UNIT 2. Internet Information Server

Transcription

1 UIT 2 Internet Information erver

2 Topics in this Unit xamine the features in II7 reate web site content Install, configure an II site ublish an II Web site onfigure web site security

3 The Internet The Internet - global network connecting thousands of individual id networks and millions of users by means of the T/I protocol Internet - a web based network connecting separate individual id networks Intranet - a web based internal network used within a single company Both internet and intranets are accessed using web browsers

4 Internet Terminology World Wide Web (WWW) - The Internet ypertext Transport rotocol (TT) communications protocol that obtains TML formatted documents and that works with FT to transport files over the Internet II 6 supports TT through h windows socket services (winsock) ypertext t Markup Language (TML) programming language used to read and enable documents and graphics images on the World Wide Web

5 Web Browser Web browser - oftware used to communicate with Web sites Uniform esource Locator (UL) convention for locating an Internet site rivate virtual network - n intranet that basically tunnels though the Internet to provide secure network access for individual organizations

6 Microsoft Internet Tools Internet ssistant - Works within Word to format a document with TML tags and to save document as a text file Frontage - Full-scale Web site development tool Microsoft Internet xplorer - Microsoft's free web browser Microsoft Internet Information erver - Microsoft's s web server shipped with 2008 server but not installed

7 II Features II runs as a service on 2008 server ompletely integrated with active Directory upports all TT protocol features an be administered over the internet rovides all of the 2008 security features to web pages an restrict server bandwidth allocated to web services

8 II Manager Interface

9 Windows rocess ctivation ervice Manages the request pipeline, the server s application pools, and the worker processes running in them You must install the W feature, with its sub features, to run the Web erver (II) role Because W now handles incoming requests instead of the W3 service, those requests do not have to be based on TT You can use II7 to implement applications through TT or non-tt Web sites

10 Web erver ole Default ervices tatic ontent Default Document Directory Browsing TT rrors TT Logging g equest Monitor equest Filtering tatic ontent ompression II Management onsole

11 II Web ervices reated automatically when II is installed but run with low priority WWW allows users to publish documents for use on the Web using yper Text Markup Language and etrieves TML documents from servers using the yper Text Transfer rotocol FT - provides file storage and Bidirectional transfer using the File Transfer rotocol T the ews etwork Transport rotocol that allows the server to host newsgroups MT the imple Mail Transport rotocol provides support for sending internet

12 II rogramming g Features I cripts (ommon ateway Interface) - tandard for returning dynamically y created TML documents to the TT service for transmission to a remote client. II (Internet erver pplication rogramming Interface) - Internet programming standard MIM Types (Multimedia Internet Mail xtensions) - standard for the content type of files transmitted over the internet erver side includes L cripts (ractical pplication xtraction and eport Language) g Mostly used for forms ODB allows database integration into a web site

13 II upported Features erver ide Includes hyperlinks, control buttons, etc. Image map handling llows database integration an provide site indexing using M indexing services rovides irtual Web ite upport

14 orts ockets port is a 16-bit T connection number socket is a port and the I (or other protocol) address of the end system needed to form a complete path to the data You can create a private web site by changing the port number in the registry for the server and in the services file for both the client and server

15 II Installation Methods ot installed by default an be installed during the Windows 2008 erver installation an be installed using server manager When installed, II defaults to a lockdown state

16 Installation equirements Windows 2008 erver Disk storage formatted for TF T/I protocol installed ost record for the web server added to D domain If the web server is a member of a domain, it must be able to contact the D during the install Must stop and remove any existing web services and reboot the computer before installing II

17 Testing the Installation Type I address from own browser window Type FQD from own browser window In both of the tests above a page explaining how to configure the server should be loaded epeat both of the tests from another computer In these cases an under construction ti page should be loaded

18 II ecurity II 7 retains a security feature from earlier II versions enabling you to specify I addresses or domain names that t the server should allow or deny access an configure access for a server, Web or FT7 site, virtual directory, folder, or a file owever,,you must install the I and Domain estrictions role service in the Web erver (II) role

