Tijdens de door stichting Laluz georganiseerde "Boost a World 2008 ~ Aan Tafel" evenement werkte mee ik in een team dat zich bezig hield met voorraadbeheer. Met een teamgenoot had ik een discussie over het inrichten van een nieuwe applicatie voor de voedselbanken in Nederland. Het zou een ASP moeten zijn waarop de verschillende Voedselbanken hun voorraden kunnen beheren en uitwisselen. Op deze wijze zouden ze samen een eenvoudig doch effectief onderling distributie systeem op moeten kunnen zetten. Een aanzet daartoe hadden we ook al ontworpen. (Bij deze een oproep aan de komende stichting Voedselbanken Nederland, neem contact met ons op als u deze gratis dienst wenst te laten implementeren, doen we allemaal voor u).

De discussie spitste zich toe op de te gebruiken systemen. We dachten beiden aan een MySQL database alleen meteen daarna liep het anders. Ik dacht dat een LAMP systeem het beste zou zijn (LAMP = Linux, Apachache, MySQL, PHP), het zijn immers allemaal vrije open source software (v/oss) tools, dus gratis verkrijgbaar en aanpasbaar. Het voorgestelde alternatief zou .Net, MySQL en Windows Server 2008 zijn. In dat geval zou men voor zowel .Net als voor de Windows Server jaarlijks een licentie moeten betalen. Mijn collega teamgenoot kwam echter met het argument dat .Net veiliger is dan PHP en daar liep mijn kennis spaak. Is het inderdaad zo dat PHP meer veiligheidslekken kent dan .Net? En hoe verhoud zich dit in het geheel? Geld bij een software systeem ook dat de ketting zo zwak is als de zwakste schakel? Want van Linux servers is weer wel bekend dat ze veiliger zijn dan Windows servers. Eveneens is Apache over het algemeen de meest gebruikte en als meest veilig erkende webserver. Veiliger dan Microsoft Internet Information Services (IIS), tenminste voor zo ver ik gehoord heb.

Is de veiligheid van PHP dan de norm? Of spelen er andere reden vraag ik me nu af? Is er bijvoorbeeld de onbekendheid met PHP een oorzaak van? Deze discussie is uiteraard nog niet ten einde, ik heb nog vele vragen en zal eens zoeken naar de beveiliging van de verschillende systemen.

Voor de Voedselbanken is geregeld dat een sponsor de .Net ontwikkeling voor zijn rekening zou nemen en een windows server zou doneren. Dat scheelt weer in de kosten. Maar hoe lang doet die sponsor dat? En als het eindigt, is een vrij systeem niet te preferen boven een gesloten systeem met de bijbehorende licenties?

Graag zie ik hier reacties op!

1. The connection string shouldn't have user in it, but the following: "Data Source=SERVER_NAME;Initial Catalog=DATABASE_NAME;Integrated Security=true;"
2. Create a user, say: User1 under "Local Users and Groups". Set the password.
3. Change the application pool's "Identity" to the user User1 just created.
4. Add in SQL Server the user using "Windows Authentication". It's better to search the user (Find Now).
5. Give the right of this user to access the database used in the connection string. "db_datareader", "db_datawriter" & "db_owner"

That should be very straight forward and simple.

Let us first see the configuration required in OBIEE (for detailed explanation, refer deployment guide on Metalink3):

1)      Create an impersonator user and associate this new user with Administrators group.

2)      Run cryptotools specifying alias as impersonation (should be spelled exactly the same) and provide the user id  / password of the impersonator user created in step (1).

3)      Modify the instanceconfig.xml to include the credentialstorage info and also enable SSO. In my environment, the instanceconfig.xml looks as below:

<CredentialStore>

<CredentialStorage type="file" path = "C:\OracleBIData\web\config\credentialstore.xml" />

</CredentialStore>

<Auth>

<SSO enabled="true">

<ParamList>

<!--IMPERSONATE param is used to get the authenticated user's username and is required -->

<Param name="IMPERSONATE"

source="serverVariable"

nameInSource="REMOTE_USER"

stripWindowsDomain="true"/>

</ParamList>

</SSO>

</Auth>

Note: If you have encrypted the password while running step (2), make sure to include passphrase in the CredentialStorage tag.

