FTP Site Virtual Directory Properties - Virtual Directory Tab
Use this tab to change the properties of a virtual directory in your FTP site. A virtual directory is a directory that is not physically contained within the home directory. To visitors of your site, it appears as though the virtual directory is contained within the home directory.
To add a new virtual directory to an FTP site, right-click the FTP site in IIS Manager, select Create New, and then click Virtual Directory.
The content for this resource should come from
A directory located on this computer
Click to permit users to access a specified directory on this computer to view or update FTP content. You can control access to the content by implementing any Windows security method.
In the Local Path box, type the path to the directory or the destination URL. The syntax must match the currently selected path type. For a local directory, use the full path, for example, C:\Inetpub\Ftproot). For a network share, use a Universal Naming Convention (UNC) server and share name, for example \\Webserver\htmlfiles.
A directory located on another computer
Click to permit users to view or update FTP content on another computer that has an active connection to this computer. If you have administrative credentials on the remote computer, you can control access to the content by implementing any Windows security method.
In the Network share box you can type the server name and directory name. Click the Connect As button to type or change the network user name and password information.
FTP site directory
If you click A directory located on this computer, the following options are available:
Local path
When content comes from a directory located on this computer, this box displays the path to the directory that stores your FTP site files. By default, these files are stored in the %localdrive%\inetpub\Ftproot directory.
Browse
Click to locate the directory path.
If you click A directory located on another computer, the following options are available:
Network share
Type the server name and directory name.
Connect as
Click to provide a user name and password for access to the network share.
If you click either A directory located on this computer or A directory located on another computer, the following options are available:
Read
Select to enable users to read or download files stored in a home directory or a virtual directory.
Write
Select to allow users to upload files to the enabled directory on your server. You should enable write permissions only for directories that are intended to accept files from users.
Log visits
Select to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this FTP site. Logging is enabled by default.
Related Topics:
To learn more about FTP site administration, see FTP Site Administration in IIS Help.
To learn more about setting up an FTP site, see FTP Site Setup in IIS Help.
To learn more about logging site activity, see Logging Site Activity in IIS Help.
FTP Site Properties - Directory Security Tab
Use this tab to allow or block access to your FTP site to individual computers or groups of computers.
TCP/IP address access restrictions
By specifying the TCP or IP address of the computer or computers to be assigned or denied access, you can control access to FTP resources, such as sites, virtual directories, or files.
Granted access
Click this option to grant access to all computers.
To add computers, groups of computers, or domains that you want to deny access to, click Add, and type the required information in the Deny Access dialog box. The computers that are denied access appear in the Except the following list box.
Denied access
Click this option to deny access to all computers.
To add computers, groups of computers, or domains that you want to grant access to, click Add, and type the required information in the Grant Access dialog box. The computers that are granted access appear in the Except the following list box.
Add
Click to define a computer or group of computers to which you want to grant or deny access.
Note Computers accessing your server across proxy servers appear to have the same IP address as the proxy server.
Remove
Click to remove the currently selected item from the exception list.
Edit
Click to modify the specific properties of the currently selected item in the exception list.
Related Topics:
To learn more about FTP site administration, see FTP Site Administration in IIS Help.
To learn more about FTP authentication and security, see FTP Site Authentication in IIS Help.
Grant Access or Deny Access
Use these two dialog boxes to list the computers, groups of computers, or domains that you want to grant or deny access to this resource.
Single computer
Click to define access rights for a single computer.
If you select a single computer you will need to know the IP address of the computer.
IP address
Type the Internet Protocol (IP) address of the computer.
DNS Lookup
Click to look up a specific computer's IP address using the domain name (for example, www.MyServer.com). In the DNS Lookup dialog box, type the DNS name for the computer in the Type the DNS name box, and click OK.
You can configure IIS to perform a DNS lookup every time access is requested for the site, virtual directory, or file. However, using the DNS lookup each time a request is made can affect server performance.
Note If you get a "Host not found" error, either the domain name you typed in is incorrect, or the computer you referred to is not available on the network.
Groups of computers
Click to define access rights for a group of computers based on network ID and subnet mask.
When you grant or deny access to groups of computers, you are required to identify them by network ID and subnet mask. A subnet mask, or address mask, is a numerical address of a subnet that includes the network. The mask simply overlays all but the significant part of the network address. Ask your network administrator for information about TCP/IP networking, IP addressing, and the use of subnet masks.
Network ID
This identifies the numerical address of the network that the group of computers are members of.
Subnet mask
This identifies the address mask that, to make the subnet address unique, replaces all but the non-significant numbers of the network ID in order to make the subnet address unique.
Related Topics
To learn more about security, see Security in IIS Help.
To learn about FTP authentication, see FTP Site Authentication in IIS Help.
Application Pools - Recycling Tab
Use this tab to administrate the recycling of worker processes. In worker process isolation mode, you can configure IIS to periodically restart worker processes in an application pool, allowing you to manage precisely those worker processes that are faulty. This ensures that specified applications in those pools remain healthy, and that system resources can be recovered.
To recycle a worker process, the ability of the faulty worker process to receive requests is throttled until it completes processing of all remaining requests that it has stored in the request queue. To drain its current requests, the process is given a configured limit. A replacement worker process for the same namespace group starts before the old worker process stops. This prevents service interruptions. The old process completes its outstanding requests, and then shuts down normally or is explicitly terminated if it does not shut down after a configurable time limit, number of requests, on a set schedule, or when a specified limit of memory usage is reached.
Recycle worker processes (in minutes)
Select to recycle worker processes after a specific period of inactivity.
Recycle worker process (number of requests)
Select to recycle worker processes after a specific number of requests.
Recycle worker processes at the following times
Select to use a scheduling scheme to shut down a process and start a replacement.
Add
Click to add a time of day to the scheduled-based worker process recycling criteria.
Remove
Click to remove the currently selected scheduled-based criteria for worker process recycling.