19 uthentication roprietary authentication can be created using an II filter with win32 or 64 DK llow nonymous - anyone can visit your site If anonymous access is disabled or access is restricted to using TF access control lists, you can use Basic uses clear textt Integrated Windows uthentication uses Kerberos security which requires the web server to be a member of an D domain ertificate authentication lient computers are authenticated to the Web site via the secured sockets layer (L) technology

20 uthentication Methods nonymous default method for all web sites users log into the server as the anonymous user ll the other methods require adding additional server roles and activation of the authentication must be enabled

21 nonymous User ccess to the web site provided by an anonymous account The default anonymous user account is IU_computername If II is installed on domain controller, the anonymous user becomes a member of the domain If you change either the name or password for IU_computername, you must create a corresponding account on the server If you are strictly an Intranet, you can disable the anonymous user account The user does not log onto the TT, FT or T services. They log onto the 2008 server

22 nonymous User ccount

23 User ccess To prevent anonymous users from accessing a directory emove the guest group from the TF permissions ssign DY to IU_omputername user Users must have log on locally (logon on interactively) rights Users permissions to access the site ontent ead rograms - ead and xecute Database - ead and Write

24 D lient ertification uthentication equirements ctive Directory ertification uthority ecure ockets Layer (L) Domain erver ertificate Map client certificates ctive Directory lient ertificate uthentication only at the server level You cannot configure individual sites or other II 7 elements to use this authentication method

25 Windows uthentication Windows uthentication, Digest uthentication, and Basic uthentication are all challenge-based authentication methods Windows uthentication is the most secure. II 7 s Windows uthentication module supports: TLM version 2 Kerberos

26 Digest uthentication Digest uthentication is also designed for use with intranet t Web servers in an ctive Directory environment works through firewalls and proxy servers because it actually transmits passwords over the network The protocol protects the passwords using a strong MD5 encryption scheme

27 Forms uthentication Forms uthentication is a login/redirection-based method lients attempting to connect to a site using Forms uthentication are redirected to an alternative Web page containing a logon interface The advantage of this method is that the authentication ti ti process occurs at the application level, instead of the operating system level Ideal heavily trafficked intranet sites or an Internet site with publicly available applications an significantly reduce the load on the operating system, diverting it to your application instead

28 UL uthorization II7 UL uthorization uses two major guidelines to evaluate the rules that apply to a specific element: Deny rules supersede allow precedence arent rules supersede child rules

29 andler Mappings In II 7, read, write, script, and execute permissions for the site have been moved to a feature called andler Mappings, which provides additional, more granular, configuration capabilities

30 Feature ermissions

31 TF ermissions lthough UL authorization rules provide an good alternative, TF permissions are still a viable means of controlling access to Web site contents

32 ecure ockets Layer (L) ecure ockets Layer (L) is a security protocol that you can use to encrypt the data exchanged by clients and II servers L requires Obtain and install a server certificate reate an L binding for your Website(s) onfigure the Web site or FT7 site to use L To connect to the server using L, the UL or link must explicitly contain the

33 L for FT7 L for FT7 eliminates one of the major shortcomings of FT: the transmission of passwords in clear text You still need a certificate, although you can use a self-signed certificate You do not need to create a special binding, but you do have to enable e L for the FT site

34 FT uses two separate T connections when establishing a client/server connection. The control channel, port number 21 by default, is for commands the data channel, port number 23 by default, is for the transmission of data files L for FT7

35 ecure ocket Layers rovides user independent encrypted links between an internet server and a client browser L uses public key encryption to provide private secure communication and data protection between the client browser and the web site L is process intensive L will not work unless a certificate is installed L directory ULs begin with TT:// Only one ost eader can be used in conjunction with L

36 Web ite ecurity Install II on an TF partition emove the guest group from all directories except those belonging to your web site Use the L (ecure ocket Layers) protocol to encrypt sensitive data Implement security auditing rect a firewall between the web server and the rest of your network

37 Web ite ermissions ead - llows users to read files from your Web server. In most instances,,you will want this option set for the root of a new site. un scripts - allows the execution of ctive erver ages () scripts on your site xecute - allows the execution of II or I applications on your site. When you enable this option it includes the un scripts option as well. Wit Write allows the use to fill out a form, write to a database or upload a file Browse - II will return an TML representation of the files and subdirectories in the root of your site