This concludes configuration in OBIEE side.

Now coming to IIS configuration:

1)      Open the Internet Services Manager

2)      Right click on the machine name > Properties > Edit on the Master properties > Directory Security > Edit on the Anonymous Access and Authentication Control > Check “Integrated Windows Authentication” and Uncheck “Anonymous Access”.

3)      Now right click on the Analytics virtual directory Properties > Directory Security > Edit on the Anonymous Access and Authentication Control > Check “Integrated Windows Authentication” and Uncheck “Anonymous Access”.

Restart IIS and presentation services.

How to test this:

Assume, you have installed OBIEE on a machine that is on domain “D1”. Now you have user with credentials with test1/test1 in that domain. So, create an RPD user with the same credentials. When you access the analytics from with in the machine where you have installed OBIEE (assuming you have logged in to that machine as test1), you will see the Dashboard screen indicating that the user is already authenticated. If you access the analytics outside of the machine where you have installed OBIEE, you will be prompted to log in to the machine (small window) where you need to provide your domain credentials (in our example, test1) and once these credentials are authenticated, you would see the dashboard screen.

Note: For more information on how Integrated Windows Authentication works, refer Microsoft website.

Inscrição no site.

by: omar

Every time I create an IIS website, I do some steps, which I consider as best practice for creating any IIS website for better performance, maintainability, and scalability. Here' re the things I do:

Create a separate application pool for each web application

I always create separate app pool for each web app because I can select different schedule for app pool recycle. Some heavy traffic websites have long recycle schedule where low traffic websites have short recycle schedule to save memory. Moreover, I can choose different number of processes served by the app pool. Applications that are made for web garden mode can benefit from multiple process where applications that use in-process session, in memory cache needs to have single process serving the app pool. Hosting all my application under the DefaultAppPool does not give me the flexibility to control these per site.

The more app pool you create, the more ASP.NET threads you make available to your application. Each w3wp.exe has it's own thread pool. So, if some application is congesting particular w3wp.exe process, other applications can run happily on their separate w3wp.exe instance, running under separate app pool. Each app pool hosts its own w3wp.exe instance.

So, my rule of thumb: Always create new app pool for new web applications and name the app pool based on the site's domain name or some internal name that makes sense. For example, if you are creating a new website alzabir.com, name the app pool alzabir.com to easily identify it.

Another best practice: Disable the DefaultAppPool so that you don't mistakenly keep adding sites to DefaultAppPool.

First you create a new application pool. Then you create a new Website or Virtual Directory, go to Properties -> Home Directory tab -> Select the new app pool.

Customize Website properties for performance, scalability and maintainability

First you map the right host headers to your website. In order to do this, go to WebSite tab and click on "Advanced" button. Add mapping for both domain.com and www.domain.com. Most of the time, people forget to map the domain.com. Thus many visitors skip typing the www prefix and get no page served.

Next turn on some log entries:

These are very handy for analysis. If you want to measure your bandwidth consumption for specific sites, you need the Bytes Sent. If you want to measure the execution time of different pages and find out the slow running pages, you need Time Taken. If you want to measure unique and returning visitors, you need the Cookie. If you need to know who is sending you most traffic - search engines or some websites, you need the Referer. Once these entries are turned on, you can use variety of Log Analysis tools to do the analysis. For example, open source AWStats.

But if you are using Google Analytics or something else, you should have these turned off, especially the Cookie and Referer because they take quite some space on the log. If you are using ASP.NET Forms Authentication, the gigantic cookie coming with every request will produce gigabytes of logs per week if you have a medium traffic website.

This is kinda no brainer. I add Default.aspx as the default content page so that, when visitors hit the site without any .aspx page name, e.g. alzabir.com, they get the default.aspx served.

Things I do here:

• Turn on Content Expiration. This makes static files remain in browser cache for 30 days and browser serves the files from its own cache instead of hitting the server. As a result, when your users revisit, they don't download all the static files like images, javascripts, css files again and again. This one setting significantly improves your site's performance.
• Remove the X-Powered-By: ASP.NET header. You really don't need it unless you want to attach Visual Studio Remote Debugger to your IIS. Otherwise, it's just sending 21 bytes on every response.
• Add "From" header and set the server name. I do this on each webserver and specify different names on each box. It's handy to see from which servers requests are being served. When you are trying to troubleshoot load balancing issues, it comes handy to see if a particular server is sending requests.

