Internet Information Services

Last updated

Internet Information Services
Developer(s) Microsoft
Initial releaseMay 30, 1995;28 years ago (1995-05-30)
Stable release
10.0 v1809  OOjs UI icon edit-ltr-progressive.svg / 2 October 2018
Written in C++ [1]
Operating system Windows NT
Available inSame languages as Windows
Type Web server
License Part of Windows NT (same license)
Website www.iis.net

Internet Information Services (IIS, 2S) is an extensible web server created by Microsoft for use with the Windows NT family. [2] IIS supports HTTP, HTTP/2, HTTPS, FTP, FTPS, SMTP and NNTP. It has been an integral part of the Windows NT family since Windows NT 4.0, though it may be absent from some editions (e.g. Windows XP Home edition), and is not active by default.

Contents

History

The first Microsoft web server was a research project at the European Microsoft Windows NT Academic Centre (EMWAC), part of the University of Edinburgh in Scotland, and was distributed as freeware. [3] However, since the EMWAC server was unable to handle the volume of traffic going to Microsoft.com, Microsoft was forced to develop its own web server, IIS. [4]

Almost every version of IIS was released either alongside or with a version of Microsoft Windows:

All versions of IIS prior to 7.0 running on client operating systems supported only 10 simultaneous connections and a single website.

Microsoft was criticized by vendors of other web server software, including O'Reilly & Associates and Netscape, for its licensing of early versions of Windows NT; the "Workstation" edition of the OS permitted only ten simultaneous TCP/IP connections, whereas the more expensive "Server" edition, which otherwise had few additional features, permitted unlimited connections but bundled IIS. It was implied that this was intended to discourage consumers from running alternative web server packages on the cheaper edition. [16] Netscape wrote an open letter to the Antitrust Division of the U.S. Department of Justice regarding this distinction in product licensing, which it asserted had no technical merit. [17] O'Reilly showed that the user could remove the enforced limits meant to cripple NT 4.0 Workstation as a web server with two registry key changes and other trivial configuration file tweaking.

Features

IIS 6.0 and higher support the following authentication mechanisms: [18]

IIS 7.0 has a modular architecture. Modules, also called extensions, can be added or removed individually so that only modules required for specific functionality have to be installed. IIS 7 includes native modules as part of the full installation. These modules are individual features that the server uses to process requests. [20]

IIS 7.5 includes the following additional or enhanced security features: [21]

Authentication changed slightly between IIS 6.0 and IIS 7, most notably in that the anonymous user which was named "IUSR_{machinename}" is a built-in account in Vista and future operating systems and named "IUSR". Notably, in IIS 7, each authentication mechanism is isolated into its own module and can be installed or uninstalled. [19]

IIS 8.0 offers new features targeted at performance and easier administration. The new features are:

IIS 8.5 has several improvements related to performance in large-scale scenarios, such as those used by commercial hosting providers and Microsoft's own cloud offerings. It also has several added features related to logging and troubleshooting. The new features are:

Express

IIS Express, a lightweight (4.5–6.6 MB) version of IIS, is available as a standalone freeware server and may be installed on Windows XP with Service Pack 3 and subsequent versions of Microsoft Windows. IIS 7.5 Express supports only the HTTP and HTTPS protocols. It is portable, stores its configuration on a per-user basis, does not require administrative privileges and attempts to avoid conflicting with existing web servers on the same machine. [35] IIS Express can be downloaded separately [36] or as a part of WebMatrix [37] or Visual Studio 2012 and later. [38] (In Visual Studio 2010 and earlier, web developers developing ASP.NET apps used ASP.NET Development Server, codenamed "Cassini".) [39] By default, IIS Express only serves local traffic. [40] [38]

Extensions

IIS releases new feature modules between major version release to add new functionality. The following extensions are available for IIS 7.5:

Usage

According to Netcraft, in February 2014, IIS had a "market share of all sites" of 32.80%, making it the second most popular web server in the world, behind Apache HTTP Server at 38.22%. Netcraft showed a rising trend in market share for IIS, since 2012. [49] On 14 February 2014, however, the W3Techs shows different results. According to W3Techs, IIS is the third most used web server behind Apache HTTP Server (1st place) and Nginx. Furthermore, it shows a consistently falling trend for IIS use since February 2013. [50]

