Wanted to postback to this article by Wade on the IIS team.

He summarizes this issue really well - in particular that topics lose focus due to a the many posts and lack of the ability to see information chronologically sorted in searching.

http://blogs.iis.net/wadeh/archive/2008/12/18/how-iis-can-help-with-sql-injection.aspx

Keep in mind that as he points out early on, request filtering for SQL inhections is a band-aid. Your appliciations should be written so they do not allow passing of invalid or risky strings to the server.

Thanks!

-brett

Somehow I started revisiting Log Parser resources and links today and wanted to post a few things. If you don't know about Logparser and you manage an IIS server or set of servers (almost any type), then stop what you're doing and go to http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1287 , download and smile.

It slices , it dices, it reads multiple log file formats using a SQL like syntax and outputs into multiple formats. The guys at Microsoft.com swear by this jewel.  (PS read anything, ANYTHING written by Jeffery Johnson).  

Here's a visual wrapper that may be helpful. I haven't used it and it's still beta, so don't know how buggy it is or not. http://www.codeplex.com/visuallogparser 

Don't miss this as free online logparser resource that appears to be very active forum.

http://forums.iis.net/default.aspx?GroupID=51

And check this out: http://www.amazon.com/Microsoft-Parser-Toolkit-Gabriele-Giuseppini/dp/1932266526 by Gabriele Giuseppini, who wrote the first 3 version of the tool.

Hope the holidays are treating you well!

-brett

Here's an interesting blog post

http://blogs.technet.com/keithcombs/archive/2008/12/16/running-lamp-on-windows-server-2008-webcast-and-screencasts-now-available.aspx

discussing running most of the LAMP stack on Windows. Controversial! You bet. But if i told you two years ago that IIS would have FASTCGI that would have been met with disbelief as well.

-brett

IIS Admins. I am shamelssly pasting this anncoucment from the IIS team here. Very nice tool that leverages the new extensible IIS 7 pipeline, configuraiton system, and UI.

-brett

-----------------------------------------------------------

Install the URL Rewrite Module for IIS 7.0 RTW today!

Microsoft URL Rewrite Module for IIS 7.0 RTW (x86)

Microsoft URL Rewrite Module for IIS 7.0 RTW (x64)

Upgrade from Go Live release

If you already have Go Live release of URL Rewrite module installed then the installation package will upgrade it to RTW release. All rewrite rules in applicationHost.config and web.config files will be preserved. Note that system reboot may be necessary when upgrading from Go Live to RTW release.

ASP.NET update

The installer for URL Rewrite module includes an update for ASP.NET runtime. The update has fixes for bugs specific to URL rewriting. The update is applied only if the machine where URL Rewrite module is being installed has .NET Framework version 3.5 SP1 or higher. If required version of .NET Framework is installed after URL Rewrite module has been installed, then the ASP.NET update can be applied by re-running URL Rewrite module installer in repair mode.

Features

Here is the complete list of features supported by URL Rewrite module:

·         Rules-based URL rewriting engine. Rewrite rules are used to express the logic of what to compare/match the request URL with and what to do if comparison was successful. Web server and site administrators can use rewrite rule sets to define URL rewriting logic.

·         Regular expression pattern matching. Rewrite rules can use ECMA-262 compatible regular expression syntax for pattern matching.

·         Wildcard pattern matching. Rewrite rules can use Wildcard syntax for pattern matching

·         Global and distributed rewrite rules. Global rules are used to define server-wide URL rewriting logic. These rules are defined within applicationHost.config file and they cannot be overridden or disabled on any lower configuration levels. Distributed rules are used to define URL rewriting logic specific to a particular configuration scope. This type of rules can be defined on any configuration level by using web.config files.

·         Access to server variables and http headers. Server variables and HTTP headers provide additional information about current HTTP request. This information can be used to make rewriting decisions or to compose the output URL.

·         Various rule actions. Instead of rewriting a URL, a rule may perform other actions, such as issue an HTTP redirect, abort the request, or send a custom status code to HTTP client.

·         Support for IIS kernel mode and user mode output caching. IIS 7.0 output caching provides significant performance improvements for web applications. URL rewrite module is fully compatible with both types of output caching. This means that it is possible to safely cache responses for rewritten URL's and thus boost the performance of web applications that rely on URL rewriting.

