IP address and domain name section Edit button to display choices shown in Figure 12-10.

Select “Granted access” to explicitly deny an IP address subnet or domain access by using the “Except the following:” box. Select “Denied access” to explicitly grant an IP address subnet or domain access by using the “Except the following:” box.

To add a single computer as an exception, click Add and then click “Single computer.” Click “DNS lookup” to search for computers or domains by name rather than by IP address. Enter the DNS name for the computer. To add a subnet of computers to the exception list, use the “Group of computers” selection instead of the “Single computer” selection, and then add the Network ID and “Subnet mask” box

Figure 12-10. Configure IP address/domain name restrictions

to specify a subnet. To grant or deny access to a domain, use the “Domain name” box. Note that if exceptions are managed by IP address, changing the IP address of a computer will mean that the exception no longer applies.

Setting MIME

Setting MIME is important because IIS will only recognize those file types that you’ve defined. Remove those MIME types not used to avoid possible exploits coded using them. Add new types as necessary to accommodate application requirements. MIME types can also be edited to create a better description or to correct the extension.

To change MIME types, begin by opening the IIS Manager console. Right-click on the local computer and select Properties. Click the “MIME types” button to display the current list, as shown in Figure 12-11.

Figure 12-11. Add, delete, or edit MIME types

To add a MIME type, click New and then enter a file extension and description. Then click OK. To remove a MIME type, select a MIME type from the “Registered MIME types (file extensions)” list and then click Remove. Click OK three times to exit.

Configuring logging

Logging at the web site level is enabled by default. To configure logging, begin by opening the IIS Manager console. Expand the local computer ikon, then expand the Web Sites or FTP Sites directory, and then right-click on the web or FTP site to enable logging. Click Properties. To enable logging for a virtual directory, right-click the virtual directory and click Properties. Click the “Enable logging” checkbox. Select a log file format. Table 12-6 defines the log file formats.

Table 12-6. Log file formats

File format	Description
W3C Extended log file format	Text-based, and customizable for a single site (the default).
National Center for Supercomputing Application (NCSA) Common log file format	Text-based and fixed format for a single site.
IIS log file format	Text-based, and fixed format for a single site.
ODBC logging	Fixed format for a single site. Data can be stored in an ODBC-compliant database (such as SQL Server).
Centralized binary logging	Binary-based, unformatted data. Not customizable. Data can be collected in a central location and can combine data from multiple web sites. A special parser is required to read the logs.
http.sys error logging	Fixed format for http.sys-generated errors.
UTF-8 Format	To read text-based (W3C extended, IIS, and NCSA Common) log files in languages other than English, enable UTF-8. (UTF-8 is configured by checking the “Encode Web logs in UTF-8” checkbox in the local computer properties.)

Logs are stored by default at the %systemroot%system32logfiles folder. Click the Properties button to configure a different log location, or schedule the frequency of log creation, as shown in Figure 12-12.

Figure 12-12. Configure log files

Use the Advanced tab shown in Figure 12-13 to modify the information that is collected in the log (if the format is W3C).

Figure 12-13. Configure log file data

Click OK twice.

When changing the log file location, configure NTFS security to match that of the default. The default file security is Administrators and SYSTEM Full Control. No user access is configured (nor is it required).

Enabling and configuring extensions

To enable extensions, open the IIS Manager console. Expand the local computer and click Web Service Extensions, as shown in Figure 12-14.

Figure 12-14. Allow or prohibit extensions

In the Details pane on the right of the screen, select a web service extension to disable or enable it. Click Allow to enable the extensions, or click Prohibit to disable the extension.

If an HTTP request handler (a programmed module created to respond to HTTP requests such as requests for URLs or URL extensions within an application) is not in the list of web service extensions, you must register it by adding the HTTP request handler to the list of web service extensions. To do so, open the IIS Manager console and select the desired web service extensions. In the details pane on the right of the screen, click “Add a new web service extension” and then click Add. Enter or browse to the extension’s path. If desired, click the “Set extension status to Allowed” checkbox. Click OK.