Edit
Click to modify the currently selected scheduled-based criteria for worker process recycling.
Recycle worker process after consuming too much memory
This option allows use of a memory consumption limit scheme to shut down a process and start a replacement. These settings control the memory recycling thresholds when the amount of virtual memory or private memory used by a worker process becomes too high in relation to total system memory. Memory-based recycling is suited for reducing heap fragmentation and recovering memory from applications with memory leaks.
Maximum virtual memory
Select to set the maximum number of megabytes of your system’s common virtual memory to be used by a worker process before that process is recycled.
Entering too high a value can severely decrease system performance. As a starting point, use the default value and work down to the lowest value possible while maintaining good performance.
Maximum used memory
Select to set the maximum number of megabytes of privately allocated system physical memory to be used by a worker process before the process is recycled.
Entering too high a value can severely decrease system performance. As a starting point, use the default value and work down to the lowest value possible while maintaining good performance.
Related Topics:
To learn more about worker processes and recycling, see Recycling Worker Processes in IIS Help.
Application Pools Properties - Performance Tab
Use this tab to configure the way that Internet Information Services (IIS) shuts down idle worker processes, the number of requests waiting to be processed, CPU monitoring, and the number of processes in a Web garden.
Idle timeout
Idle timeout limits helps conserve system resources by terminating unused worker processes by gracefully closing idle processes after a specified idle duration. This allows you to better manage the resources on particular computers when the processing load is heavy, when identified applications consistently fall into an idle state, or when new processing space is not available.
Shutdown worker processes after being idle for (time in minutes)
Select to terminate any idle worker processes after a specific period of inactivity.
Type a number in the box, or click the up and down arrows, to set the amount of minutes before an idle worker process terminates.
Request queue limit
Select to configure IIS to monitor the number of requests for a designated application pool queue before queuing a new request.
Application pool queue length limits prevent large numbers of requests from queuing up and overloading your server. If adding the new request to the queue exceeds the capacity of the queue, the server rejects the request and sends a non-customizable 503-error response to the client.
Limit the kernel request queue (number of requests)
Select to configure IIS to use a numeric-based scheme for limiting incoming HTTP requests and allow you to limit the size of the request queue. When the limit is reached, IIS does not process those additional requests, but sends a non-customizable 503-error response to the client.
Type a number in the box, or click the up and down arrows, to set the limit for the number of requests allowed in the queue.
Enable CPU monitoring
Select to configure IIS to use CPU accounting to track and terminate worker processes that consume large amounts of CPU time that exceed the specified limits. CPU monitoring is available only for applications pools and does not apply to CGI applications.
Maximum CPU use (percentage)
Type a number in the box, or click the up and down arrows, to set the percentage of CPU usage a worker process is permitted to use.
Refresh CPU usage numbers (in minutes)
Type a number in the box, or click the up and down arrows, to set how often CPU process numbers are to be refreshed in order to be used by CPU monitoring.
Action performed when CPU usage exceeds maximum CPU use
From the list box, click the best action to perform when the CPU exceeds its specified maximum usage.
· If No action is selected, when the CPU usage for a specific application pool or group of pools reaches the set limit, IIS writes an error in the Event Log.
· If Shutdown is selected, when the CPU usage for a specific application pool reaches the set limit, IIS initiates a shutdown of all worker processes in the application pool by allowing each worker process the application pool's specified ShutdownTimeLimit seconds to shut down. If the processes do not shut down in that time frame, IIS terminates the worker processes. The application pool shuts down and resets according to the time limit set in CPUResetInterval.
Web garden
A Web garden is an application pool using more than one worker process.
Maximum number of worker processes
Type a number in the box, or click the up and down arrows, to set the maximum number of worker processes allowed within an application pool.
Related Topics:
To learn more about the timeout and CPU features, see Quality of Service in IIS Help.
To learn more about Web gardens, see Configuring Web Gardens
Application Pools Properties - Health Tab
Use this tab to configure worker processes health monitoring. You can set limits for communicating with the worker processes, determine a course of action if a number of processes rapidly fail, and set startup and shutdown times.
Enable pinging
Select to configure Internet Information Services (IIS) to ping each worker process in an application pool every specified number of seconds to detect the activity of the processes.
IIS monitors the health of worker processes by periodically pinging them to determine their responsiveness. If worker processes fail to respond to a ping, the worker process is terminated and a replacement worker process is created.
Ping worker process every (frequency in seconds)
Type a number in the box, or click the up and down arrows, to set the time interval, in seconds, when worker processes are pinged for activity.
Enable rapid-fail protection
Select to configure IIS to remove this application pool from service and place it in a mode where the kernel-mode driver immediately returns a 503 Service Unavailable - out-of-service message to any requests to that application pool.
Rapid-fail protection protects your Internet service from widespread interruptions by detecting and isolating application pools where worker processes are rapidly failing.
Failures
Type a number in the box, or click the up and down arrows, to set a numerical limit on unexpected program terminations. This must be set in conjunction with the Time period setting.
Time period (time in seconds)
Type a number in the box, or click the up and down arrows, to set a time limit in which to detect the corresponding number of unexpected program terminations. This must be set in conjunction with the Failures setting.
Startup time limit
Worker process must startup within (time in seconds)
Type a number in the box, or click the up and down arrows, to set the worker process startup time in seconds.
Shutdown time limit
Worker process must shutdown within (time in seconds)
Type a number in the box, or click the up and down arrows, to set the worker process termination time, in seconds, after IIS detects inactivity.
Related Topics:
To learn more about rapid fail protection, see Application Pool Health in IIS Help.
Application Pools Properties - Identity Tab
The identity of an application pool is the name of the account under which an application pool's worker process runs. By default, application pools operate under the NetworkService account, which has the least user rights that are required to run Web applications. This account provides the most security against attackers who might attempt to take over the computer on which the World Wide Web Publishing Service (WWW service) is running. You can configure application pools to run as LocalSystem, which is an account with more assigned user rights than the NetworkService account; however, running an application pool under an account with more user rights assigned presents a more serious security risk.