• Rewrite maps. Rewrite map is an arbitrary collection of name-value pairs that can be used within rewrite rules to generate the substitution URL during rewriting. Rewrite maps are particularly useful when you have a large set of rewrite rules, all of which use static strings (i.e. there is no pattern matching used). In those cases, instead of defining a large set of simple rewrite rules, you can put all the mappings between input URL and substitution URL as keys and values into the rewrite map, and then have one rewrite rule which references this rewrite map to look up substitution URL based on the input URL.

·         Failed Request Tracing support. IIS7.0 Failed Request Tracing can be used to troubleshoot errors related to URL rewriting.

·         Extensible Rule templates. Rule template is an extension for URL rewrite module user interface, that simplifies creation of rewrite rules for a particular task.  The GoLive release of the module includes 3 built-in rule templates, plus it allows plugging in any number of custom templates.

·         UI for testing of regular expression and wildcard patterns. A GUI tool for testing rule patterns is included into the module's user interface. The tool can be used to quickly check how the regular expression or wildcard pattern works. Also, it can be used for troubleshooting and debugging of problems related to pattern matching.

·         UI for managing rewrite rules and rewrite maps. Rewrite rules and rewrite maps can be added, removed and edited by using "URL Rewrite Module" feature in IIS Manager.

• GUI tool for importing of mod_rewrite rules. URL rewrite module includes a GUI tool for converting rewrite rules from mod_rewrite format into an IIS format.

·         String manipulation functions. Built-in string manipulation functions can be used to convert URLs to lowercase and to perform URL encoding and decoding.

More information

The following resources related to Microsoft URL Rewrite Module are available on IIS.net:

Walkthroughs:

• Creating rewrite rules
• Using Failed Request Tracing to trace rewrite rules
• Using global and distributed rules
• Using rewrite maps
• Importing rewrite rules
• Enabling "Pretty Permalinks" in WordPress
• Rule templates
• User Friendly URL
• Rule with Rewrite Map
• Request Blocking
• Testing rule and condition patterns
• Using URL rewrite module - video walkthrough

References and guidance:

• URL Rewrite Module configuration reference
• URL Rewriting and ASP.NET routing
• URL Rewriting and Request Filtering
• URL Rewriting for ASP.NET Web Forms
• Developing rule templates for URL Rewrite module

Bill Staples posted an important annoucment about the availability of the Web Deployment tool release Beat 2.

When Bill says something like this "It is one of the fundamental building blocks that IIS will be building on the next several years.", that means "Hey you - IIS admin - pay attention to this cause it's going to REALLY important and some very cool features that you can't live without".

He goes on to say that current features include:

 Microsoft has released an updated SQL Server 2005 Driver for PHP. The SQL Server 2005 Driver for PHP download is available to all SQL Server users at no additional charge. The SQL Server 2005 Driver for PHP is a PHP 5 extension that allows for the reading and writing of SQL Server data from within PHP scripts. The extension provides a procedural interface for accessing data in all editions of SQL Server 2005 and SQL Server 2008.

http://www.microsoft.com/downloads/details.aspx?FamilyId=61BF87E0-D031-466B-B09A-6597C21A2E2A&displaylang=en

The IIS team continues to deliver on the promise of the modular pipeline. One often requested module was URL re-writing, which was released today.

-brett

Install the URL Rewrite Module for IIS 7.0 Go Live today!

Microsoft URL Rewrite Module for IIS 7.0 Go Live (x86)

Microsoft URL Rewrite Module for IIS 7.0 Go Live (x64)

New Features

Here are the features that are new since CTP release (for a complete list of features refer to this article):

·         Support for IIS kernel mode and user mode output caching. IIS 7.0 output caching provides significant performance improvements for web applications. URL rewrite module is fully compatible with both types of output caching. This means that it is possible to safely cache responses for rewritten URL's and thus boost the performance of web applications that rely on URL rewriting.

·         Lower case conversion. A lower case conversion function called "ToLower" can be used within rewrite rule to convert any rule input string or substitution URL to lower case.