To allow an application to call a web service extension, open the IIS Manager console. Expand the local computer and click Web Service Extensions. In the details pane on the right of the screen, click “Allow all web service extensions for a specific application.” Select the name of the application from the Application list box.

To prohibit all web service extensions, open the IIS Manager console. Expand the local computer and click Web Service Extensions. Click “Prohibit all Web service extensions” and click Yes.

You should review web server security prior to placing a web server in production. Periodic review of a production web server should also be done. The security review should include the location for the web server, the server and web server security hardening, and the security policy (written rules) and posture (actual practice) of the organization. Security hardening for IIS should include the following:

When the IIS Manager console is used to configure IIS, changes are written to the IIS metabase, an XML file that represents IIS configuration. In addition to IIS Manager-based changes, some configuration steps are only done by directly editing the metabase file. An IIS administrator should become familiar with the metabase file and comfortable enough to work with it as necessary. However, caution should be used, since improper changes to the file can make the web server, a web site, or an application inoperable.

In addition to the metabase file, metabase.xml, predefined information properties for the metabase are described in the metabase schema file, MBSSchema.xml. Both files are located at %systemroot%system32inetserv and can be edited by using a text editor. If necessary, the metabase can be edited while IIS is running by enabling the edit-while-running feature described next. After the edit is complete, and the file is saved, the properties will be replaced in the in-memory metabase. IIS maintains a history of changes made to the metabase file and saved to disk. Metabase history files are saved using the HistoryMajorVersionNumber property of the metabase file. Files are saved in the systemrootsystem32inetsrvhistory folder.

To enable the edit-while-running option, begin by opening the IIS Manager console. Right-click the local computer and select Properties, as shown in Figure 12-15.

Select Enable Direct Metabase Edit checkbox. Click OK.

The metabase can be backed up by using the IIS Manager or the command-line script issback.vbs, which is located in the %systemroot%System32 directory. Two types of backup can be created: a portable backup that can be restored to another server, and a nonportable backup that can only be restored to the same server. The type of backup created depends on whether a password or the machine keys are used to encrypt secure metabase properties.

To create a backup, begin by opening the IIS Manager console. Right-click the local computer and select All Tasks, then select Backup/Restore Configuration. Click Create Backup. Enter a name for the backup file. To make the backup portable, select

Figure 12-15. Configure direct metabase edit

the “Encrypt backup using password” checkbox and enter a password in both the Password box and the “Confirm password” box. Click OK and then click Close. A copy of the metabase is created in the %systemroot%System32inetsrvMetaBack folder.

To restore the backup, begin by opening the IIS Manager console. Right-click the local computer and select All Tasks, then select Backup/Restore. Click the version of the Automatic Backup file to use in the restore and click Restore. If prompted for a password, enter the password used when creating the backup.

Although backing up the metabase is important, a complete backup of the web server should also be performed regularly. A complete backup includes the backup of all the web sites, applications, and data stored on the web server. It also includes a backup of the System State and of the boot and system volumes, as well as the metabase. In addition to a regular backup, a complete web server backup should be performed before migration, before allowing client access to a newly created web site or application, or before changing configuration settings on an existing web server. Backup files can be saved to hard disk, or other removable or nonremovable media. ntbackup.exe and third-party backup programs can be used.

To back up using ntbackup.exe, click Start → All Programs → Accessories → System Tools → Backup. Click Advanced Mode. Click the Backup tab. Select the System State checkbox on the left side of the screen, as shown in Figure 12-16, then select the boot and system volume.

Figure 12-16. Backup the System State and other critical server and web server files

Select web server data, including the backup destination type and media or filename. Select the file or tape location in the “Backup destination” drop-down box. Enter a file path or select the tape to use, respectively, in the “Backup media or file name” text box. Click Tools and then click Options and complete options such as backup type and log file type. Then click OK. Use the Advanced button to set such advanced backup options as data verification or hardware compression. Then click OK. When you have selected all the appropriate options, click Start Backup.