I set the 404 handler to some ASPX so that I can show some custom error message. There's a 404.aspx which shows some nice friendly message and suggests some other pages that user can visit. However, another reason to use this custom mapping is to serve extensionless URL from IIS. Read this blog post for details.

Make sure to set ASP.NET 2.0 for your ASP.NET 2.0, 3.0 and 3.5 websites.

Finally, you must, I repeat you "MUST" turn on IIS 6.0 gzip compression. This turns on the Volkswagen V8 engine that is built into IIS to make your site

original  link from:

http://msmvps.com/blogs/omar/archive/2008/10/04/best-practices-for-creating-websites-in-iis-6-0.aspx?

1- Stop IIS Admin service.
2- Search for Enable32BitAppOnWin64="TRUE" in MetaBase.xml and delete that line.
You can find the MetaBase.xml in the following path:
<Your windows folder path>\system32\inetsrv\MetaBase.xml.
3- Restart IIS .

But the issue didn’t get fixed until I run  aspnet_regiis -i for both ASP.Net 1.1 and 2  .

And now the ASP.Net tab is back again in IIS.

The format of the specified network name is invalid

Additionally in System event log following errors were logged:

EventID 1004 from W3SVC: Cannot register the URL prefix .... for site .... The site has been deactivated.

and

Event ID 1005 from HTTP: Unable to bind to the underlying transport for .... The IP Listen-Only list may contain a reference to an interface which may not exist on this machine.

I checked if IIS websites were configured to listen on old IP address only... but no... they were set to "All unassigned".

Also I checked if nothing blocks ports 80 and 443 when IIS is stopped....

After some research I found this Microsoft TechNet page: Configuring the IP Inclusion List (IIS 6.0) which mentiones both events and refers to "httpcfg" utility which is used for configuration of HTTP protocol bindings.

Unfortunatelly I was working at remote desktop without access to installation CD to install Windows Support Tools containing "httpcfg". But the solution was quite simple...

What I did to fix:

1. Opened the Registry Editor
2. Navigated to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters"
3. At "ListenOnlyList" registry value there was a reference to old IP address.
4. Changed the old IP address to new one in "ListenOnlyList" value.
5. Restarted HTTP service ("net stop http / net start http")
6. Restarted IIS service ("net stop w3svc / net start w3svc")

And it works now...

ASP.NET

• Buenas prácticas para crear sitios ASP.NET con IIS 6.0: Omar Al Zabir, autor del libro Creando un portal web 2.0 con ASP.NET 3.5, tiene un artículo que detalla las buenas prácticas que hay que seguir cuando configuramos un sitio con IIS 6.0. Es una lectura y compra obligada.
• Videos de ASP.NET Dynamic Data con VB: Bill burrows ha unido en una serie de vídeos un tutorial que nos enseña a usar el nuevo soporte de ASP.NET Dynamic Data de .NET 3.5 SP1. Podéis encontrar más enlaces a tutoriales de ASP.NET Dynamic Data en el anterior post sobre links aquí.
• Explorando la cache en ASP.NET: Abhijit Jana nos muestra las opciones de cacheado con ASP.NET. Si estáis interesados en otra gran técnica (pero no muy conocida), querréis leer un post que escribí aquí.
• Routing con WebForms: Wally McClure tiene un podcast donde nos muestra cómo usar la nueva infraestructura de rutado de ASP.NET en .NET 3.5 SP1 con páginas basadas en formularios. Un montón de gente piensa incorrectamente que esta característica sólo funciona en aplicaciones ASP.NET MVC - cuando en realidad también funciona con formularios web (en realidad todos los sitios con APS.NET Dynamic Data lo usan.
• Integración continua con ASP.NET y despliegue usando CruiseControl.NET, Subversion, MSBuild y Robocopy: Omar Al Zabir tiene otro artículo - esta vez implementando la integración continua con ASP.NET.