Netcraft data in February 2017 indicates IIS had a "market share of the top million busiest sites" of 10.19%, making it the third most popular web server in the world, behind Apache at 41.41% and nginx at 28.34%. [51]

Security

IIS 4 and IIS 5 were affected by the CA-2001-13 security vulnerability which led to the infamous Code Red attack; [52] [53] however, both versions 6.0 and 7.0 have no reported issues with this specific vulnerability. [54] In IIS 6.0 Microsoft opted to change the behaviour of pre-installed ISAPI handlers, [55] many of which were culprits in the vulnerabilities of 4.0 and 5.0, thus reducing the attack surface of IIS. [53] In addition, IIS 6.0 added a feature called "Web Service Extensions" that prevents IIS from launching any program without explicit permission by an administrator.

By default IIS 5.1 and earlier run websites in a single process running the context of the System account, [56] a Windows account with administrative rights. Under 6.0 all request handling processes run in the context of the Network Service account, which has significantly fewer privileges, so should there be a vulnerability in a feature or custom code it won't necessarily compromise the entire system given the sandboxed environment these worker processes run in. [57] IIS 6.0 also contained a new kernel HTTP stack (http.sys) with a stricter HTTP request parser and response cache for both static and dynamic content. [58]

According to Secunia, as of June 2011, IIS 7 had a total of six resolved vulnerabilities while [54] IIS 6 had a total of eleven vulnerabilities, out of which one was still unpatched. The unpatched security advisory has a severity rating of 2 out of 5. [54]

In June 2007, a Google study of 80 million domains concluded that while the IIS market share was 23% at the time, IIS servers hosted 49% of the world's malware, the same as Apache servers whose market share was 66%. The study also observed the geographical location of these dirty servers and suggested that the cause of this could be the use of unlicensed copies of Windows that could not obtain security updates from Microsoft. [59] In a blog post on 28 April 2009, Microsoft noted that it supplies security updates to everyone without genuine verification. [60] [61]

The 2013 mass surveillance disclosures made it more widely known that IIS is particularly bad in supporting perfect forward secrecy (PFS), especially when used in conjunction with Internet Explorer. Possessing one of the long term asymmetric secret keys used to establish a HTTPS session should not make it easier to derive the short term session key to then decrypt the conversation, even at a later time. Diffie–Hellman key exchange (DHE) and elliptic curve Diffie–Hellman key exchange (ECDHE) are in 2013 the only ones known to have that property. Only 30% of Firefox, Opera, and Chromium Browser sessions use it, and nearly 0% of Apple's Safari and Microsoft Internet Explorer sessions. [62]

See also

Related Research Articles

<span class="mw-page-title-main">Apache HTTP Server</span> Open-source web server software

The Apache HTTP Server is a free and open-source cross-platform web server software, released under the terms of Apache License 2.0. It is developed and maintained by a community of developers under the auspices of the Apache Software Foundation.

Active Server Pages (ASP) is Microsoft's first server-side scripting language and engine for dynamic web pages.

<span class="mw-page-title-main">HTTPS</span> Extension of the HTTP communications protocol to support TLS encryption

Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). It uses encryption for secure communication over a computer network, and is widely used on the Internet. In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS) or, formerly, Secure Sockets Layer (SSL). The protocol is therefore also referred to as HTTP over TLS, or HTTP over SSL.

Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. The protocol is widely used in applications such as email, instant messaging, and voice over IP, but its use in securing HTTPS remains the most publicly visible.

Integrated Windows Authentication (IWA) is a term associated with Microsoft products that refers to the SPNEGO, Kerberos, and NTLMSSP authentication protocols with respect to SSPI functionality introduced with Microsoft Windows 2000 and included with later Windows NT-based operating systems. The term is used more commonly for the automatically authenticated connections between Microsoft Internet Information Services, Internet Explorer, and other Active Directory aware applications.

ASP.NET is a server-side web-application framework designed for web development to produce dynamic web pages. It was developed by Microsoft to allow programmers to build dynamic web sites, applications and services. The name stands for Active Server Pages Network Enabled Technologies.

Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft Corporation which provides a user with a graphical interface to connect to another computer over a network connection. The user employs RDP client software for this purpose, while the other computer must run RDP server software.

The Internet Server Application Programming Interface (ISAPI) is an n-tier API of Internet Information Services (IIS), Microsoft's collection of Windows-based web server services. The most prominent application of IIS and ISAPI is Microsoft's web server.