To restore using ntbackup.exe, click Start → All Programs → Accessories → System Tools → Backup. Click the Advanced Mode. Click Restore and Manage Media and then expand the media item that contains the backup. Select the System State box for that file. Select other data to restore. Click “Original location” if backups should be placed in the same folder or folders as they were when backed up. Or, click “Alternate location” and designate a folder. The folder structure of the backup will be preserved. Click the Tools menu and then click Options. Click the Restore tab and then select either “Do not replace the file on my computer to retain files remaining on the disk” (these files may be more recent versions) or “Replace the file on disk only if the file on disk is older,” or check “Always replace the file on my computer.” Click OK. Click Start Restore. Use the Advanced button for other options such as restoring security settings.

SSL is a method that can provide clients with a way to authenticate the server they are connected to. Authenticating the server means to verify that it is who it says it is; SSL provides encryption of the communications between client and server. Web sites can be configured to accept or require SSL connections. To do so requires a server certificate. The use of client certificates is optional, but can provide additional security since the clients are then able to authenticate to the server. In most cases, however, SSL is configured to require a server certificate only.

The certificate can be either purchased from a public Certification Authority (CA) or produced by a Microsoft or third-party CA operated by your organization. When a browser client is used for an SSL connection to a web site, the server presents its certificate and the browser client performs a number of tests, including checking its certificate store to determine if a trusted CA issued the certificate. A trusted CA is a CA for which a copy of its server certificate is stored in the browsers Trusted store. The public key stored in the certificate can be used to validate the signature of the issued server certificate signed by the associated CA private key. If the certificate is not available, the client cannot validate the certificate. The client then provides a warning to the user.

Because the certificate provided by the public CA can be validated by most (if not all) browser clients, it is better to obtain an SSL certificate from a public CA for e-commerce and for other sites that expect connections from the public. Privately produced SSL certificates may better serve private, or intranet sites. To facilitate their use, clients will need a copy of the CA certificate to be able to validate the server certificate.

To configure IIS 6.0 to use SSL, you generally must do the following:

Requesting a certificate

To request a SSL certificate, begin by opening the IIS Manager console. Right-click on the web site the that certificate will be used in and select Properties. Select the Directory Security page and then click the Server Certificate button in the Secure Communications section and then click Next. Click Create a New Certificate (as shown in Figure 12-17) and then click Next.

Click “Prepare the request now,” but send it later, as shown in Figure 12-18. Then click Next.

Enter a name for the certificate. Change the key strength, if required, by entering the information on this page and then click Next. Key strength (or length) is important because, in general, the longer the key, the more secure the communication. However, longer keys can mean slower communications, and more expense if certificates

Figure 12-17. Create a certificate request

Figure 12-18. Select whether to submit the request or do so later

are purchased. Enter the organization name and department name (“Organizational unit”), as shown in Figure 12-19. Click Next.

Enter the common name and then click Next. This should be the fully qualified domain name (FQDN) for the web server domain if the server will be on the Internet, but can be the server NetBIOS name if the web server will be on the intranet. Enter city, state, and country information, and then click Next. Browse to a location to save the certificate file and click OK. The file is saved as a text file and given a .cer extension.

The certificate request must be submitted to a CA to receive a certificate. When using a public CA, follow the instructions provided by the CA. If you are using a non-Microsoft CA, follow the CA instructions. If you are using a Microsoft CA, copy the certificate text file produced in the previous steps to the CA, and use these instructions.

At the CA, browse to the CA’s web site (for example, http://localhost/crtsrv). Click Request a Certificate. Click Advanced Certificate Request. Click “Submit a certificate

Figure 12-19. Add organization information

request using a base 64 Encoded CMC or PKCS # 10 file or submit a renewal request using a base 64 Encoded PCKS #7 file.” Click Browse to look for a file to insert and browse to the location of the saved certificate request file created earlier in this section. Use the certificate template drop-down list to select Web Server and then click Submit to submit the request.

If the certificate request must be approved, a warning will appear, indicating that an administrator with appropriate permissions on the CA must approve the request. The certificate must be downloaded after approval. If the CA is configured to automatically approve the request, the certificate will be issued.

Select “Download certificate” and browse to a location to store the certificate file.