For example, suppose that an Internet service provider (ISP) wants to allow customers to upload Common Gateway Interface (CGI) applications and then add them to an application pool. Running the CGI-enabled applications in a separate application pool under the NetworkService account
—with its minimal user rights—prevents these applications from being used to take over the server.
Predefined
Click any of the predefined security accounts in the list box.
Configurable
Click to configure your own application pool security by specifying the identity with a user name and the associated password. If you use a custom user account, that account must be part of the IIS_WPG group, or the application pool will fail.
User name
Type the alias of the user permitted to access this data source and table.
Password
Type the password that is associated with the user name specified above.
Browse
Click to view a list of available Windows user accounts on this server.
Note In previous versions of IIS, worker processes ran under the LocalSystem account. Because the LocalSystem account has access to almost all resources, this can have serious security implications. For better security, the IIS 6.O default is to run worker processes under the newly built-in NetworkService account. IIS 6.0 also allows you to configure the account on which worker processes run.
Related Topics
To learn more about the NetworkService account and the LocalSystem account in IIS, see Configuring Worker Process Identity in IIS Help.
Web Site Properties - Web Site Tab
Use this tab to set a friendly name for your Web site, configure access to your Web site, set connection limits to your site, and enable logging and configure the logging format for your site.
Web site identification
In order for browsers to access your Web content, both an IP address and TCP port number must be defined.
Description
Type a friendly name for your Web site. The friendly name appears in the console tree of IIS Manager.
IP address
Assign an IP address from the list box or type a new IP address to be used for accessing this site. If you do not assign a specific IP address, this site responds to all IP addresses assigned to this computer and not assigned to other sites, which makes this the default Web site. For an IP address to appear in the list, the IP address must have already been defined for use on this computer in Control Panel. See Windows Server 2003 family Help for more information. The description of the site is not required.
TCP port
Assign the TCP port on which the Web service is running; the default for the Web service is port 80. You can change the port to any unique TCP port number, but if you change the port number, clients must know in advance to request that port number, or their requests fail to connect to your server. A port number is required; this text box cannot be left blank.
SSL port
Assign the SSL port that is to be associated with this Web site identity. The default SSL port number is 443. You can change the SSL port to any unique TCP port number, but to connect to your server, clients must know in advance to request that port number, in order to connect to your server. An SSL port number is required only if SSL encryption is used. Otherwise, if SSL encryption is not enabled for your site, the SSL Port
Advanced
Click to further configure the IP address, TCP port number, and Host Header value that are used to access to your site.
Connections
You can set the length of time in seconds before the server disconnects an inactive user. This ensures that all connections are closed if the HTTP protocol fails to close a connection. Most Web browsers ask the server to keep the connection open across multiple requests. This is referred to as an HTTP Keep-Alive, an HTTP specification that allows for greatly enhanced server performance. Without it, a browser has to make numerous connection requests for a page containing multiple elements, such as graphics. A separate connection may need to be made for each element. These additional requests and connections require additional server activity and resources, decreasing server efficiency. Additional requests also make a browser much slower and less responsive, especially across a high-latency (slow) connection. HTTP Keep-Alives are enabled by default during the installation process.
Connection timeout
Type a number in the box to set the length of time in seconds before the server disconnects an inactive user. This ensures that all connections are closed if the HTTP protocol fails to close a connection.
Enable HTTP Keep-Alives
Select to enable a client to maintain an open connection with your server, rather than re-opening the client connection with each new request. Disabling Keep-Alives may degrade server performance. HTTP Keep-Alives are enabled by default.
Enable Logging
Select this option to enable your Web site's logging features, which records details about user activity and creates logs in your choice of format.
The information is stored in ASCII files or an ODBC-compliant database. Logging information in IIS goes beyond the scope of the event-logging or performance-monitoring features of Microsoft ® Windows®. The logs can include information such as who has visited your site, what the visitor viewed, and when the information was viewed last. You can use the logs to assess content popularity or identify information bottlenecks.
Active log format
Select one of the following formats for the log files.
· Microsoft IIS Log Format: A fixed ASCII format.
· NCSA Common Log File Format: A fixed ASCII format.
· ODBC Logging: A fixed format logged to a database that is compatible with that database.
· W3C Extended Log File Format: A customizable ASCII format, selected by default. To use Process Accounting, the W3SVC Extended Log File format must be selected.
Properties
Click to configure options for log file creation (for example, weekly, or by file size), or to configure properties for W3C Extended logging or ODBC logging.
Related Topics
To learn more about naming Web sites, see Naming Web Sites in IIS Help.
To learn more about encrypting data with SSL, see Encryption in IIS Help.
To learn more about HTTP Keep-Alives, see Enabling HTTP Keep-Alives in IIS Help.
To learn more about logging site activity, see Logging Site Activity in IIS Help.
Advanced Web Site Identification
Use this dialog box to add additional Web site identities, or SSL identities to your computer.
A Web site identity consists of an IP address, TCP port, and an optional host header name, which associates a name with a single static IP address to host multiple sites. You add the host name to your name resolution system (typically DNS) so that when a request reaches the server, IIS uses the host name to determine which site the clients are requesting. This host name is passed in the HTTP header.
An SSL identity consists of an IP address and an SSL port number.
Multiple identities for this Web site
You can add, remove, or edit Web site identities for this Web site. A Web site identity consists of an IP address, TCP port, and an optional host header name. Each Web site must have a unique combination of identification characteristics. Therefore, while multiple Web sites can share two of their three identification characteristics, (IP address, TCP port, and host header name), they must have at least one characteristic that is different. Because SSL certificates contain the domain name in them, Web sites using certificates cannot share an IP address with other Web sites.
Add
Click to add a Web site identity.
