Web Server IIS Concept (6.0)

IIS stands for internet information services. IIS is used to provide web hosting service or we can say it is used to provide web services. In web services Hypertext Transfer Protocol (HTTP) is used or some times for security reasons we can enable HTTPS (Hypertext Transfer Protocol Security) which provides security, integrity and encryption to our data. In case of HTTP, it works on 80number ports and in case of HTTPS; it works on 443 number ports.

                              In window 2000, IIS is by default install which means 80 number ports is by default open, which may arise some security issues. But in window server 2003, IIS is not installed by default; we can install it according to our requirement. WWW, which is called World Wide Web, is its sub component, which is automatically installed when we install IIS.

                              IIS also play a very important role with Exchange server 2003 (Mail Server). Because Exchange Server uses some windows component like SMTP (Simple Mail Transfer Protocol), WWW (World Wide Web), asp.net all these components are required for the proper functionality for the Exchange Server.

                              Exchange Server 2003 is a Server Software. We can access it by mail client software, in which outlook web access (OWA) play a very important role. Outlook web access support provided by IIS Server.

Installation of IIS

(1) Window server 2003 must be required.

(2) Go to control panel -> add/remove programs -> add/remove windows components -> then application services -> detail.

(3) Then check the check box of IIS.

(4) You can also check its sub components from its IIS details.

       (i) SMTP

       (ii) NNTP

(iii)WWW

(5) Click ok.

(6) And click next to install the IIS.

IIS Testing

We can test our web server by two methods:-

(1) By using IIS manager.

(2) By using internet explorer (web browser)

By using IIS manager

(i) Open IIS from Administrative Tools.

(ii) In the left pane, select web site container.

(iii) Expand it.

(iv) There is default web site in list. Right click on it then click browse.

(v) A default page will display in the detail page.

By using Internet Explorer on client

(i) Open explorer and type the IP address in address bar.

What is web page?

IIS supports many languages for e.g.:- html, asp, (common gate interface) cgi scripts, JavaScript, vbscript etc. a web page we can create with the help of html. Its extension is .html or .htm.

A web page contains some formats like tables, hyperlinks, images, contents of matter and bullets in the shape of images etc.

Configuring IIS

To configure the IIS, open IIS manager from Administrative Tools. In the left pane, Double click on web site container then right click on it then new then web site.

A new web site wizard appears on your screen in which we have to provide the following information.

(1) Description Name of website.

(2) IP address of IIS, select it from list. Port no = 80, Host Header Value=

(3) Local path of your Home Directory c:\website\msn.

(4) Permissions.                                                            

Configuring first page of web site

Select your web site from list in IIS manager. Then right click on it-> Then properties->documents tab Then click on add button. Now type the simply name of web page. Now place it in the top of the list by clicking on moves up button. Click Apply, ok.

Web site

Web site is a collection of web pages. One web page contains the reference of second web page according to the requirement of the topic. These references are stored in the hyper reference links, which is also called hyperlinks. Hyperlink is a part pf anchor tag.

Virtual directory

IIS server support virtual directories. In real world, virtual directory is a folder which is not available in to your Home Directory. By using virtual directory, we can display contents and we can separate our html files from other web pages on the web site.

Create a sub folder in your home directory. Place a html file in the sub folder with the same name as you provide first page of the web site. Open IIS manager. In the left pane, Select your web site from the list, right click on it. Then new-> then virtual directory.

A virtual directory wizard appears on your screen. Type the alias name, which is related to your topic. On the next, type the local path of your sub folder. Then click next to finish.

A virtual directory is display in the list under your web site. It will display with gear type icon. Right clicks on your web site, then click explore. Now your IIS manager displays all the files in the detail pane. Now select your file. Right click on it then open with notepad. Now create a hyperlink of virtual directory.

<a href=”news”>news</a>

Virtual web hosting

 We can run multiple web sites with multiple IP addresses means each web site has unique IP address. But we can provide multiple web site service with single IP address by using Host Header value. In other words, Host Header value is a fully qualified Domain Name. To do this we have to register multiple Domain names over the internet and then we have to add ‘A Record’ (Host Record). In each domain, here Host Record means public IP address of your web server.

                  When any internet client wants to communicate or access our web site then his query goes to DNS server over the internet. Now DNS server resolve name to IP address of the Host computer. Here host computer is a web server. Now query shifted to your web server. Your web server listen the request and port no. 80 and reads the host header value then check its configuration if found then respond back to the requesting client.

                  In case of multiple web site hosting services, other multiple domain name have same IP address when your web server receives multiple request with same IP address, same port no. 80 but with different host header value then your web server differentiate the request by reading the host header value. So in this way we can provide multiple web site service by using single IP address. This process is called virtual web hosting and this is possible with the help of domain name server (DNS).

