jorkeo - hosting geek : Hosting

SQL 2008 Released

jorkeo — Fri, 08 Aug 2008 02:53:10 GMT

The final product of the Launch Wave has RTM'd - SQL Server 2008 - with a snazzy new logo:

If you have an MSDN or Technet subscription you can get it now - I'm very excited about one particular version in this version SQL 2008 Web - designed to be a cut down version of the full blown server, perfect for hosting environments.

Get your self a trial version and have a play.

-jorke

Technorati Tags: SQL Server 2008

Installing FTP with IIS7 on 2008 Server Core

jorkeo — Thu, 05 Jun 2008 10:36:51 GMT

I had a few questions from an old colleague, Virgil, who had just built a 2008 server core machine and was having issues configuring FTP. Without asking I knew Virgil would be chasing an FTP server that would have some method of secure transport such as FTPS and pluggable authentication methods, I know this because he's an interoperable kind of guy :)

He'd already been trying to configure this with the default install of FTP that comes with Server 2008, but I recommended that he use the downloadable version from the iis.net website. Only issue here is that you have to uninstall the old FTP server before that will install, then configure the service all over again... so after about 30 minutes of furious IM conversations this is how we did it..

First we uninstalled the FTP Service that comes with 2008 :

start /w pkgmgr /uu:IIS-FTPPublishingService;IIS-FTPServer

Then downloaded the FTP publishing service for IIS 7, with the friendly name of FTP7;
- x86 - http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1619
- x64 - http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1620

and installed it:

msiexec /i ftp7_x86_rtw.msi

Once that was in we simply had add the appropriate bindings to the site, like so (Make sure you close your quotes properly or it goes NUTS!) :

c:\windows\system32\inetsrv\appcmd.exe set site /site.name:"Default Web Site" /+bindings.[protocol='ftp',bindingInformation="*:21:"]

then we simply had to set an authorised user to the server:

c:\windows\system32\inetsrv\appcmd.exe set config "Default Web Site" /sectionystem.ftpserver/security/authorization /+[accessType='Allow',permissions='Read,Write',roles='',users='ftpuser'] /commit:apphost

And we were done! (or so we thought!).... On attempting to connect to the FTP server we ended up with the error :

534-Policy requires SSL.
Win32 error: Access is denied.
Error details: SSL policy requires SSL for control channel.
534 End
Login failed.

ahh that's right - by default the FTP install is set to run as FTPS thus requiring a secure connection... to turn off this feature (it was a lab environment and didn't require secure transfer) resulted in a LOT of head scratching, eventually to save time we popped open the applicationhost.config file and and added theses lines in the <site /> tag..:

Not very elegant but served the purpose - a bit more investigation I eventually fell upon the answer using the IIS7 Administration Pack, which allowed me to generate the correct script:

c:\windows\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/sites /[name='Default Web Site'].ftpServer.security.ssl.controlChannelPolicy:"SslAllow" /[name='Default Web Site'].ftpServer.security.ssl.dataChannelPolicy:"SslRequire" /commit:apphost

And there we go, FTP7 configured on Windows Server 2008 Core - couldn't be easier to script...

- jorke

Technorati Tags: Windows Server 2008,IIS,FTP,FTP7,Server Core

Hosting Days Australia - Coming to a City Near you!

jorkeo — Wed, 30 Apr 2008 02:36:24 GMT

via Christian

This years Hosting Days is "Fast Tracking Your Success with FastLane" in a city somewhere close to you, unless you are in Darwin or Alice Springs or Cameron's Corner....

Phil and I have the first track, which is the fun track all about the HOW of hosting.

Go to https://partner.microsoft.com/australia/40048707 to see the agenda and register

see you there!

- jorke

Technorati Tags: Hosting Days,partners,events

Hacked Web Applications causing storm - rattling Windows...

jorkeo — Mon, 28 Apr 2008 16:01:35 GMT

For the past few days a "Cyber attack" has been taking place and according to internetnews.com :

"number of infected IIS servers at 282,000. Less than a day later, security firm F-Secure wrote its own blog entry, putting the infestation at over 500,000"

and f-secure :

"Performing a Google search results in over 510,000 modified pages."

Without pointing out the reporting inconsistencies between servers and pages .... what is actually happening here..

First of all its not at all related to the security advisory that was released last week. Nor is it in fact related to any other security issue with IIS, ASP, ASP.NET or Windows. It's really important to understand that, its all to do with dodgy and insecure development practices.

