IIS 7 The Administrators Guide.ppt

IIS6 Request Processing IIS7 Request Processing Many, Many Modules Install, manage, and patch only the modules you use… Reduces attack surface Reduces in-memory footprint Provides fine grained control … replace core server components with custom components… Consistently install the same set of modules… Avoid: 503 “Service Unavailable” [module is enabled but not installed] Application doesn’t work as expected [web.config references a module that isn’t installed] [unexpected module conflicts with custom module] IIS6 ASP.NET Integration Runtime limitations Only sees ASP.NET requests Feature duplication IIS7 ASP.NET Integration Two Modes Classic (runs as ISAPI) Integrated Integrated Mode .NET modules / handlers plug directly into pipeline Process all requests Full runtime fidelity Replicate Content and Config Main IIS configuration file (applicationHost.config) Built-in “IUSR” account, no more machine specific SID’s Simple file copy, no command line tools required …watch for machine specific data like IP’s and drive letters IIS config ? web.config, XCOPY with application Centralize Content and Config IIS config ? web.config, centralize on file server File System: Client Side Caching (CSC) provides a local disk cache Distributed File System Replication (DFSR) abstracts multiple file servers to one share name provides content replication Configuration moves to .config files… Configure IIS and ASP.NET properties in the same file Use locking to provide delegation Built for simple, schema-based extensibility … welcome to a world of xcopy deployment… Configuration Layout Configuration Delegation Delegation is: Configuration locking, “overrideMode” ACL’s on configuration files By default… All IIS sections locked except: Default Document Directory Browsing HTTP Header HTTP Redirects All .NET Framework / ASP.NET sections are unlocked Determine your configuration lockdown policy… Be conservative at first Unlock as necessary (locking late