<span class="mw-page-title-main">Microsoft Data Access Components</span> Framework

Microsoft Data Access Components is a framework of interrelated Microsoft technologies that allows programmers a uniform and comprehensive way of developing applications that can access almost any data store. Its components include: ActiveX Data Objects (ADO), OLE DB, and Open Database Connectivity (ODBC). There have been several deprecated components as well, such as the Jet Database Engine, MSDASQL, and Remote Data Services (RDS). Some components have also become obsolete, such as the former Data Access Objects API and Remote Data Objects.

The acronyms BAPP and BAMP refer to a set of open-source software programs commonly used together to run dynamic websites or servers. This set is a solution stack, and an open source web platform.

<span class="mw-page-title-main">HTTP 403</span> HTTP status code indicating that access is forbidden to a resource

HTTP 403 is an HTTP status code meaning access to the requested resource is forbidden. The server understood the request, but will not fulfill it, if it was correct.

Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. The software was created by Russian developer Igor Sysoev and publicly released in 2004. Nginx is free and open-source software, released under the terms of the 2-clause BSD license. A large fraction of web servers use Nginx, often as a load balancer.

<span class="mw-page-title-main">SharePoint</span> Web application platform

SharePoint is a web-based collaborative platform that integrates natively with Microsoft 365. Launched in 2001, SharePoint is primarily sold as a document management and storage system, although it is also used for sharing information through an intranet, implementing internal applications, and for implementing business processes.

The Online Certificate Status Protocol (OCSP) stapling, formally known as the TLS Certificate Status Request extension, is a standard for checking the revocation status of X.509 digital certificates. It allows the presenter of a certificate to bear the resource cost involved in providing Online Certificate Status Protocol (OCSP) responses by appending ("stapling") a time-stamped OCSP response signed by the CA to the initial TLS handshake, eliminating the need for clients to contact the CA, with the aim of improving both security and performance.

Security Support Provider Interface (SSPI) is a component of Windows API that performs security-related operations such as authentication.

GlobalSign is a certificate authority and a provider of internet identity and security products. As of January 2015, Globalsign was the 4th largest certificate authority in the world, according to Netcraft.

<span class="mw-page-title-main">Windows Server 2008 R2</span> Fifth version of Windows Server, released in 2009

Windows Server 2008 R2, codenamed "Windows Server 7", is the fifth version of the Windows Server operating system produced by Microsoft and released as part of the Windows NT family of operating systems. It was released to manufacturing on July 22, 2009, and became generally available on October 22, 2009, shortly after the completion of Windows 7. It is the successor to Windows Server 2008, which is derived from the Windows Vista codebase, released the previous year, and was succeeded by the Windows 8-based Windows Server 2012.

Windows Identity Foundation (WIF) is a Microsoft software framework for building identity-aware applications. It provides APIs for building ASP.NET or WCF based security token services as well as tools for building claims-aware and federation capable applications.

<span class="mw-page-title-main">.NET Framework version history</span>

Microsoft started development on the .NET Framework in the late 1990s originally under the name of Next Generation Windows Services (NGWS). By late 2001 the first beta versions of .NET Framework 1.0 were released. The first version of .NET Framework was released on 13 February 2002, bringing managed code to Windows NT 4.0, 98, 2000, ME and XP.