ASP.NET AJAX y jQuery

• Introducción a jQuery (Parte 1): Rick Strahl ha posteado un artículo de introducción a jQuery, y habla sobre cómo aprovechar sus características en páginas ASP.NET.
• Nuevo soporte AJAX para aplicaciones guiadas por datos: Bertrand Le Roy ha escrito un artículo para MSDN que muestra las nuevas características disponibles en ASP.NET AJAX en la preview de hoy. Leed también sus post aquí y aquí para aprender más sobre el soporte de templates de lado del cliente.
• Usando jQuery para mejorar el indicador de progreso de ASP.NET AJAX: Dave Ward tiene un artículo que describe cómo integrar la funcionalidad de jQuery con el control UpdatePanel de ASP.NET AJAX para mejorar el estado de progreso.
• ASP.NET AJAX: Habilitar marcadores en el botón de volver del navegador: Scott Mitchell continúa con su serie sobre ASP.NET AJAX y muestra cómo añadir puntos en el historial en paginas con AJAX para que los visitantes puedan marcarlas, así como habilitar la navegación atras/siguiente en el navegador. Esta es una nueva característica que se ha añadido a ASP.NET  en .NET 3.5 SP1.
• 46 tutoriales para el ASP.NET AJAX Control Toolkit: Christian Wenz ha publicado 46 tutoriales tanto en VB como en C# en el que nos muestra escenarios típicos con el ASP.NET AJAX Control Toolkit.

Microsoft Web Platform

• Instalación de plataformas web: Hacer un instalador para despliegue web: Scott Hanselman tiene un post donde nos muestra el nuevo "Microsoft Web Platform Installer" que estamos creanto para permitir una forma rápida de instalar cada componente web de Microsoft - y tener rápidamente una máquina lista para el desarrollo web.

Espero que sirva.

Scott.

Traducido por: Juan María Laó Ramos.

Artículo original.

http://knowledge.xtravirt.com/hot-tips/virtualcenter-2x/12-virtualcenter-2x/32-virtualcenter-and-iis-conflicts.html

Microsoft Web Platform Installer Beta (download here) or more info here

What does it do?

It’s a single tool that helps you get started installing the Microsoft Web Platform including:

· ASP.NET components

· SQL Server 2008 Express Edition (and all required pre-requisite software)

· IIS Extensions such as Secure FTP, Web Playlists, URL Rewriter, and much more!

· Visual Web Developer

· .NET Framework 3.5 SP1

· SQL Server Driver for PHP

and Supported Operating Systems are: Windows Vista RTM, Windows Vista SP1, Windows Server 2008

Además, simplifica los métodos de configuración del aislamiento de usuarios (útil para configurar servicios de hosting) y la configuración de FTP sobre SSL. La descarga está, de momento, sólo en inglés.

Tuesday, 14 October 2008
3:00 p.m.
Morrice Hall, Room 328
(3rd floor)
3485 McTavish Street

My first pass at integrating it was to do everything at once: tie in WebDAV.net, add authentication and authorization, and change the WebDAV/file mapping from root = root to root/a/b/c = root. Needless to say, this was too big of a chunk to bite off.

So step 1 turned into getting it so that I could open the application with a WebDAV client. This involved tweaking another HttpModule that was throwing a NullReferenceException because app.User wasn't defined. Things seemed to work, so I checked it in.

Step 2 was to tie in auth. I got the WebDAV component to set the response status to 401, but it and the Forms authentication disagreed about what that meant: WebDAV wanted to send a HTTP Basic Auth request, and ASP.NET wanted the user to be redirected to the login page. After fighting with this for a day or so, it became clear that the WebDAV part of the site would need to be a separate ASP.NET application. Also, another dev pointed out that the WebDAV module was messing up other parts of the site.

So I created a new project and plopped the WebDAV module in it. It took some time to get it back to the point where it was running (the HttpModule wasn't being loaded at one point, and it wasn't giving me either warnings or errors). Next was to create a connection to the database...