·         Rule templates. Rule template is an extension for URL rewrite module user interface, that simplifies creation of rewrite rules for a particular task.  The Go Live release of the module includes 3 built-in rule templates, plus it allows plugging in any number of custom templates.

·         UI for testing of regular expression and wildcard patterns. A GUI tool for testing rule patterns is included into the module's user interface. The tool can be used to quickly check how the regular expression or wildcard pattern works. Also, it can be used for troubleshooting and debugging of problems related to pattern matching.

·         UI for managing rewrite rules and rewrite maps. Rewrite rules and rewrite maps can be added, removed and edited by using "URL Rewrite Module" feature in IIS Manager.

More information

New and updated walkthroughs: http://learn.iis.net/page.aspx/460/using-url-rewrite-module/

Updated configuration reference: http://learn.iis.net/page.aspx/465/url-rewrite-module-configuration-reference/

URL Rewriter Forum on IIS.NET: http://forums.iis.net/1152.aspx

Just ran across this white paper on Technet.

This is a GREAT PAPER on IIS 7 created by the Microsoft.com guys. I love their stuff. If you've ever seen their presentations at TechEd, MIX you know they are full of hard core IT details about how they deal with eye-poping scale. Thing is though, they always keep in mind the very useful details - "tweak this like that", "run this logparser script", "we setup our pools like this.." - showing you how they keep the house running. Despite rumors to the contrary, Microsoft.com is a 100% IIS 7 shop running out of the box bits.

While there are very few sites that need the kinds of scale Microsoft.com supports, the best practices and policies they have are really good for many of you supporting web farms. If I were running one, I would be very familiar with anything coming from these guys.

Migrating a Large, High-Volume Web Site to Internet Information Services 7.0

Had a question come up on the IIS 7 list server (iislists.com) on using CDONTS on IIS 7. Steve has written a blog post on the topic I thought was worth referencing.

Getting CDONTS to work on Windows Server 2008 x64 - Steve Schofield Weblog

One of the often heard requests for IIS has been about the need to have a more flexible, rules based URL rewriting system. The IIS team is making good on it's promise to release some out of band updates to the server using the modular pipeline. From all appearances, this is a really nice first release of a url rewrite system that comes complete with a UI. For example, you could redirect to a specific page based on the contents of URL, server variables or http headers. Examining the headers lets you make routing decisions based on the host header for example.

This is a pre-release version so  be sure to give the team some feed back over on iis.net

IIS.net : Learn IIS7: Using URL Rewrite Module: Installing and Configuring IIS 7.0

Update for WebDAV may be hard to find.

Solution: IIS7 WebDAV Module Tweaks « Enter the Tatrix

Hey, check out this article by Mvolo. As usual, he's got a great line on the important details and impeccable insight into practical implementation.

IIS 7.0: Top 10 Performance Improvements in IIS 7.0

Version 1.0 RTM of the SQL Server 2005 Driver for PHP is live!

Version 1.0 of the SQL Server 2005 Driver for PHP is available for download on the MSDN download site.

Ran across this today on IIS.net.  For those of you that know me, I've been raving about URLScan as great security tool for IIS since IIS 5 days. It was one of the centerpieces of the IIS FastTrack class I taught back in the day.

After a very long time, the IIS team has released an update to URLScan 2.5, a beta release of URLScan 3.0. It's still an ISAPI filter and I'd bet that it's written by the leading authority on ISAPI at Microsoft, Wade Hilmo who also wrote the original URLScan and siblings.

One of the key new features is the ability to create different rule sets for different sites.  In URLScan 2.5 you could only have 1 ruleset for the entire server which was great for sites that had 1 primary app or very similar workloads on different sites, but if you had 1 site that had a maximum URL of 50 characters and another 250 characters, you had to set the max URL length to 250 which meant less than optimum security. Now, you can tuneup each site to according to it's requirements.

Another cool addition is that if you change the ruleset, you don't have to recycle IIS in order to pick up the changes. That's a nice improvement that is harder than it sounds .

So check out the new beta and be sure to send a note to the team via the forums about how these tools. When they hear from customers about the usefulness of these releases, it helps them justify doing more of updates and add-ons.