Configuring the web site to require SSL

Once the certificate is installed, it can be used to create an HTTPS connection to the web server. However, HTTP connections will still be allowed unless the web server is configured to require an SSL connection. To require an SSL connection return to the

Figure 12-20. Install the certificate from a file

Directory Security property page (as explained previously), click Edit, and select Require Secure Channel (SSL).

FTP is not installed by default. To install an FTP server, use the Control Panel → Add/Remove Programs → Add/Remove Windows Components applet. The FTP service is an Application Server component. To configure the server, you must provide a root level file folder and subfolders for FTP content. If user isolation will be used, you must create a subfolder entitled LocalUser, a subfolder called LocalUserPublic, and subfolders under LocalUser for every user who will have the right to store and/or use files on the FTP server. The user subfolders should be of the form <FTProot><LocalUser><UserName> if local users will be accessing the server, and <FTProot><DomainName><UserName> if Active Directory user accounts will be used.

In our discussion on configuring FTP, we will look at the following tasks:

Creating an FTP site

To create an FTP site, begin by opening the IIS Manager console. Right-click on the local computer and select New, then “Create an FTP site.” Enter a name for the site and then click Next. Select an IP address and port number to be used, and then click Next. Every FTP site on the same server must have a unique IP address or port. Select FTP isolation mode required and then click Next. In Figure 12-21, the user isolation mode is selected. The default is no isolation. Table 12-7 describes the FTP user isolation modes.

Figure 12-21. Configure user isolation

Table 12-7. User isolation modes

Isolation mode	Description
Do not isolate users	Users may gain access to the home directory of other users.
Isolate users	Each user has his or her own directory. To the users, it looks like the FTP root.
Isolate users using Active Directory	The FTP service is integrated with Active Directory to retrieve home directory information for users. The Active Directory user object is extended with properties to hold the FTP root (the FTP share) and FTP directory (the relative path to the user’s home directory. A script (%systemroot%system32iisftp.vbs) can be used to get and set the properties.

Configure access permissions, as shown in Figure 12-22, and then click Next. Click Finish.

Figure 12-22. Configure access permissions

Configuring FTP authentication

You must configure authentication for FTP separately from authentication for HTTP. FTP authentication is either anonymous FTP or basic FTP. Anonymous FTP authentication requires no user credentials, while basic FTP authentication requires a username and password. Unfortunately, basic FTP authentication sends credentials in plain text.

To configure FTP authentication, open the IIS Manager console and select “FTP sites.” In the detail pane on the right side of the screen as shown in Figure 12-23, right-click the FTP site, directory, virtual directory, or file to configure. Then select Properties.

Click the Security Accounts tab. To allow anonymous connections, select the “Allow anonymous connections” checkbox as shown in Figure 12-24. Enter the username and password for the anonymous logon username.

To enable basic FTP Authentication, clear the “Allow anonymous connections” checkbox. Click OK.

Figure 12-23. Locate the site

Figure 12-24. Configure authentication

Setting up an FTP site concludes the discussion on basic administration tasks for IIS . You should now feel comfortable creating web sites, configuring authentication and permissions, as well as configuring SSL and creating virtual directories. There are other operations that you may be required to perform. One of the lesser known is configuring IIS mail services . While this process can be quite complex, you should know a little bit about the IIS mail services that are available.

The SMTP service is not installed by default, but can be installed by using the Add Windows Components program. The SMTP service is an Application Server component. However, the POP3 service must be installed from the E-mail Services section of Windows Components. When SMTP is installed, a default SMTP virtual server is created. The default virtual server is set to monitor the default domain. To set additional virtual SMTP servers to monitor additional domains create a new virtual SMTP server:

If a new IP address will be used by the SMTP service, configure the IP address before creating the virtual server. Create a folder to hold SMTP folders and files. When the new SMTP virtual server is created, the folders identified in Table 12-8 will be created.

Open the IIS Manager console. Right-click the computer and select SMTP Virtual Server. Enter a name for the web site. Use the IP drop-down list to select an available IP address. Choose All Unasssigned to allow SMTP to respond on all unassigned IP addresses configured on the server. Each SMTP server must have a unique IP address or port. Click Next. Enter the path to the directory to be used for the mail root. Specify the default domain for the virtual server. Click Finish.