I tried copying over configuration from the main application to the new application in order to get all of the dependency injection stuff to work on the WebDAV application. This way I could do ServiceLocator<ILoginDataProvider>.Get(), just like the main application did when the user logged in. I was creeping towards this, when I realized that most of the high-level auth code in the main application assumed that it was running in a forms-based authentication environment (e.g. the data provider pulled information from the session, if it was constructed with the CompositeWeb services container), and I needed to do a protocol-based authentication.

I had an epiphany at this point -- why complicate things by using CompositeWeb when all I needed was to make two calls to the LoginDataProvider? Two concrete constructor calls later, I had auth implemented for the WebDAV web application.

Along the way, I discovered that the best way to test was to set up a virtual directory in IIS. Visual Studio was helpful enough to create the virtual directory of my choosing. In order to get WebDAV to work correctly, I needed to add the ASP.NET ISAPI dll as a wildcard handler, and I needed to tell IIS that there would never be any authentication (i.e. disable digest, basic, and integrated authentication). Disabling integrated authentication makes VS tell you that you can't debug the application, but this is a lie... Build the application, then Debug, Attach to Process, and pick aspnet_wp.exe. You just can't use the F5 shortcut that normally does all of that for you.

So, here's what I'd say about integrating WebDAV into an existing ASP.NET application:

• WebDAV.net works fine (though the framework has a couple of very obvious bugs when you don't set up debug logging).
• Make it a separate application. If you want it to look like it's a subfolder of your application, deploy it to a subdirectory of the application.
• Don't try to use CompositeWeb and WebDAV.net at the same time.

Y claro después de actualizar, el primer problema, los apaches hacen de frontales a unos cuantos IIS ( como para dejarlos en DMZ) pues nada más cambiar de versión  empezaron los problemas, el proxy reverso escupía  errores 502 como un loco cuando le tocaba servir el contenido de los IIS,  y la situación se hacía insostenible.

[Thu Aug 23 19:22:38 2007] [error] [client 192.168.x.1]  \
proxy: error reading status line from  remote server 192.168.0.xxx

Googleando un poco encuentro un bug en apache que se parece sospechosamente a mi problema, y la solución que pasa por incluir estas lineas en el host virtual donde hacemos proxy reverso al infame IIS :

        ProxyRequests Off
        ProxyBadHeader Ignore
        SetEnv force-proxy-request-1.0 1
        SetEnv proxy-nokeepalive 1

Przejdź do Panel sterowania > Programy i funkcje. Wybierz 'Włącz lub wyłącz funkcje systemu Windows'.

Zaznacz odpowiednie checkboxy w 'Internetowe usługi informacyjne'. Wciśnij 'OK' i zaczekaj.

Po wpisaniu w przeglądarkę adresu http://localhost/ powinieneś zobaczyć obrazek powitalny.

The error I was getting was a 2294, because it wasn't loading the correct .net 2.0 framework number. By default iis loads v2.0.50215 and the newer version is v2.0.50727 on my box so I changed the AppPool to use/load the newer version and bamm! iis is back online.

1) Change clientCredentialType to Certificate (this would require you to customize wsHttpBinding) & specify the serviceCertificate in serviceCredentials of the web.config file. (N.B. The service can pick the certificate only from Local Machine).

2) Next using Add Service Reference, generate proxy for the client. After generation you need to specify the location of the client certificate (normally this would Current User certificate store). This can be done by specifying new endpoint behavior on the client side.

3) As a final step in the client’s app.config file you need to change value:

<identity>
      <dns value="YourCertNameHere" />
</identity>

(N.B. If you hosting your service on IIS & running under ASPNET/NETWORKSERVICE account, you would have to grant rights to that certificate so that IIS can access it when required. This would require you to download FindPrivateKey (I found it here) and execute below commands:
1) findprivatekey My LocalMachine -n CN=localhost –a
2) Output - (C:\Documents and Settings\All Users\ApplicationData\Microsoft\Crypto\RSA\MachineKeys\
7b90a71bfc56f2582e916a51aed)
3) cacls "C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7b90a71bfc56f2582e916a51aed" /E /G ASPNET:R
(Change ASPNET in step 3 to NETWORKSERVICE – For Windows Vista IIS7))

Download Files

• Click Start, and then click Run.
• In the Open box, type cmd, and then click OK.
• In the command prompt window, navigate to the %drive%:\Inetpub\Adminscripts folder, where %drive% is the drive in which Windows Server 2003 is installed.
• In the Adminscripts folder, type the following command:
cscript adsutil.vbs set w3svc/AppPools/Enable32bitAppOnWin64 1

Note: The value "1" for Enable32bitAppOnWin64 specifies 32-bit mode, whereas the value "0" specifies 64-bit mode.