Remove
Click to remove the currently selected Web site identity from the list.
Edit
Click to edit the currently selected Web site identity.
Multiple SSL identities for this Web site
You can add, remove, or edit SSL identities for this Web site. An SSL identity consists of an IP address and an SSL port number. An SSL identity is required only if SSL encryption is used. If SSL encryption is not enabled on your site, the Add, Remove, and Edit buttons are unavailable.
Add
Click to add an SSL identity for this Web site, which consists of an IP address and an SSL port number. The Advanced Web Site SSL Identification dialog box appears. The default port number for SSL is 443. If a port number, other than the default is used, your clients must know in advance to request that port number as part of the URL; otherwise their requests fail to connect properly to your server.
Remove
Click to remove the currently selected SSL identity from this Web site.
Edit
Click to edit the currently selected SSL identity for this Web site.
Related Topics
To learn more about naming Web sites, see Naming Web Sites in IIS Help.
To learn more about encrypting data with SSL, see Encryption in IIS Help.
Logging Properties - General Tab
Use this tab to specify how log files are created and saved. A file name is displayed under the Log file directory box; this name is determined by the log file format and the criterion used for starting new log files.
New log schedule (common for all log formats)
Any changes to the log schedule defined takes effect immediately after applying the new settings.
Hourly
Click to create log files hourly.
Daily
Click to create log files daily, starting with the first entry that occurs after midnight.
Weekly
Click to create log files weekly, starting with the first entry that occurs after midnight Saturday.
Monthly
Click to create log files created monthly, starting with the first entry that occurs after midnight of the last day of the month.
Note "Midnight" is midnight local time. Midnight is used for all log file formats except W3C Extended format, which by default uses midnight Greenwich Mean Time, but can be specified as midnight local time (by selecting the Use local time for file naming and rollover option below).
Unlimited file size
Click to always append data to the same log file. You can access this log file only after stopping the server.
When file size reaches
Click to create a new log file when the current log file reaches a given size. Type or click the up and down arrows to specify the size you want.
Use local time for file naming and rollover (W3C-specific)
Select to set creation time and naming format for W3C Extended log files to midnight local time rather than Greenwich Mean Time.
Log file directory
Type or browse to the directory in which log files will be saved.
Browse
Click to locate the directory to which log files will be saved.
Related Topics
To learn more about logging site activity, see Logging Site Activity in IIS Help.
Logging Properties - Advanced Tab
Use this tab to customize W3C Extended logging by choosing the fields (items) to be recorded in the log. Where appropriate, the abbreviated field name appears after the proper name. To limit log size, omit unneeded fields.
Date
Select to record the date the activity occurred.
Time
Select to record the time the activity occurred.
Extended Properties
Client IP Address
Select to record the IP address of the client that accessed your server.
User Name
Select to record the name of the authenticated user who accessed your server. This does not include anonymous users, who are represented by a hyphen (-).
Service Name
Select to record the Internet service and instance number that was accessed by a client.
Server Name
Select to record the name of the server on which the log entry was generated.
Server IP
Select to record the IP address of the server on which the log entry was generated.
Select to record the port number the client is connected to.
Method
Select to record the action the client was trying to perform (for example, a GET command).
URI Stem
Select to record the resource accessed (for example, an HTML page, a CGI program, or a script).
URI Query
Select to record the query, if any, the client was trying to perform; that is, one or more search strings for which the client was seeking a match.
Protocol Status
Select to record the status of the action, in HTTP or FTP terms.
Protocol Substatus
Select to record additional status of the action, in HTTP terms. For more information about the Protocol Substatus property, see Substatus Error Codes in IIS Log Files in IIS Help.
Win32 Status
Select to record the status of the action, in terms used by the Microsoft® Windows® operating system.
Bytes Sent
Select to record the number of bytes sent by the server.
Bytes Received
Select to record the number of bytes received by the server.
Time Taken
Select to record the length of time the action took to complete. For all log formats except ODBC logging, Time Taken is logged in milliseconds, according to the following technical breakdown: The client-request timestamp is initialized when HTTP.sys (the kernel-mode driver) receives the first byte (before HTTP.sys begins parsing the request). The client-request timestamp is stopped when the send completion occurs (for the last send) in IIS. Time Taken does not reflect time across the network. Also note, the first request to the site shows a slightly longer time taken than other similar/same requests because HTTP.sys opens the log file with the first request.
Protocol Version
Select to record the protocol (HTTP, FTP) version used by the client. For HTTP, this is either HTTP 1.0 or HTTP 1.1.
Host
Select to record the content of the host header.
User Agent
Select to record the browser used on the client.
Cookie
Select to record the content of the cookie sent or received, if any.
Referrer
Select to record the previous site visited by the user. This site provided a link to the current site.
Related Topics
To learn more about W3C Extended logging, see Customizing W3C Extended Logging in IIS Help.
To learn more about logging site activity, see Logging Site Activity in IIS Help.
Web Site Properties - Performance Tab
Web Site Properties - Performance Tab
Use this tab to set properties that affect bandwidth use, and the number of client Web connections. By configuring network bandwidth on a given site, you can better control the amount of traffic allowed to that site. For example, by restricting bandwidth and/or the number of connections on a low-priority Web site, you allow other, higher-priority sites to handle larger traffic loads. Settings are site-specific and can be adjusted as network traffic and usage changes.
Bandwidth throttling
Bandwidth throttling limits the bandwidth available to this Web site. Bandwidth throttling uses Packet Scheduler to manage when data packets are sent. When you configure a site to use bandwidth throttling using IIS Manager, Packet Scheduler is automatically installed, and IIS automatically sets bandwidth throttling to a minimum of 1024 bytes/second. However, if you use another method (for example, Active Directory® Service Interfaces [ADSI] or Windows Management Instrumentation [WMI]), you must install Packet Scheduler for bandwidth throttling to work correctly.