Well very simply put its an age old SQL injection attack on a web site that modifies the return code adding a hidden link to a site that downloads malware to client viewing the web page. Nothing new technology wise here, just a new method of delivery - which really should not affect those who have kept their machines up-to-date.

In this case the attackers have chosen to target ASP/ASPX based web sites that have poorly written validation methods and deliver their code via a database content management system. The result being that pages on the site will return a hidden script tag that directs to one of the sites listed in the earlier articles - which picks on particular vulnerabilities available on the client machine, not just those related to software developed by Microsoft either.

Well that's all very nice you say - but "How do I protect myself against these kind of attacks?".

The way I see it, there are three areas of responsibility where lies the ability to protect the world against those few malicious people.

1. The Developer - FIX YOUR BROKEN CODE! Seriously - check your code for possible attack vectors and test, test test. I've seen heaps of web sites and web servers compromised due to poorly written or no validation checking. Incorrect security settings deploying to high risk environments. Don't always assume you know who is going to access your app. Don't assume that app will exist with everything local to it. Catch those errors - I could go on. There is heaps of guidance around this - here is a few to start you off:

2.The Client - Keep your machine up-to-date - as Coatsy says "go to update.microsoft.com and Download the golden padlock of goodness" from Microsoft Update.

3. The System Admin / Hoster / Guy who has to run the web server - Hey I sympathise with you most (of course I would!) You have to get a site with poorly written code up and running, and now what? you have to check the thing isn't going to compromise your server? but of course the code supplied doesn't work in your standard low security settings to you need to bend the rules to allow that code to work.. Be Strong!

But you may have been too late, and you have to clean this mess up on your server - how are you going to prevent this malicious code being delivered to and from your server, while keeping everything up and running?

Stop the attack coming in

If you are using IIS7 or URLScan on IIS6.0/5.1 you can filter the request to prevent the incoming attacks. In IIS7 This is what the configuration string looks like in your server wide applicationhost.config file (based on the info in articles):

Stop it going out

This is a little trickier, but due to the awesome modularity of IIS7 (only going to look at this) you can very easily write a module that can look in all the requests scan for the URL sequence in the response and send it to null. More information on doing this is at the IIS.NET website. Hey, if I get enough comments I'll write one and post it up here!

Done and Dusted

What we all need to remember about these kind of attacks is that vulnerability in the web sites being targeted are not limited to just a particular operating system platform. SQL Injection attacks is rampant in many platform agnostic applications and its such a simple thing to prevent.

As you have probably guessed I'm pretty passionate about this subject, and when I see such misguided reports and irrational reactions to incorrect or misunderstood information, it inspires me to ensure that the truth of the issue is available. Speaking personally; In my short time at Microsoft, I have never seen such commitment behind ensuring that the Windows Operating System is the most versatile and secure operating system on earth.

- jorke

Note: Graphics "borrowed" from Microsoft Japan Security Bulletins

Technorati Tags: SQL Injection,Security Vunerability,IIS,Windows,Microsoft

Potential Security Vulnerability for NetworkService / potential new IIS exploit

jorkeo — Fri, 18 Apr 2008 11:25:39 GMT

Important heads up with regards to a potential privilege escalation issue when running under NetworkService – which we all know is the IIS default.... But also note that it requires native code or full trust .NET.

Hosting Providers with Shared Hosting configurations should pay careful attention to this and ensure that they are running a customised version of medium trust at the very least - http://msdn2.microsoft.com/en-us/library/ms998341.aspx. Also be wary of any custom ISAPI extensions - i.e do a code review.

High level summary:

Processes running under Network Service identity can elevate to Local System on XP, Win2k3, Vista and Win2k8. Additionally, on Win2k3 any process running with an identity that has SeImpersonatePrivilege can elevate to Local System, and this privilege is required by IIS worker process identity. The Elevation of Privilege requires running native user code or full-trust managed code.

Our guidance is of course to move your app move WPI away from NetworkService to a windows account. Additionally on Win2k3, our guidance includes disabling Distributed Transaction Coordinator service (to close the hole where any identity with SeImpersonatePrivilege can elevate).

More information here: http://www.microsoft.com/technet/security/advisory/951306.mspx

Let me know if you have any further questions or require advice.

- jorke

UPDATE (6:23pm 18/4/08):

Check out Ken Schaefer's Blog for the origin of this potential issue.