38 irtual ervers llow one server to host more than one web site Multiple server names can be registered to one server I address using separate ports Multiple I addresses can be assigned to one I an use one I address, name and port using the ost eaders Option an be used only with WWW ervices an create only one home directory per virtual server cript files in a common directory can apply to all virtual it servers. The scripts directory must tbe under the home directory to apply only to the individual virtual server

39 irtual Directories llow more than one server to store files for one web site ppear as sub directories of the home directory re listed by an alias in the directory structure re not visible in FT so the user must have the UL to connect to the directory

40 II Manager II Manager MM nap In top, start and pause II services Browse Domains dd MIM types onfigure ervices TML manager allows web page dministration ( asp )

41 Internet ervice Manager

42 Key Manager Used to secure data transmission between II and clients accessing it through the network with L services ublic key - data encryption key that is publicly available to any station on network rivate key - data encryption key known only to authorized network stations that are sending and receiving data to and from each other

43 Database Integration annot exceed open database limit equire an ID file ame and location of the.t file ODB data source name (D) QL statements User ID / assword equires only one special license to provide unlimited access through the internet Using different protocol between web and QL server recommended for ecurity

44 Indexing ervices By default indexes the entire web site an limit search scope to improve performance The index files occupy additional space equal to about 40% of the of the space occupied by the data being indexed an be started, stopped or paused from the Indexing ervice MM snap-in

45 ommon rror odes Unauthorized - will request the required user authentication Forbidden - server refuses request normally there is some sort of security error, such as ssl128 required, I address rejected, certificate t required, etc File ot Found - ither the requested resource cannot be found or the virtual directory name has a space in it Internal erver rror such as application restarting, server too busy, asp page error Bad ateway - trying to access a QL server with a bad data source name (D)

46 reating Web ites II creates a default Web site when you install it, but you can create as many additional sites as you wish. ny additional Web sites you create on an II7 server inherit the default server settings unless you modify them manually.

47 dding a irtual Directory

48 ite Bindings II7 is capable of hosting many separate Web sites simultaneously there must have some way of associating each incoming request with a particular Web site The binding for each site determines how the TT protocol listener, http.sys will identify its requests II7 supports three TT binding options: I address ort number ost header

49 ite Bindings Dialog Box

50 Default Document Filenames The Default Document module in II7 includes all of the filenames, plus others supporting ctive erver ages () When you install the Default Document role service in II7, you can specify default filenames for the entire Web server, and for each of the server s Web sites individually When the server processes a request, it checks the directory specified in the UL for each filename in the list sequentially and replies to the client with the first named file that it finds

51 Default Document Filenames

52 Directory Browsing When II7 receives an TT request containing a UL with no filename, and none of the default document filenames exist in the specified folder, the Web server has two choices It can generate an error message, or it can display a directory listing The directory listing enables the user to browse the site s directory structure and select files to display in the browser. Before you can configure Directory Browsing, you must install the Directory Browsing role service in the Web erver (II) role

53 II Web ite Directory

54 Directory Browsing ane

55 Web ite Logging g TT Logging is one of the role services that Windows erver 2008 installs by default with the Web erver (II) role.

56 W3 Logging Fields Dialog Box

57 rror ages When a Web server cannot process a client request, it generates an error code, which specifies the reason for the problem. If a client sends a request for a filename that does not exist, the server generates an TT rror ot Found The code numbers for the errors are standardized di d in the TT specifications, but how the error messages are presented is left up to the Web server implementation

58 II 7 Detailed rror page

59 II 7 ustom rror age

60 rror ages ane

61 dit ustom rror age Dialog Box

62 emoving II To remove II hose the remove all button Then delete the key_local_machine\microsoft\inetstp key in the registry

63 ummary II is a full featured web hosting application with an easy to use interface It provides all the features necessary to larger businesses plus easy database integration ince it can use active directory, it can be used as both an internet web server and an intranet t web server II is used primarily by larger companies that host their own web sites and use other Microsoft server products

64 Lab 2 Task 1: Install II 7 Task 2: reating Web ontent Task 3: reating a Web ite Task 4: reating irtual Directories Task 5: onfiguring I ddress estrictions