Learn IIS7: Using UrlScan: Configuring Security: Installing and Configuring IIS 7.0

During the development of IIS7, Bill Staples often promised better integration with Powershell was in the future.

Well, the future is now and today I got the following message in my inbox:

Congates IIS team for this very cool improvment in integration and administration that makes IIS even easier to manage!

-brett

===================================================

IIS7 PowerShell Provider Tech Preview 2

Here is a quick overview:

What’s new with TP2?

·         IIS7 Powershell provider now supports SSL (installing and acquiring a certificate, creating an ssl site binding)

·         Tech Preview 2 ships with 40 new cmdlets. All of these cmdlets are for day-to-day IIS tasks like creating web-sites, web-applications, enabled request tracing, adding a handler or a module. The complete list is at http://learn.iis.net/page.aspx/492/using-the-task-based-cmdlets

The IIS7 PowerShell Provider offers

• Create Web-Sites, Web Applications, Virtual Directories and Application Pools
• Change Simple Configuration Properties on Web-Sites, Application Pools, Web Applications and Virtual Directories
• Add and Change Complex Configuration Settings
• Query Run-time Data (Web-Site State, Application Pool State, Currently Executing Requests)
• Execute Advanced Configuration Tasks, Scripting, Integration with other PowerShell Snap-Ins and features
• Search and Discover Configuration Settings

DOWNLOAD:
Tech Preview 1 of the IIS 7.0 PowerShell Provider can be found here:
x86: http://iis.net/downloads/default.aspx?tabid=34&g=6&i=1664
x64: http://iis.net/downloads/default.aspx?tabid=34&g=6&i=1665

FORUMS:
Go to our PowerShell forum if you need support or if you are looking for 'Tips and Tricks'
http://forums.iis.net/1151.aspx

WALKTHROUGHS:
The walkthroughs are here: http://learn.iis.net/page.aspx/447/managing-iis-with-the-iis-70-powershell-provider/

Mike Volo advises about the benefits of creating lean, mean web server machine!

http://mvolo.com/blogs/serverside/archive/2008/06/17/Make-your-next-IIS-7.0-web-server-a-lean-one.aspx 

IIS 7.0 Server-Side : Make your next IIS 7.0 web server a lean one

Mike Volodarsky announces he's leaving Microsoft. Mike was a central player in the creation of IIS 7 and was the PM for many key projects including the integrated pipeline and APPCMD.  Aside from assisting the team, he wrote the modules used in the demos for the Windows Server 2008 Hosting roadshow that went on worldwide, and saved my butt on more than on occasion with details about a switch or missing punctuation in a program or command line.

Of course, I'm sure he's up to new very interesting projects so expect to hear more from him!

IIS 7.0 Server-Side : Leaving Microsoft ...

Scott mentions in this blog entry planned updates for IIS 7. In addition "We will also shortly begin sharing details of a new web application deployment framework for IIS that enables you to easily automate the deployment of web applications on either a single server or across a web farm of machines.

.NET Web Product Roadmap (ASP.NET, Silverlight, IIS7) - ScottGu's Blog

Here's a blog post from Bill Staples on this issue. Bill is the uber manager of IIS and was the main vision and driver for both IIS 6 and IIS 7 as well as having key involvement since IIS 4.

SQL Injection Attacks on IIS Web Servers - BillS IIS Blog

Worth readin.g

Reading a Hacker's Mind : Running Multiple ASP.NET applications SECURELY on a single web server

The IIS team has released another preview of even more additions to IIS 7.

This time its the IIS 7 admin pack which adds some UI features that enhance the administration experience beyond what you get out of the box. This is possible due to the overhaul of the IIS  configuriation system which allows UI extensibility as well control over the request processing pipeline.

The admin pack adds (quote from Carlos' blog)

Request Filtering UI - This UI exposes the configuration of the IIS runtime feature called Request Filtering.