Limit the network bandwidth available to this Web site
Select to enable bandwidth throttling on this Web site.
Maximum bandwidth
Type a number in the box or click the up and down arrows to set the maximum bandwidth, in kilobytes per second, that you want to be available to this Web site.
Web site connections
You can configure Internet Information Services (IIS) to allow an unlimited number of concurrent connections, or to limit the number of connections it accepts for this Web site. Setting the number to an unlimited amount circumvents constant administration if your connections tend to fluctuate. However, system performance can be impacted if the number of connections exceeds your system resources. Restricting this site to a specified number of connections can keep performance stable. Settings are site-specific and can be adjusted as network traffic and usage changes.
Unlimited
Click to configure this Web site to handle an unlimited number of concurrent connections.
Connections limited to
Click to set a specific number of concurrent connections to this Web site. Type a number in the box or click the up and down arrows to set the number of connections.
Related Topics
To learn more about the bandwidth throttling feature, see Throttling Bandwidth in IIS Help.
To learn more about limiting simultaneous connections to a Web site, see Limiting Connections in IIS Help.
To learn more about the role of the performance management, see Performance Tuning in IIS Help.
Web Site Properties - ISAPI Filters Tab
Use this tab to set options for ISAPI filters. An ISAPI filter is a program that responds to events during the processing of an HTTP request. The table lists each filter's status (which can be enabled or disabled), file name, and priority for loading into memory. You can change the execution order of filters only with the same priority.
Important If you have added or changed a filter at the global level, you must restart Internet Information Services (IIS) to load the new filter. If you have added or changed a filter at the Web site level, the filter is not loaded until a request is made to the Web site.
Add
Click to add an existing ISAPI filter by browsing for the executable file and providing a friendly name.
Remove
Click to remove the currently selected ISAPI filter from this load list.
Edit
Click to modify the properties of the currently selected ISAPI filter.
Disable
Click to prevent the currently selected ISAPI filter from loading, but keep it in the filter list.
Move up
Click to move the currently selected filter higher in the execution order.
Move down
Click to move the currently selected filter lower in the execution order.
Related Topics:
To learn more about ISAPI filers, see Installing ISAPI Filters in IIS Help.
Add/Edit Filter Properties
Use this dialog box to establish ISAPI filter properties. An ISAPI filter is a program that responds to events during the processing of an HTTP request.
Filter Name
Type a friendly name for the ISAPI filter. Friendly names often include version numbers to ensure proper updates with future versions of the filter.
Executable
Type the full path to the executable program associated with this ISAPI filter.
Browse
Click to locate the ISAPI filter.
Related Topics
To learn more about ISAPI filers, see Installing ISAPI Filters in IIS Help.
Web Site Properties - Home Directory Tab
Use this property sheet to create and manage Web sites on your IIS server. The settings on this tab are similar to those available on the Home Directory tab of virtual directories.
Setting up local or network paths allows the request to be directed to the correct physical location. You can further configure the physical location by setting user access rights, choosing whether to log requests for these resources, and choosing whether to index this site using the Indexing Service. To specify when the request is received, applications must be identified, located, and given the appropriate execute permissions and protection.
The content for this resource should come from
This setting allows you to define the location of the home directory for this Web site.
A directory located on this computer
Click to permit users to access a specified directory on this computer to view or update Web content. You can type the directory name in the Local path text box. You can control access to the contents by implementing any Windows security method.
A share located on another computer
Click to permit users to view or update Web content on another computer that has an active connection to this computer. If you have administrative credentials on the remote computer, you can control access to the contents by implementing any Windows security method. When selected, you can enter the server name and directory name in the Network Directory box. Click Connect As to enter network user name and password information.
A redirection to a URL
Click to redirect the client application, such as a browser, to another Web site or virtual directory by entering a URL in the Redirect to box. When selected, redirect options are substituted for path options.
If you click either A directory located on this computer or A share located on another computer, the following options are available:
Local path
When content comes from a directory located on this computer, this box displays the path to the directory that stores your Web site files. By default, these files are stored in the %localdrive%
\inetpub\wwwroot directory.
Browse
Click to locate the directory path.
Network directory
When content comes from another computer on the network, this box displays the computer name and share name of the content location.
Connect as
When content comes from another computer on the network, click to provide a user name and password for access to the network share.
Script source access
Select to allow users to access source code if either Read or Write permissions are set. Source code includes scripts in ASP applications.
Read
Select to allow users to read or download files or directories and their associated properties.
Write
Select to allow users to upload files and their associated properties to the enabled directory on your server or to change content in a Write-enabled file. Write access is allowed only when a browser that supports the PUT feature of the HTTP 1.1 protocol standard.
Directory browsing
Select to allow users to see a hypertext listing of the files and subdirectories in this virtual directory. Because virtual directories do not appear in directory listings, users must know a virtual directory's alias. If Directory browsing is disabled and the user does not specify a file name, the Web server displays an "Access Forbidden" error message in the user's Web browser.
Log visits
Select to configure IIS to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this Web site.
Index this resource
Select to allow the Microsoft Indexing Service to include this directory in a full-text index of your Web site.
Note Before setting this option, you must enable the Indexing Service through the Add or Remove Programs item in Control Panel.
Application name
Type the name of the root directory that contains the files and subdirectories of an application.
Starting point
This displays the metabase node where the application is configured.
Execute permissions
This option determines the program execution level allowed for this site's resources.
· Set permissions to None to restrict access only to static files such as HTML or image files.
· Set permissions to Scripts to allow only scripts to run, not executables.
· Set permissions to Scripts and Executables to remove all restrictions so that all file types can be accessed or executed.
Application pool
Click the application pool in the list box that is associated with this home directory.
Remove/Create
Click to remove an application, or to create an application from the Web site while leaving the virtual directory intact.
Configuration
Click to configure application mappings, options, and debugging features.
Unload
Click to unload an isolated application from memory, or to unload a pooled application not referenced by any other application.