References

  1. ↑ Lextrait, Vincent (February 2010). "The Programming Languages Beacon, v10.0". Archived from the original on 30 May 2012. Retrieved 12 February 2010.
  2. ↑ "Running IIS 6.1 as an Application Server (IIS 6.0)". TechNet . Microsoft. Archived from the original on 21 September 2013. Retrieved 14 December 2012.
  3. ↑ "Windows NT Internet Servers". Microsoft. 10 July 2002. Archived from the original on 19 September 2008. Retrieved 26 May 2008.
  4. ↑ Kramer, Dave (24 December 1999). "A Brief History of Microsoft on the Web". Microsoft. Archived from the original on 14 May 2008. Retrieved 26 May 2008.
  5. ↑ "Microsoft ASP.NET 2.0 Next Stop on Microsoft Web Development Roadmap".[ permanent dead link ]
  6. ↑ "Chapter 1 - Overview of Internet Information Services 5.0". 9 December 2009. Retrieved 25 October 2010.
  7. ↑ "Chapter 2 - Managing the Migration Process". 9 December 2009. Retrieved 27 June 2012.
  8. ↑ "What's New In IIS 6.0?". Archived from the original on 14 May 2013. Retrieved 25 November 2010.
  9. ↑ arkaytee. "Introduction to IIS Architectures". docs.microsoft.com. Retrieved 29 August 2019.
  10. ↑ "IIS 7.0: Explore The Web Server For Windows Vista and Beyond" . Retrieved 25 November 2010.
  11. ↑ "What's New in Web Server (IIS) Role in Windows 2008 R2" . Retrieved 25 November 2010.
  12. ↑ Mike Bishop; David So (11 September 2015). "HTTP/2 on IIS". Microsoft.{{cite web}}: CS1 maint: multiple names: authors list (link)
  13. ↑ Sourabh Shirhatti (14 June 2022). "New Features Introduced in IIS 10.0". Microsoft.
  14. ↑ Sourabh Shirhatti; Richard Lang (19 May 2022). "New Features Introduced in IIS 10.0 Version 1709". Microsoft.{{cite web}}: CS1 maint: multiple names: authors list (link)
  15. ↑ Sourabh Shirhatti. "New Features Introduced in IIS 10.0, version 1809". Microsoft.
  16. ↑ "Netscape goes to jail, does not collect $200". InfoWorld. Archived from the original on 23 December 2008. Retrieved 12 April 2014.
  17. ↑ "Differences Between NT Server and Workstation Are Minimal". O'Reilly Media. Archived from the original on 16 March 2016. Retrieved 7 July 2018.
  18. ↑ "Authentication Methods Supported in IIS 6.0 (IIS 6.0)". IIS 6.0 Documentation. Microsoft. Archived from the original on 2 November 2012. Retrieved 13 July 2011.
  19. 1 2 "Changes Between IIS 6.0 and IIS 7 Security". iis.net. Microsoft. 7 February 2010. Retrieved 13 July 2011.
  20. ↑ Templin, Reagan (11 August 2010). "Introduction to IIS 7 Architecture". iis.net. Microsoft. IIS 7 Modules. Retrieved 16 July 2011.
  21. ↑ "Available Web Server (IIS) Role Services in IIS 7.5". Microsoft TechNet. Microsoft. 27 January 2010. Retrieved 13 July 2011.
  22. 1 2 Eagan, Shaun (29 February 2012). "IIS 8.0 Application Initialization". IIS Blog. Microsoft . Retrieved 19 September 2013.
  23. ↑ Yoo, Won (29 February 2012). "IIS 8.0 ASP.NET configuration management". IIS Blog. Microsoft . Retrieved 19 September 2013.
  24. ↑ Eagan, Shaun (29 February 2012). "IIS 8.0 Centralized SSL certificate support". IIS Blog. Microsoft . Retrieved 19 September 2013.
  25. ↑ McMurray, Robert (29 February 2012). "IIS 8.0 Multicore Scaling on NUMA Hardware". IIS Blog. Microsoft . Retrieved 19 September 2013.
  26. ↑ "IIS 8.0 WebSocket protocol support". IIS Blog. Microsoft. 28 November 2012. Retrieved 19 September 2013.
  27. ↑ Eagan, Shaun (29 February 2012). "IIS 8.0 Server Name Indication". IIS Blog. Microsoft . Retrieved 19 September 2013.
  28. ↑ McMurray, Robert (29 February 2012). "IIS 8.0 Dynamic IP Address Restrictions". IIS Blog. Microsoft . Retrieved 19 September 2013.
  29. ↑ Eagan, Shaun (29 February 2012). "IIS 8.0 CPU Throttling". IIS Blog. Microsoft . Retrieved 19 September 2013.