• Configuration Editor UI - This UI provides an advanced generic configuration editor entirely driven by our configuration schema. It includes things like Script Generation, Search functionality, advanced information such as locking and much more.
• Database Manager UI - This UI allows you to manage SQL Server databases from within IIS Manager, including the ability to create tables, execute queries, add indexes, primary keys, query data, insert rows, delete rows, and much more.
• IIS Reports UI - This extensible platform exposes a set of reports including some log parser based reports, displaying things like Top URL's, Hits per User, Page Performance, and many more.
• FastCGI UI - This UI exposes the configuration for the FastCGI runtime feature.
• ASP.NET Authorization UI - This UI allows you to configure the ASP.NET authorization settings.
• ASP.NET Custom Errors UI - This UI allows you to configure the Custom errors functionality of ASP.NET

Pay particularly close attention to the Database Manager UI. Carlos' had this idea a while back and did some very cool demos with it while IIS 7 was in beta. You can manage your SQL database right in the IIS 7 UI! Sweet.

Check it out http://blogs.msdn.com/carlosag/archive/2008/03/21/IISAdminPackTP1Released.aspx

-brett

Sukesh has developed and released on codeplex, a mobile application that lets your manage an IIS 7 server from your cell phone!

This is very cool application that shows off some of the great technology that is built into IIS 7 and .NET. This app uses the hostable web core, and LINQ plus the new management API, ,microsoft.web.adminsitration.

You can find his blog at http://www.awesomeideas.net/page/IIS7-Mobile-Admin.aspx which links into codeplex where you can download the source code!

Very  nice Sukesh! Keep em comin.

Thanks,

Brett

I can tell from the log files that webdav and IIS 7 is one of the hot search items.

So, here ya go! - here's an email I got at Microsoft annoucing it

---------------------------

After a year and a half of work and hundreds of hours of labor, we shipped the new WebDAV Extension for IIS 7.0 earlier today!

The new module is now available from the following URLs:

·         Microsoft WebDAV Extension for IIS 7.0 (x86)

o   http://www.iis.net/go/1621/

·         Microsoft WebDAV Extension for IIS 7.0 (x64)

o   http://www.iis.net/go/1618/

This new WebDAV module specifically targets RFC compliance, better integration into IIS, easier configuration, and more configurable security options.

The following walkthroughs have been published on the http://learn.iis.net/ web site to help people get started using the new WebDAV module:

• Getting Started:
• Installing and Configuring WebDAV on IIS 7.0
• What’s New for Microsoft and WebDAV?
• Using the WebDAV Redirector
• Advanced Administrative Features:
• How to manage WebDAV using APPCMD
• How to use custom properties with WebDAV
• How to configure WebDAV and Request Filtering
• Migrating FPSE Sites to WebDAV

Looking over the logs for search queries that wind up here, there's a need to post some FAQs now that IIS 7 is out.

Q: Can I install IIS 7 on XP or Windows Server 2003?
A: No.

Q: Where do I download IIS 7?
A: It's on the Vista or Windows Server 2008 DVD. Don't look for IIS7 on microsoft.com, it's not there.

Q: I have Vista, but don't see IIS 7.
A: Not all versions have IIS7.  See http://learn.iis.net/page.aspx/28/installing-iis7-on-vista/

Q: What happend to IIS_WPG?
A: See http://www.brettblog.com/2007/10/13/IISGroupsAndUsers.aspx

Q: What happened to the IUSR anonymous user?
A: See http://www.brettblog.com/2007/10/13/IISGroupsAndUsers.aspx

Q: Where is the mother lode of IIS7 info?
A: http://iis.net

Q: How do I disable IPv6?
A: Network properties for NIC

Q: How do I enable WebDAV (DAV) on IIS 7?
A: http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1579 Note that you will need to adust the URLFiltering section to allow DAV (see http://learn.iis.net/page.aspx/354/how-to-configure-webdav-with-request-filtering/ )

Q: Where do I get the updated IIS 7 FTP Server?
A: http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1619

If you have more questions you'd like see on this list, let me know!

-brett

As we near release for Windows Server 2008, the IIS team has released a beta of a very important tool called the Microsoft Web Deployment Tool.

How to replicate content and setting for web servers continually arises and is one of the most frequently asked questions I receive. Perhaps the second, and closely related question is how to migrate from IIS 6 to IIS 7. This tool has been in development for months but has not been widely discussed publicly so I personally and delighted that it is finally public.