If you click A redirection to a URL, the following options are available:
Redirect to
Type a fully qualified URL from which the content will be served.
The exact URL entered above
Select to redirect a virtual directory to the destination URL without adding any other portions of the original URL. You can use this option to redirect an entire virtual directory to one file. For example, to redirect all requests for the /scripts virtual directory to the Default.htm file in the home directory, type /Default.htm in the Redirect to box and select this option.
A directory below URL entered
Select to redirect a parent directory to a child directory. For example, to redirect your home directory (designated by /) to a subdirectory named /newhome, type /newhome in the Redirect To box and select this option. Without this option, the Web server will continually map the parent to itself.
A permanent redirection for this resource
Click to send the following message to the client: "301 Permanent Redirect." Redirects are considered temporary, and the client browser receives the following message: "302 Temporary Redirect." Some browsers can use the "301 Permanent Redirect" message as the signal to permanently change a URL, such as a bookmark.
Related Topics
To learn more about the home directory, see Setting the Home Directory in IIS Help.
For a listing of redirect variables and redirect wildcards, see Redirect Reference in IIS Help.
To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.
Web Site Properties - Documents Tab
Use this tab to define your site's default Web page and to append a footer to the site's documents.
Enable default content page
When enabled, the default document is served to the browser whenever the browser request does not specify a document name. Default documents can be a directory's home page or an index page containing a site document directory listing. Multiple documents can be listed in a top-down search order. The files shown are located in the site’s Home directory. The order can be modified by using the Move Up and Move Down buttons.
Select the Enable default content page check box to enable the Web server to identify a default document whenever a browser request does not specify a document name.
Add
Click to add additional default documents. Default documents are served in the order in which the names appear in the list. The server returns the first document it finds.
Remove
Click to remove a default document from the list without deleting the file.
Enable document footer
Select the Enable document footer check box to configure your Web server to automatically append a footer to every document your Web server returns. The footer file should not be a complete HTML document. It should only include only HTML tags that are necessary to format the appearance and function of your footer content.
Browse
Click to locate and specify the full path and file name for your footer file.
Related Topics
To learn more about a default document, see Setting Up a Default Document in IIS Help.
To learn more about adding a footer to your Web pages, see Adding a Footer to Web Pages in IIS Help.
Web Site Properties - Directory Security Tab
Use this tab to set IIS security features to confirm the user identity of users before granting access to restricted content.
Authentication and access control
This setting allows you to configure your Web server to confirm the user identity of users before assigning access to restricted content. Before your Web server can authenticate users, however, you must first create valid Windows user accounts and then configure the NTFS directory and file permissions for those accounts.
Edit
Click to configure your Web server's authentication and anonymous access features.
IP address and domain name restrictions
This setting allows you to assign or deny specific users, computers, groups of computers, or domains from accessing this Web site, directory, or file based on IP address or domain name.
Edit
Click to add settings that set restrictions on or deny access to this Web site, directory, or file by specific users, computers, groups of computers, or domains.
Secure communications
Windows provides means to secure communication between the client and the Web server using server certificates and certificate mapping. You can implement secure communications by enabling Windows directory service mapping, which allows you to use the Directory Service client-certificate mapping rather than one-to-one or many-to-one mapping. To enable this service, the server must be a member of the Windows® Server 2003 domain.
Enable the Windows directory service mapper
Select to use Directory Service client-certificate mapping rather than one-to-one or many-to-one mapping. To enable this service, the server must be a member of the Windows Server 2003 domain. This option is available only when editing properties for all Web sites.
When editing properties for a specific Web site, the following options are available:
Server Certificate
Click to start the Web Server Certificate Wizard and obtain a server certificate.
View Certificate
Click to view the server certificate (if there is one installed) for this Web site.
Edit
Click to enable communication settings such as certificate acceptance, certificate mapping, and the certificate trust list.
Related Topics
To learn more about user authentication in IIS, see Web Site Authentication in IIS Help.
To learn more about access control, see Access Control in IIS Help.
To learn more about certificates in IIS, see Certificates in IIS Help.
To learn more about mapping client certificates to user accounts, see Client Certificate Mapping in IIS Help.
Authentication Methods
Use this dialog box to configure your Web server to verify user identities. You can authenticate individuals or select groups of users to prevent unauthorized persons from establishing a Web (HTTP) connection to restricted content. Anonymous access allows users to establish an anonymous connection. The user logs on to IIS with an anonymous or guest account. There are currently four Authenticated access methods:
· Windows Integrated authentication uses a cryptographic exchange with the user's Web browser to confirm the identity of the user.
· Digest authentication works only with Active Directory® accounts, sending a hash value over the network, rather than a plaintext password. Digest authentication works across proxy servers and other firewalls and is available on Web Distributed Authoring and Versioning (WebDAV) directories.
· Basic authentication transmits passwords across the network in cleartext, an unencrypted form.
· .NET Passport authentication is a Web authentication service.
Enable anonymous access
Select this check box to establish an anonymous connection for users. IIS logs on the user with an anonymous or guest account. By default, the server creates and uses the account IUSR_
computername.
User name
This is the user name for the account used for anonymous access only within Windows.
Password
The anonymous user account password is used only within Windows. Anonymous users do not log on by using a user name and password.
Browse
Click to search and select the object type, such as user, and the location, such as your computer or any accessible computer connected on the network.
Authenticated access
Options selected in this section require that users provide a valid Microsoft Windows user name and password before they access any information on your server.
Integrated Windows authentication
Select to ensure that the user name and password are sent across the network in the form of a hash. This provides a secure form of authentication.
Note If this authentication method is enabled, IIS uses Windows Integrated authentication only when Anonymous access is disabled and Anonymous access is denied because Windows file system permissions have been set, requiring users to provide a Windows user name and password before establishing a connection with restricted content.