To stop, start, and pause SMTP, begin by opening the IIS Manager console. Select the local computer. Right-click the virtual server and click Stop to stop the server, or Pause to pause it. To restart a paused server, click Pause again. To start a stopped server, click Start.

To stop and start POP3, select Start → All Programs → Administrative Tools. Click POP3. Right-click the computer icon and select Connect. On the resulting shortcuts menu, choose All Tasks and then choose to stop, start, or pause the service.

To configure an SMTP virtual server, begin by opening the IIS Manager console. Right-click on the SMTP virtual server and select Properties. To change the IP address used, use the “IP address” drop-down list. To change the port, click the Advanced button. Select the IP address to configure and click Edit. Enter a new port number and click OK. The Advanced tab can be used to add multiple IP addresses and multiple ports on which the SMTP server can listen.

By default, the SMTP service is configured not to relay mail. This is important, since it prevents the SMTP server from being used to distribute spam. Unfortunately, it also prevents the SMTP service from forwarding mail to a mail gateway. You can configure the SMTP service to relay mail to and from a specific mail server used as a mail gateway. To do so, create a remote domain that represents the mail gateway, and configure the remote domain and the local SMTP virtual server to relay mail.

Begin by opening the IIS Manager console. Expand the virtual SMTP server entry and select Domain to see the default domain, as shown in Figure 12-25.

Figure 12-25. Domains can be local, as is the default domain here, or remote

Right-click a domain and click New. Then select Domain. Select Remote as the domain type and then click Next. Enter the domain address space (that is, the DNS domain name of the remote domain). Click Finish.

In the IIS Manager console, select the SMTP virtual server Domain node and right-click the remote domain entry. Select Properties. On the General page, set the properties for routing and securing message delivery. Click “Allow incoming mail to be relayed to this domain,” as shown in Figure 12-26. Click OK.

Monitoring SMTP entails more than checking to see that the service is running. Logging should be configured, logs reviewed, and the mail folder should be monitored, as described in Table 12-6. User sessions can also be monitored and disconnected if necessary.

A user session starts when a user connects to a virtual server. User sessions are tracked separately and can be manually disconnected. To do so, begin by opening the IIS Manager console. Double-click the virtual SMTP server. Select the “Current sessions” node for the server. In the detail pane on the right of the screen, right-click the session and select Terminate. To disconnect all users, right-click in the detail pane and select “Terminate all.”

Figure 12-26. Configure mail relay to a mail gateway

To monitor SMTP activity, you should enable and configure logging. To do so, begin by opening the IIS Manager console. Right-click the virtual SMTP server and select Properties. To enable logging, check the “Enable logging” box. To change the logging file format, use the “Active log format” box.

This brief introduction to mail services in IIS is not meant to make you an SMTP expert, but rather to give you a glimpse into what’s available should you want to provide such services for IIS applications. The main purpose of IIS is, of course, as a basis for web applications. Web applications should be written by those who understand not just web server administration, but how to translate application requirements into production quality applications that fulfill them. Application authors are responsible for detailing which IIS services and extensions are required. As an administrator, you should understand how to install and run IIS applications as described next.

Session state data is per-user and per-application data that can be retrieved across multiple requests. The data is typically cached by the application and is the total of the data generated by the user during one connection to the server. Session state data is independent of other sessions and does not survive the user session. Session state is also not part of the HTTP protocol, but rather is an abstraction layer built by the server-side environment (such as our asp.net example). The data is stored in components called providers. The example asp.net application can use three different providers: InProc (or in-process storage, which means the data is kept by the worker process assigned to the application; a worker process is user-level code that is used to process requests), StateServer (an out-of-process store that is kept by a separate worker process), and SQLServer (an out-of-process store in a SQL server table). If an in-process provider is used, and the application is recycled, all session state data is lost. If an out-of-process provider is used and the application is recycled, the session state data is maintained.