Those of you who need something like this to replicate 6-6, 6-7 and 7-7 scenarios - please download and test this tool.  You can provide feedback to me or via the forums at iis.net. I'd be happy to connect your feedback to the managing PM on the IIS team.

Below is an email that circulated internally annoucing the tool with links.

Enjoy!

-brett

-----------

IIS is thrilled to announce the Technical Preview 1 release of the Microsoft Web Deployment Tool! The tool provides deployment and migration support for IIS 6.0 and 7.0. It incorporates many features that enable web server administrators to deploy, sync and migrate sites, including configuration, content, SSL certificates and other types of content associated with a Web server.

This tool can be used on Windows Server 2008 and IIS 7.0 as well as Windows Server 2003 and IIS 6.0. Please note that this is a Technical Preview release of the tool and should not be used on production servers. For a Tech Preview, only forum level support is available.  

How to Get Started

Download and read the walkthroughs: http://go.microsoft.com/?linkid=8100895

Download the x86 version: http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1602

Download the x64 version: http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1603

Web Deployment Tool forum: http://forums.iis.net/1144.aspx

Web Deployment Team blog: http://blogs.iis.net/msdeploy/

Features

The following list contains several of the features in this version:

·         Synchronization and Snapshot of IIS 6.0/IIS 7.0:

The sync operation provides administrators with a way to quickly synchronize a site or server and deploy changes to existing sites and servers. A synchronization allows you to synchronize one source with one destination. For example, you can synchronize two directory paths or two web servers. The sync can be performed with local or remote objects.

The snapshot, or archive, functionality allows administrators or developers to quickly take an archive of their web site or server for rollback, restore or backup purposes.

·         Migration from IIS 6.0:

The migrate operation provides administrators with a way to migrate sites or entire servers from IIS 6.0 to IIS 7.0, including their settings and content. A migration is essentially a way of synchronizing, filtered by migration rules. For example, when migrating from IIS 6.0 to IIS 7.0, MS Deploy will check the value of some properties and see if it is the IIS 6.0 default. If it is the default, such as the log files directory, it will instead use the value set on the IIS 7.0 server. This enables a server admin to maintain new settings on IIS 7.0 while moving sites or applications from IIS 6.0.

·         Analysis of IIS 6.0 Installed Features:

The analyze operation allows administrators to check what components are installed on the source server. In this way, they can determine if features are present that they will need in IIS 7.0 or that require more advanced setup than simply copying files. For example, ASP.NET requires more than a file copy and will need to be installed on the destination server.

·         Troubleshooting and Validation Features:

For validating an operation, the -whatif flag allows administrators to see what actions would happen when they perform an operation. This is especially useful for performing sync or migration, when they want to validate what changes will be made before performing them. For troubleshooting, the -verboseLevel flag allows administrators to get rich detail about what operations are being performed, and upon failure, the ability to diagnose the problem.

I just ran across these events sponsored by MSDN!

These are free sessions being held all over the country. Check it out!

http://www.msdnevents.com/

In days past, a Web server was simply a place to throw your static and dynamic pages for delivery. That’s all changed with recent releases of IIS – and IIS 7 is no exception. This session will highlight several key features of IIS that make it our most extensible, manageable and secure Web platform ever. You’ll learn about the modular design of IIS and the integrated pipeline, providing for new scenarios that involve sharing authentication across IIS, ASP.NET and other dynamic web server runtimes. We’ll explore how the new IIS protocol listeners enable IIS to host WCF services on a variety of protocols (not just HTTP), providing a scalable and manageable host for your distributed applications. You’ll see how easy it is to write modules and handlers in managed code. Plus you’ll learn about the new security aspects of IIS 7, from initial deployment to feature delegation to administrator lists. After this lively session, you’ll be raring to do much more with your Web server than simply copying over ASP.NET pages.

We’ll cover:

• Authentication methods and integration between ASP.NET and IIS 7
• Writing IIS managed handlers and modules
• How the IIS protocol listeners support hosting WCF services on TCP, Named Pipes and more
• IIS handler permissions, request filtering and administration lists
• How the XML replacement for the Metdata Config file makes it easy to duplicate Web servers
• Features and protocols that make IIS 7 secure right out of the box