Digest authentication for Windows domain servers
Select to work with Active Directory® and send a hash value over the network, rather than a cleartext password. This method works across proxy servers and other firewalls. Using Digest authentication requires that a Realm be defined.
Basic authentication (password is sent in cleartext)
Select to send the password across the network in cleartext. Basic authentication is part of the HTTP specification and is supported by most browsers; however, user name and password are not encrypted and could present security risks.
.NET Passport Authentication
Select to enable .NET Passport authentication services on your Web site. NET Passport allows users of your site to create a single sign-in name and password for easy, secure access to all .NET Passport-enabled Web sites and services. .NET Passport-enabled sites rely on the .NET Passport central server to authenticate users rather than hosting and maintaining their own proprietary authentication systems. However, the .NET Passport central server does not authorize or deny a specific users' access to individual .NET Passport-enabled sites. It is the responsibility of the Web site to control user permissions. Using .NET Passport authentication requires that a Default domain be defined.
Default domain
This identifies the Windows domain used for user authentication control.
Select
To authenticate the user or group, click to view a list of all domains to which you are connected.
Realm
This identifies the domain or other operating system authentication controller used to authenticate the user or group.
Select
Click to view a list of all domains and realms to which you are connected.
Related Topics:
To learn more about user authentication, see Web Site Authentication in IIS Help.
To learn more about .NET Passport authentication, see .NET Passport Authentication in IIS Help.
IP Address and Domain Name Restrictions
Note Computers accessing your server across proxy servers display the same IP address as the proxy server.
IP address access restrictions
Granted access
Click to grant access to all computers.
To add computers, groups of computers, or domains that you want to deny access to, click Add, and type the required information in the Deny Access dialog box. The computers that are denied access appear in the Except the following list box.
Denied access
Click to deny access to all computers.
To add computers, groups of computers, or domains that you want to grant access to, click Add, and type the required information in the Grant Access dialog box. The computers that are granted access appear in the Except the following list box.
Add
Click to define a computer or group of computers to which you want to grant or deny access.
Remove
Click to remove the currently selected item from the exception list.
Edit
Click to modify the specific properties of the currently selected item in the exception list.
Related Topics:
To learn more about security, see Security in IIS Help.
Secure Communications
Use this dialog box to configure Secure Sockets Layer (SSL) settings for encrypted communication. When a Web browser supporting secure communications connects to a Web site configured to use SSL (URLs starting with https:// ), a secure connection protects the data being transferred. A client certificate is a digital identification issued by a trusted, third-party organization, referred to as a certification authority. You can configure your Web server to accept, require, or reject client certificates as a means of establishing a connection with a particular file or directory. Users attempting to access a site with client certificates can be mapped; users without client certificates can use other authentication methods. Client certificate mappings match information contained in a client's certificate against Windows user account information. A certificate trust list (CTL) is a list of approved certification authorities for a particular Web site.
Require secure channel (SSL)
Select to configure IIS to require an encrypted communication link for a Web browser to connect with this Web site, directory, or file. When this option is selected, all data sent to and from this Web site is encrypted using a certificate.
Require 128 bit encryption
Select to configure IIS to require a 128-bit encrypted communication link for a Web browser to connect with this Web site, directory, or file.
Ignore client certificates
Select to allow users access to this site without being prompted to present a client certificate.
Accept client certificates
Select to allow access for users with client certificates, without requiring the certificate. Users with client certificates can be mapped; users without client certificates can use other authentication methods.
Require client certificates
Select to allow only users with a valid client certificate to connect. Users without a valid client certificate are denied access to this site. Before you can select this option to require client certificates, you must select the Require secure channel (SSL) option.
Enable client certificate mapping
Select to configure your server to authenticate users who log on with a valid client certificate.
Edit
Click to edit or, if no certificate mapping exists, create a client certificate mapping. When a user logs on to your Web site with a certificate, their permissions match those of the user account to which the certificate is mapped.
Enable the Windows directory service mapper
Select to use Directory Service client-certificate mapping rather than one-to-one or many-to-one mapping. To enable this service, the server must be a member of the Windows Server 2003 domain.
Enable certificate trust lists
Select to edit existing CTLs or create a new one. A CTL is a list of approved certification authorities for a particular Web site and are applicable only at the Web-site level.
Current CTL:: Click a CTL for this site from the list box.
New:: Click to create a new CTL for this site.
Edit:: Click to change the settings of the currently selected CTL in the list box.
Related Topics
To learn more about certificate mapping, see Client Certificate Mapping in IIS Help.
To learn more about certificates, see Certificates in IIS Help.
Web Site Properties - HTTP Headers Tab
Use the HTTP Headers tab to set values returned to the browser in the header of the HTML page. You can also set content ratings for content, and define MIME types.
These values can be set globally for all sites or separately within each site. Internet Information Services (IIS) uses an inheritance model for these settings. If you set or change a setting that conflicts with a setting at another node in the hierarchy, you are prompted to specify the nodes to which this new setting applies.
Enable content expiration
Select the Enable content expiration check box to include expiration information for time-sensitive material, such as special offers or event announcements. The browser compares the current date to the expiration date to determine whether to display a cached page, or to request an updated page from the server.
Expire immediately
Click this option and content expires immediately after it is served. This setting forces the browser to always retrieve the content fresh from the server on subsequent requests.
Expire after
Set a specific period of time after which the browser is forced to retrieve the content again from the server on the subsequent requests.
Expire on
Select to set a specific date and time after which the browser is forced to retrieve the content again from the server on the subsequent requests.
Custom HTTP headers
You can use this property to send a custom HTTP header from the Web server to the client browser. Custom headers can be used to send instructions from the Web server to the client browser that are not yet supported in the current HTTP specification, such as newer HTTP headers that IIS may not inherently support at the time of the product's release. For example, you can use a custom HTTP header to allow the client browser to cache the page but prevent proxy servers from caching the page.
Add
Click to add a new custom HTTP header.