Many web servers host multiple web sites and applications. For example, an Internet Service Provider (ISP) may host hundreds of web sites and applications for hundreds of organizations. Some web sites will require a dedicated server, but many will be hosted together with others on the same server. Organizations may also host several of their own unique web sites and want to make use of a single server. When multiple sites and applications are hosted on a single server, you should provide some isolation to ensure availability, improve performance, and enhance security. Isolation is the process by which web sites and applications are kept separated and prevented from having an impact on each other. This can be accomplished in a number of ways, including providing them their own disk or subdirectories, their own worker processes, and their own security context.

IIS 6.0 can run in two different application isolation modes : the IIS 5.0 isolation mode and the IIS 6.0 worker process isolation mode. Running applications in isolation mode provides better security and availability because application code can be separated from the web server code and from other applications. IIS 6.0 worker process isolation mode is superior to IIS 5.0 isolation mode because it runs all application code in an isolated environment without a performance penalty. IIS 5.0 isolation mode is available for backward compatibility with those applications that depend on its behavior.

All new installations of IIS 6.0 will default to worker process isolation mode, while all upgrades of IIS 5.0 to IIS 6.0 will default to IIS 5.0 isolation mode. To change from one mode to another, open the IIS Manager console. Right-click on the Web Sites node and select Properties. Select the Service tab. Change the checkbox of the “Run WWW service in IIS 5.0 isolation mode,” as shown in Figure 12-27. (Enabling this box with a check runs IIS 50; clearing the box runs worker process isolation mode.) Click OK.

Figure 12-27. Change process isolation mode

Worker process isolation mode supports multiple application pools, each of which can have a different configuration. Worker process application mode provides the following improvements to performance, availability, and security:

When multiple applications and/or web sites will be hosted on a single server, the applications and web sites should be assigned to application pools and the applications pools should be configured. To do so requires thought as to the best assignment. It is not always the best choice to simply assign every application to its own application pool. Doing so may increase administration efforts and provide a diminishing return on performance and availability.

For best results, follow these steps:

Creating and configuring application pools

To create an application pool, begin by opening the IIS Manager console. Right-click “Application pools,” select New, and then select Application Pool. Enter a name for the new application pool, as shown in Figure 12-28 and then click OK.

Figure 12-28. Create a new application pool

To assign a service account (that is, configure the identity) for an application pool, first expand the local computer in the Internet Information Services Manager and expand Application Pools. Right-click the application pool to configure and click Properties. Click the Identity tab, as shown in Figure 12-29. Click either Predefined (use a standard service account such as Network Service, Local Service, or Local System) or Configurable (use an account created).

Use the drop-down list box to select a Predefined account or use the “User name” and Password boxes in the Configurable section to enter the username and password of the account. Click OK.

To assign web sites and applications to an application pool, begin by opening the IIS Manager console. Right-click “Web site” and select Properties. Select the Home

Figure 12-29. Assign an identity to the application pool

Directory tab. In the “Application pool” field, use the drop-down list to select the application pool, as shown in Figure 12-30.

Figure 12-30. Assign an application pool to a web site

Monitoring the health of application pools

There are many settings that can be used to detect Application Pool health, to keep applications running efficiently, and to improve performance.

IIS 6.0 supports application availability by detecting problems with worker processes and taking action based on the problem detected. The basic detection method is a ping, and the action taken is based on the worker process response. If the worker process doesn’t respond, it is considered unavailable. The worker process may respond to the ping by requesting a recycle. Adjust the ping response time property (that is, the interval between pings to the worker process) to accommodate the specifics of applications and servers on the organization’s network. The ping response time should not be set too short, as normally busy worker processes will take some time to respond; and a too short ping response time may cause a shutdown of a healthy worker process.

Worker process pinging is enabled by default. To manage worker process pinging, open the IIS manager console, right-click on the application pool, and select Properties. Click the Health tab. To modify worker process pinging, select the “Enable pinging” checkbox, as shown in Figure 12-31.