Technorati Tags: Security Vunerability,NetworkService,IIS,exploit

HUGE performance increases with PHP on Windows 2008

jorkeo — Mon, 14 Apr 2008 05:54:57 GMT

One of our local developers Dallas J Clark (Brisbane local) blogged about an article that shows PHP with a 130% performance increase on Windows Server 2008 - and of course there have been a few comments asking about the metrics of the comparison etc. So naturally I'm wading into to try and clear the water..

I have to agree that there are a lot of unknowns and its difficult to do a competitive comparison with such little comparative data. What needs to be understood as that the results are for a specific case that the customer experienced, see the case study right here.

The facts are that Microsoft has spent a lot of time working with Zend to ensure that PHP has been engineered to run well on Windows.

The key difference to understand here is that you need to understand the execution architecture differences between *nix vs Windows, respectively multi-process vs multi-threaded. As CGI is designed for multi-process execution this can give pretty ordinary performance on Windows due to the threads/cycles involved in spinning up processes every time a request is processed by the web server. Of course you could attempt multi-threading using the ISAPI filter but ask what the results were from anyone who has tried :) – especially when you are not using code you have written all yourself – thus the best way to ensure reliable performance on Windows is to run via CGI – which of course the performance is not optimal.

Now how has this changed; IIS 7 has a FastCGI module as part of its install which by its design will make anything CGI based run faster, the idea being that it allows you to process multiple requests in the one connection and once the script has been processed the FastCGI process will keep running, waiting for more requests until its spun down as part of the web server. So in this case using PHP, it eliminates the constant overhead of loading PHP into memory each time a request needs to be processed or course increasing the speed of the request.

Also there are the “NTS” non thread safe windows binaries of PHP that are available off the php.net site - These binaries allow you to execute your code without needing to wait for thread synchronisation, meaning a HUGE performance increase. Couple this with FastCGI then you are you going to experiencing PHP running at a speed never before possible.

To test this I ran a little test, for metrics sake this is Windows Server 2008 Enterprise running in Virtual PC 2007 - allocated 512MB of RAM. The host machine is a HP Compaq Laptop

nc8430 Core 2 Duo @ 2.16Ghz and 4GB RAM, with a 7200 rpm disk, running Vista of course. My methodology was to grab a simple PHP site, run PHP with the standard CGI Module run a performance test, then change handler mapping to run the FastCGI Module and run the same performance test. The site I tested was on Qdig and performance tests were using the Web Capacity Analysis Tool (WCAT). The metric measured was Get Requests / second, because this is an indication of how long the requests are taking before they need to be queued by the web server.

On the left - NTS PHP with CGIModule - maximum approx 30 rps

On the right - NTS PHP with FastCGIModule - maximum approx 870 rps

Of course your mileage will vary, but you will have a comparable or better experience than on other platforms.

Questions?

-jorke

Technorati Tags: PHP Performance,PHP,IIS 7,IIS,Windows Server 2008,FastCGI,CGI

MIX: IIS7 bring hosters and developers together

jorkeo — Fri, 07 Mar 2008 22:19:00 GMT

Attended a great presentation at MIX by Tito Leverette Web Platform Architect Evangelist aka Hosting Guy from Atlanta and Rob Cameron Developer Evangelist aka Dev Guy:

Bring Hosters and Developers together with IIS7

I thought they did a great job of pointing out the differences between what a Dev guy wants and what hoster guy is going to give them :) Tito did a great job of giving the classic "BUT NARRR" then explaining why - but then again I am hoster biased...

-jorke

Technorati Tags: IIS,II7,hosting,developers,Windows Server 2008,Microsoft,MIX08

Microsoft Web Deployment Tool

jorkeo — Thu, 24 Jan 2008 03:54:52 GMT

A brand new IIS blog and a shiny new tool in tech preview. Check out the tech preview of the Web Deployment Tool from the awesome IIS Team.

This new tool is designed with migration from IIS 6.0 to IIS 7.0.

Get it, try it, tell me what breaks, so far I've found it rock solid!

- jorke

Technorati Tags: IIS,Deployment tool,hosting,IIS7.0,Microsoft

iis7forheroes.com - from Emantra

jorkeo — Wed, 23 Jan 2008 10:07:00 GMT

The guys at Emantra pinged me today with a project we've been talking about for a while, and I'm stoked these guys have pulled this off!