Edit
Click to edit the properties of the currently selected custom HTTP header.
Remove
Click to remove the currently selected custom HTTP header.
Content rating
Use content ratings to embed descriptive labels in the HTTP headers of your Web pages. Browsers, such as Microsoft® Internet Explorer, version 3.0 or later, can detect content ratings to help users identify potentially objectionable Web content.
Edit Ratings
Click to set content rating values.
MIME types (site, directory, and virtual directory levels)
Multipurpose Internet Mail Extensions (MIME) mappings set the various file types that IIS serves to clients. IIS serves only files with extensions registered in the MIME types list.
MIME types can be defined globally for IIS, and additional MIME types can be defined at the Web site, Web site directory, and Web site virtual directory level.
IIS uses an inheritance model for MIME type settings. MIME types defined at the global level are inherited by all Web sites, Web site directories, and Web site virtual directories. MIME types defined at the Web site, Web site directory, or Web site virtual directory are used only at that particular node. If you set or change a MIME type that conflicts with a setting at another node in the hierarchy, you are prompted with an Inheritance Override dialog box where you can specify the nodes to which the new setting applies.
The registered file types that are installed on this computer are listed in the Registered MIME types (file extensions) list box.
Caution IIS 6.0 returns an error (404.3) if a request refers to a file with a file extension that is not in the MIME map or script mapped. If you want to allow IIS to serve all files regardless of their extension, you have to either add the particular extension or a wildcard (.*) to the MIME map.
MIME Types
Click to configure MIME mappings. These mappings set the various file types that the Web service returns to browsers
Note When you click a MIME type, the MIME mappings are listed in the MIME Types box.
Related Topics
To learn more about content ratings, see Using Content Ratings in IIS Help.
To learn more about MIME types, see Working with MIME Types in IIS Help.
To learn more about editing MIME types directly in the IIS metabase, see the MimeMap property.
Add/Edit Custom HTTP Header
Custom headers appear in the HTTP Headers tab of a property sheet in the form Name: Value. Type the name and value of your custom HTTP header in the Custom header name and Custom header value boxes.
Related Topics
To learn how to create multiple Web sites using host header names, see Hosting Multiple Sites Using Host Header Names in IIS Help.
Content Ratings - Ratings Tab
Use this tab to configure your Web server's content rating features for a particular Web site, directory, or file.
Your Web server's Platform for Internet Content Selection (PICS) system uses a rating system developed by the Internet Content Rating Association (ICRA), which rates content according to levels of violence, nudity, sex, and offensive language. For more information about ICRA, see http://www.icra.org.
Enable ratings for this content
Select to set the rating levels on this Web site for each of the listed categories.
Category
Adjust the Rating slider bar for each category to the appropriate level for this content.
E-mail address of person rating this content
Type an e-mail address in the text box to identify the person rating this content.
Expire on
Select an expiration date to control the duration of the rating. After this date, no rating is associated with the content.
Related Topics
To learn more about content ratings, see Using Content Ratings in IIS Help.
Web Site Properties - Custom Errors Tab
Use this tab to customize HTTP error messages that are sent to clients when Web server errors occur. Administrators can use generic default HTTP 1.1 errors, detailed custom error files that IIS provides, or create their own custom error files.
These values can be set globally for all sites or separately within each site. IIS uses an inheritance model for these settings. If you set or change a setting that conflicts with a setting at another node in the hierarchy, you are prompted to specify the nodes to which this new setting applies.
Edit
Click to change the properties of the currently selected custom error message.
Set to Default
Click to configure the currently selected custom error message to use the default HTTP 1.1 error.
Note To change the settings for multiple errors, press the CTRL or SHIFT key and click the HTTP errors.
Related Topics
To learn more about custom error messages, see Custom Error Messages in IIS Help.
Edit Custom Error Properties
Use this dialog box to edit custom error messages. Click a custom error message, and then click Edit.
For security and other system concerns, some errors cannot be customized to point to a URL. For example, the error 401;2 “Unauthorized - Logon failed due to server configuration” does not allow a custom error message on a URL because if a server configuration exists, it might not be possible to reach the URL containing the custom error file.
Message type
Click the type of message that you want to be returned to the client browser — Default, File, or URL — from the Message type list box.
Default
Click to return the default HTTP 1.1 error to the client browser. File allows you to map the custom error to a file by using a fully qualified file name. URL allows you to map the custom error to a URL. If the output type is a URL, this URL must exist on the local server. Click OK to save your selections.
File/URL
Browse to or type the location of the file mapped to the custom error.
Browse
Click to locate the directory and file.
Related Topics
To learn more about custom error messages, see Custom Error Messages in IIS Help.
Background Intelligent Transfer Service
Background Intelligent Transfer Service (BITS) helps you transfer large amounts of data without degrading network performance. It does this by transferring data in small chunks, utilizing unused bandwidth as it becomes available, and reassembling the data at the destination. BITS is supported on Microsoft® Windows Server 2003 family operating systems and on Microsoft® Windows 2000 Servers.
BITS downloads and uploads both file names, as Universal Resource Locators (URLs), and data. Any transfers that are interrupted by network disconnections or by computer shutdowns and restarts resume when network connectivity is re-established.
BITS Server Extensions is part of Internet Information Services (IIS) and has the following components:
- BITS management console snap-in, for configuring and managing BITS by using Microsoft Management Console (MMC).
- BITS server extension ISAPI, which is used for BITS data transfer.
If you want client computers to be able to use BITS to upload files to a server, you must configure an IIS server with BITS Server Extensions installed and activated.
For more information, see the following topics and Web sites:
- To install BITS Server Extensions, see To install BITS Server Extensions.
- To configure BITS Server Extensions, see To configure BITS Server Extensions.
- To review BITS-specific security information, see Concepts.
- To review the BITS PSDK, see Background Intelligent Transfer Service (http://www.microsoft.com/).
No comments:
Post a Comment