• Press ENTER.
• Type iisreset and then press ENTER.
• Close the command prompt window.

IIS would now run in 32 bit emulation mode and you can now install x86 based applications on the server.

Because EPO use Apache on the port 80, I have tested wsus on a new tcp port in IIS (8530 and 8531 for SSL), I have discovered that wsus seems not very confortable with a least 2 things:

• If wsus install itself in iis using custom port, it put itself in the ‘WSUS Administration’ web site on port 8530
• When running the client diag of wsus on some client, every client complain with some errors (VerifyWUServerURL() failed with hr=0×80072efd). I have finally discovered that it is mainly due to the fact the the ‘SelfUpdate’ service in IIS is not in the Default web site.
• I have also discovered that even if all seems working nice, I still have some errors in the event viewer like 'The DSS Authentication Web Service is not working'

Here are the steps that I have taken to solve my issues:

• Move EPO apache to port other that 86
  • See https://knowledge.mcafee.com/article/579/614037_f.SAL_Public.html for more information about this. Just remember that you will have also to reinstall your client on each computer that connect to your EPO server.
  • At this end of the procedure, remember to delete the file following the procedure found here:
    • Recompile the ePO agent: 
      In Windows Explorer, navigate to: …\Program Files\Network Associates\ePO\3.x.x\DB\Software\Current\EPOAGENT3000\Install409
    • Move the FramePkg.exe and Framework.z files out of this folder to the root of the c: drive.
      NOTE: Once the ePO services are restarted in the next step, the FramePkg.exe and Framework.z files will be recompiled back into this folder.
    • Click Start, Run, type: services.msc right-click on the following services and click Start:
      NOTE: This will create a new FramePkg.exe and Framework.z file.
      McAfee ePolicy Orchestrator 3.x.x Server
      McAfee ePolicy Orchestrator 3.x.x Event Parser
  • Generate a new Framework package using EPO console
  • On each client, update the Framework EPO agent using : FramePkg.exe /Install=agent /ForceInstall /silent
    Note: On some computers, you will have to uninstall the agent before updating it using “C:\Program Files\Network Associates\Common Framework\FrmInst.exe” /forceuninstall”

• Ok now the port 80 is free for IIS.
  • Make sure the value for PortNumber under the “HKLM\SOFTWARE\Microsoft\Update Services\Server\Setup” key is set to the correct port (the one your WSUS site is on).
  • Make sure that the IIS web site where WSUS is installed is called ‘Default Web Site’
  • Go to your wsus installation (C:\Program Files\Update Services\Tools) and use:
    - wsusutil configure ssl : if you use ssl
    - wsusutil usecustomwebsite false : this will either move your wsus to the ‘Default Web Site’ site in IIS on use port 80 or if you use the ‘true’ option, this will move wsus to the ‘WSUS Administration’ IIS web site on port 8530 port.
• Reconfigure your SSL in IIS
  - On the root ‘Default Web Site’ site in IIS, go in ‘Directory Security’ tab on tell IIS to reuse a certificate that you have already have created.
  - Reconfigure SSL for some folders in IIS, according my previous post.
• Of course, you will have to configure your GPO or registry to reflect the changes.

And finally no more errors!

IIS Admin Service or a service dependent on IIS Admin is not active. It most likely failed to start, which may mean that it's disabled. Restart attempt failed",

look into the error log an see if you have a bad SMTP install.

It's so easy that it's not much worth a guide - basically you click on your server in IIS 7.0 manager and select the "Server Certificate" icon, you click on "Create Certificate Request" in the right pane and follow the prompts.  Then, after it creates your CSR, you submit that to the CA and install the CRT that comes back.  Then you bind it to the site, itself.  Done.  If you factor in the waiting it's as easy to do in Windows 2008 as it is on any of my *nix boxes.