Assigning Host Header value to existing web site

Configure or create a zone in DNS server. Add host record or ‘A record’ by right click on your zone. Now open web server. Expand web site container in the left pane. Select your site from the list. Then its properties. On general tab, click on advance button. In the multiple identity section. Select the IP address from list. Then click on edit button. Now type the host header value in the given dialog text box. Click apply, ok.

Configuring Alias record in DNS server

We can assign multiple identities to a single web site means we can assign or call any particular web site with alias name with the help of DNS server.

To do this, first of all we have to create a zone in DNS server then we will add Alias record by right click on your zone.

In the alias record dialog box, type the simple alias name of your web site. Then type the original fully qualified domain name.

Sale

Sale.abc.com

WWW.abc.com

Web server side configuration of alias name

Open web server. Create a new web site with host header value or we can select existing web site. Then its properties, on general tab click on advance button. In the multiple identity section, Click on add button. In the given dialog box, select the same IP address from list. Type same 80 no. port and type the alias host header value for web site. Click ok and click apply.

Backup and Restore of IIS configuration

Open IIS manager from Administrator Tool. In the left pane, right click on local server. Then all task -> then Backup & Restore.

A Backup & Restore dialog box appears on your screen. Type the name of Backup. Here you can encrypt your Backup by using password. To do this select the check box of encrypt with password. Now type the password and click ok.

To restore the last configuration or backup again, right click on server local. Then all task, then Backup & Restore configuration. Now select your backup from the list and click on restore button. It will ask you password type the password and again click ok.

Securing your HTML files in IIS

NTFS provide us file level security. So we can secure our html files by placing our home directory on NTFS disk drive. By default everyone has right to access the web pages. Every user is a member of users group. We remove the users group from the html file access list (Access Control List-ACL) and we can add some of the users in the ACL list. When a user accesses the web page that page demands authentication. If the user information matches with ACL list then he can view the web page otherwise not.

Steps: -

Open IIS Manager.

Select any configure web site. Right click on it. Then explore it in the detail pane. It will show all the html files.

Now select your first web page -> Properties -> click on security tab.

Then click on Advance button. A special permission dialog box appears on screen. Select users group from the list.

Deselect the checkbox allow inheritance checkbox option.

Another dialog box appears on screen. Click copy button. Now click close.

 Now select your users group from the list on security tab and click remove.

Now click on add button and add the users whom you want grant permission to access this web site.

Click ok. And Click apply ok.

Authentication

We can secure our web site by enabling Authentication. By default anonymous access authentication is enable, in which everyone has right access the web site.

      Authentication means every user who wants to access web site have to prove his identity means he must deliver username and password, which is available in local database in workgroup environment or in Active directory database.

There are three types of Authentication: -

(1) Anonymous Access

(2) Basic Authentication

(3) Integrated Window Authentication

Anonymous access

In this Authentication, only valid username is required. No need to provide your identity. This type of authentication overwrites other authentication method. If we want to enable another authentication method then we have to disable anonymous access authentication.

Basic authentication

This is a second type of authentication. In this type, a valid username & valid password is required. This authentication is not a secure authentication because it sends the user information in clear text or plain text, which creates some security issues. For example: - in case of hub, any third person can capture the data by using third party software. So he can analyses and read your user information.

Integrated windows authentication

This is a most secure method in authentication type. In this type, a valid username & valid password is required. It sends user information in encrypted form by using HASH algorithms (MD5-Message Digest 5, SHA1). In this type Kerberos protocol is used means Active Directory must be required. For the proper functionality of this type anonymous access must be disabling.

      In case of mail server, we can enable this type of SMTP server to control the junk emails.

 Steps to enable authentication

Open IIS Manager.

Select your configure web site -> properties -> click on directory security tab.

In the authentication section, click on edit button.

Deselect the option of anonymous access. By default integrated windows authentication checkbox is selected.--Now click apply, ok.

  Restriction by using IP Address

We can allow or deny computers by using their IP Address and IP Subnet. This restriction will also apply on our web site. In this process, we have to decide whether computers are more.

      We will decide our deny list according to the no. of computers to be deny. We will also deny according to the IP Subnet.

Steps to enable IP restriction

Open IIS Manager.

Select your configure web site -> Properties -> Directory Security Tab.

In the IP restriction section, click on edit button.

An IP Address restriction dialog box appears on screen. In which you have two options: -

(i) By default all computers will be granted access except the following.

(ii) By default all computers will be deny access except the following.