  30. ↑ Benari, Erez (26 June 2013). "Idle Worker-process Page Out". IIS Blog. Microsoft . Retrieved 18 September 2013.
  31. ↑ Benari, Erez (3 July 2013). "Dynamic Site Activation". IIS Blog. Microsoft . Retrieved 18 September 2013.
  32. ↑ Benari, Erez (10 July 2013). "Enhanced Logging". IIS Blog. Microsoft . Retrieved 18 September 2013.
  33. ↑ Benari, Erez (15 July 2013). "ETW Logging". IIS Blog. Microsoft . Retrieved 18 September 2013.
  34. ↑ Benari, Erez (3 September 2013). "Automatic Certificate rebind". IIS Blog. Microsoft . Retrieved 18 September 2013.
  35. ↑ "IIS Express FAQ". iis.net. Microsoft. 14 January 2011. Retrieved 27 January 2011.
  36. ↑ "Internet Information Services (IIS) 7.5 Express". Download Center. Microsoft. 10 January 2011. Retrieved 27 January 2011.
  37. ↑ "IIS Express Overview". iis.net. Microsoft. 14 January 2011. Retrieved 27 January 2011.
  38. 1 2 Hanselman, Scott; Condron, Glen (15 September 2015). "3 Introducing Model View Controller (MVC)". Introduction to ASP.NET. Microsoft. 0:14:02.
  39. ↑ Guthrie, Scott (29 June 2010). "Introducing IIS Express". ScottGu's Blog. Microsoft.
  40. ↑ Gopalakrishnan, Vaidy (12 January 2011). "Handling URL Binding Failures in IIS Express". iis.net. Microsoft.
  41. ↑ "FTP Publishing Service". iis.net. Microsoft . Retrieved 17 July 2011.
  42. ↑ "Administration Pack". iis.net. Microsoft . Retrieved 17 July 2011.
  43. ↑ "Application Request Routing". iis.net. Microsoft . Retrieved 17 July 2011.
  44. ↑ "Database Manager". iis.net. Microsoft . Retrieved 17 July 2011.
  45. ↑ "IIS Media Services". iis.net. Microsoft . Retrieved 30 July 2011.
  46. ↑ "URL Rewrite". iis.net. Microsoft . Retrieved 17 July 2011.
  47. ↑ "WebDAV Extension". iis.net. Microsoft . Retrieved 17 July 2011.
  48. ↑ "Web Deploy 2.0". iis.net. Microsoft . Retrieved 17 July 2011.[ permanent dead link ]
  49. ↑ "February 2014 Web Server Survey". news.netcraft.com. Netcraft. 3 February 2014.
  50. ↑ "Usage statistics and market share of Microsoft-IIS for websites". w3techs. Q-Success.
  51. ↑ "February 2017 Web Server Survey". news.netcraft.com. Netcraft. 27 February 2017.
  52. ↑ "CA-2001-13 Buffer Overflow In IIS Indexing Service DLL". CERT® Advisory. Computer emergency response team. 17 January 2002. Retrieved 1 July 2011.
  53. 1 2 Hadi, Nahari (2011). Web commerce security: design and development. Krutz, Ronald L. Indianapolis: Wiley Pub. p. 157. ISBN   9781118098899. OCLC   757394142.
  54. 1 2 3 "Vulnerability Report: Microsoft Internet Information Services (IIS) 6". Secunia. Secunia ApS. Retrieved 1 July 2011.
  55. ↑ "IIS Installs in a Locked-Down Mode (IIS 6.0)". Microsoft Developer Network (MSDN). Microsoft. Archived from the original on 30 April 2011. Retrieved 1 July 2011.
  56. ↑ "How To: Run Applications Not in the Context of the System Account in IIS (Revision 5.1) Microsoft Corporation". 7 July 2008. Retrieved 20 July 2007.
  57. ↑ Henrickson, Hethe; Hofmann, Scott R. (2003). "Chapter 15: ASP.NET Web Services". IIS 6: the complete reference. New York City: McGraw-Hill Professional. p. 482. ISBN   978-0-07-222495-5 . Retrieved 12 July 2011.
  58. ↑ Henrickson, Hethe; Hofmann, Scott R. (2003). "Chapter 1: IIS Fundamentals". IIS 6: the complete reference. New York City: McGraw-Hill Professional. p. 17. ISBN   978-0-07-222495-5 . Retrieved 12 July 2011.
  59. ↑ "Web Server Software and Malware". Google Online Security Blog.
  60. ↑ "Windows Pirates Encouraged to Install Security Updates". USA Today . Technology Live. February 2010. Retrieved 18 July 2011.
  61. ↑ Cooke, Paul (27 April 2009). "Who Gets Windows Security Updates?". Windows Security Blog. Microsoft . Retrieved 18 July 2011.
  62. ↑ SSL: Intercepted today, decrypted tomorrow, Netcraft, 25 June 2013.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.