Figure 12-31. Enable and configure pinging

Enter the number of seconds before the worker process should be pinged. To configure rapid-fail protection, select “Enable rapid-fail protection” checkbox. Rapid fail protection disables the application pool if a selected number of failures occur within a selected number of minutes. This prevents a damaged application from continuing to needlessly consume resources. Enter the maximum number of failures allowed. Enter the “Time Period (in minutes)” during which the number of failures is counted. In the “Startup time limit” box, enter the time in seconds in which the Worker process must start up. In the “Shutdown time limit” field, enter the time (in seconds) to elapse before shutting down a failing worker process. Click OK.

Recycling worker processes

Misbehaving worker processes can be stopped and restarted. This process is often called process recycling, but is sometimes referred to as application recycling. Process recycling can be configured based on the following properties:

Elapsed time

Specify the number of minutes after which the worker process should be recycled. If applications have problems running for long time periods, determine the maximum amount of time they can run and set the elapsed time for less than that time.

Number of requests

Specify the number of HTTP requests that can be processed before the worker process should be recycled. If applications are failing after a given number of HTTP requests, set the number for less than that number.

Scheduled times

Specify the time within a 24-hour period when a worker process should be recycled. This should be a frequency that prevents an application from failing.

Virtual memory

Specify the amount of virtual memory the worker process can use before it must be recycled. When applications reserve memory multiple times, the memory heap becomes fragmented and there is a steady rise in the amount of virtual memory used. Start with less than 70 percent of available virtual memory, monitor the worker processes memory usage, and adjust this figure.

Used memory

Specify the amount of memory used by the W3wp.exe process before the worker process should be recycled. If an application has memory leaks, the amount of memory used will continue to increase. Set to less than 60 percent of available memory.

On demand

Specify that worker process recycling occurs via the use of the MMC console or a script that requests recycling of an application pool.

To immediately recycle the worker processes assigned to an application pool, expand the local computer node from the IIS Manager console and right-click the application pool. Then click Recycle. To configure a worker process to be recycled after a set elapsed time, right-click the application pool in the IIS Manager console and then click Properties. Select the Recycling tab, as shown in Figure 12-32.

Select the “Recycle worker processes (in minutes)” checkbox. Enter the number of minutes to elapse before the worker process is recycled. To configure the worker process to be recycled after a number of processing requests, select “Recycle worker process (number of requests)” and enter the number of requests to be processed before worker process recycling. To configure the worker process to be recycled at scheduled

Figure 12-32. Configure recycling

times, select the “Recycle worker process at the following times” checkbox. Click Add to add a time to the list, Remove to delete a time, or Edit to change a time. To configure a worker process to be recycled after consuming a set amount of memory, select the “Maximum virtual memory (in megabytes)” checkbox. Enter the maximum amount of virtual memory allowed before the worker process is recycled. Memory consumption can also be limited by clicking the “Maximum used memory (in megabytes)” and entering the maximum amount of memory to be used before the process is recycled. Click OK to apply the changes.

Many of the application pool configurations will improve web server and application performance since they limit memory use, constrain or stop misbehaving applications and so on. Other performance settings are also available.

To configure application pool performance, begin by opening the IIS Manager console. Expand the local computer and right-click the application pool. Select the Performance tab, as shown in Figure 12-33.

In the Idle Timeout areas, select “Shutdown worker process after being idle for (time in minutes)” checkbox. Enter the number of minutes before the worker process will be recycled. To configure a request queue limit, select “Limit the kernel request queue (number of requests)” checkbox. Enter the maximum number of requests to allow in the request queue limit field. To configure CPU monitoring, select the “Enable CPU monitoring” checkbox. Enter the percent maximum CPU threshold in the “Maximum CPU use (percentage)” checkbox. Enter the number of minutes before the CPU usage numbers are refreshed in the “Refresh CPU usage numbers (in minutes)” field. Use the “Action performed when CPU usage exceeds maximum CPU use” drop-down box to select an action to take. To configure a web garden

Figure 12-33. Configure performance

(that is, assign multiple worker processes), use the “Web garden maximum number of worker processes” text box and enter the number of worker processes to assign to the application pool. When you have finished configuring the performance, click OK.