ARTICLES IN THE BOOK
A GUIDE TO WINDOWS VISTA
This article is from:
All text is available under the terms of the GNU Free Documentation License: http://en.wikipedia.org/wiki/Wikipedia:Text_of_the_GNU_Free_Documentation_License
Microsoft Internet Information Services (IIS; formerly called Server) is a set of Internet-based services for servers using Microsoft Windows. It is the world's second most popular web server in terms of overall websites. As of February 2007 it served 31% of all websites according to Netcraft. The servers currently include FTP, SMTP, NNTP and HTTP/HTTPS.
IIS was initially released as an additional set of Internet based services for Windows NT 3.51. IIS 2.0 followed adding support for the Windows NT 4.0 operating system and IIS 3.0 introduced the Active Server Pages dynamic scripting environment.
IIS 4.0 dropped support for the Gopher protocol and was bundled with Windows NT as a separate "Option Pack" CD-ROM.
The current shipping version of IIS is 7.0 for Windows Vista, 6.0 for Windows Server 2003 and IIS 5.1 for Windows XP Professional. IIS 5.1 for Windows XP is a restricted version of IIS that supports only 10 simultaneous connections and a single web site. IIS 6.0 added support for IPv6.
Windows Vista does not install IIS 7.0 by default, but it can be selected among the list of optionally installed components. IIS 7.0 on Vista will not limit the number of connections allowed but will limit workloads based on the active concurrent requests, improving usability and performance in peer-to-peer scenarios.
Earlier versions of IIS were hit with a spate of vulnerabilities, chief among them CA-2001-19 which led to the infamous "Code Red worm"; however, version 6.0 has only three reported issues that affect it, two "moderately critical", the third "not critical". In perspective, Apache had thirty three reported issues, two "highly critical", ten "moderately critical", eighteen "less critical", and three "not critical". In IIS 6.0, Microsoft has opted to change the behavior of pre-installed ISAPI handlers, many of which were culprits in the vulnerabilities on 4.0 and 5.0, thus reducing the attack surface of IIS. With its next release, IIS 7.0, Microsoft goes a step further by modularizing many of the components, creating a customizable installation stack.
In IIS 5.1 and lower, by default all websites were run in-process and under the System account, a default Windows account with elevated rights. Under 6.0 all request handling processes have been brought under a Network Services account which has significantly fewer privileges. In particular this means that if there is an exploit in a feature or custom code, it wouldn't necessarily compromise the entire system given the sandboxed environment the worker processes run in. IIS 6.0 also contained a new kernel HTTP stack (http.sys) with a stricter HTTP request parser and response cache for both static and dynamic content.
IIS 5.0 and higher support the following authentication mechanisms:
Debuting with Windows Vista, and also to be included in Windows Server "Longhorn", IIS 7.0 features a modular architecture. Instead of a monolithic server which features all services, IIS 7 has a core web server engine. Modules offering specific functionality can be added to the engine to enable its features. The advantage of having this architecture is that only the features required can be enabled and that the functionalities can be extended by using custom modules.
The following sets of modules are slated to ship with the server:
Writing extensions to IIS 7 using ISAPI has been deprecated in favor of the module API. Much of IIS's own functionality is built on this API, and as such, developers will have much more control over a request process than was possible in prior versions. Modules can also be written using any .NET Framework language, and can be deployed on a per-site basis.
A significant change from previous versions of IIS is that all web server configuration information is stored solely in XML configuration files, instead of in the metabase. The server has a global configuration file that provides defaults, and each virtual web's document root (and any subdirectory thereof) may contain a web.config containing setting that augments or overrides the defaults. Changes to these files take effect immediately. This marks a significant departure from previous versions whereby web interfaces, or machine administrator access, were required to change simple settings such as default document, active modules and security/authentication. It also eliminates the need to perform metabase synchronization between multiple servers in a farm of web servers.
IIS 7 also features a completely rewritten administration interface that takes advantage of modern MMC features such as task panes and asynchronous operation. Configuration of ASP.NET is more fully integrated into the administrative interface.
Categories: FTP server software | Mail transport agents | Microsoft server technology | Web server software