Go to their site http://iis7forheroes.com/ and get yourself some of:

The first SHARED IIS7.0 web hosting in Australia! (that I know of!)

Well done to Cam, Russ and Ross for a job well done, where can I get a shirt like the guy in the picture? :)

- jorke

Technorati Tags: emantra,hosting,iis7,iis7.0,windows server 2008

Infrastructure Architecture Design Questions

jorkeo — Mon, 14 Jan 2008 04:44:11 GMT

This is very interesting and fairly comprehensive list of basic operational questions to ask when building the infrastructure on your web facing project - from the Microsoft.com operations team.

I love the breakdown of availability, this is something I've had lots of discussions with people in the past - and I've found it a pretty good measure of priorities in the past:

Availability %	Downtime per year	Downtime per month*		Downtime per week
98%	7.30 days		14.4 hours	3.36 hours
99%	3.65 days		7.20 hours	1.68 hours
99.5%	1.83 days		3.60 hours	50.4 min
99.9%	8.76 hours		43.2 min	10.1 min
99.99%	52.6 min		4.32 min	1.01 min
99.999%	5.26 min		25.9 sec	6.05 sec
99.9999%	31.5 sec		2.59 sec	0.605 sec

The hardest question for anyone starting a new project is answering performance questions - how to test this without over-engineering and blowing out cost?

- jorke

Technorati Tags: Ms.com,architecture,Microsoft,hosting,infrastructure

What size footprint does your worker process leave?

jorkeo — Mon, 05 Nov 2007 15:43:00 GMT

Well it all depends on what you are cramming into your request pipeline! With IIS7's modular architecture you have the ability to load only what you need to run. What does this mean - well let's look at the footprint of a worker process that has all default modules loaded, i.e. ASP/ASP.NET/CGI/Authorization etc etc.

To see the footprint in its entirety we want to dump out the applications loaded and see their usage. For this I have a handy PowerShell script I whacked together (because I love PowerShell); So browse to your website to spin up a worker process then run the following at a PowerShell prompt:

gps -name w3wp | select -expand Modules | where {$_.Filename -like '*\inetsrv*} | ft

which should give you something like the following:

this shows the footprint of a worker module with a default install of IIS 7.0 - you can see all the various modules loaded there for authorization, authentication, gzip etc. So how big is our worker process with no modules? Well simply rip the <globalmodules> out of the applicationhost.config file - NOT RECOMMENDED - without backup up your config first of course. Now browse to your site and you will notice nothing happens...- because you've ripped out all the modules there is nothing to process the request - thus you will get a naked worker process - lets take a look:

So you can see with IIS7 you can really customize what happens in your request pipeline to make huge differences to the size of your worker processes. Neat eh?

Now I've also found out you can do the same as PowerShell script by simply running:

tasklist /fi "imagename eq w3wp.exe" /M

but where's the fun in that.. :)

-jorke

ServerManagerCMD.exe to install IIS7

jorkeo — Mon, 29 Oct 2007 09:54:01 GMT

This is by far the quickest and easiest way to install IIS7 on Windows Server 2008, and even better - you do it via the command line!

To install IIS7 on a brand spanking new build of Windows Server 2008 simply do the following:

For a default install - that is the basic options to run IIS7:

ServerManagerCMD.exe -I Web-Server

For a full install - this is the works, includes bacon AND pineapple:

ServerManagerCMD.exe -I Web-Server -allsubfeatures

This will give you the install text like so:

And after about 1 minute - IIS is installed!

Check out all the other cool stuff that you can do with ServerManagerCMD.exe

- jorke

Technorati Tags: ServerManagerCMD , IIS , IIS7 , Windows Server 2008 , Hosting

ISV Innovation Days

jorkeo — Wed, 03 Oct 2007 05:06:14 GMT

This is a great opportunity for hosters to network with Independent Software Vendors (ISV's) - as we all know that hosters are the platform of the future.

Here are the details from Luisa in our partner team:

ISV Innovation Days will allow you to connect with the Microsoft ISV Virtual Team (including representatives from the Microsoft Partner Team; and our Developer Platform Evangelism - DPE) and learn about the advantages and resources of becoming an early adopter for the 2008 launch wave products (Windows Server 2008, Visual Studio 2008, SQL Server 2008) in a relaxed workshop environment.

The Agenda includes New Opportunities with the 2008 Product Launch (for senior management), Whats new in Visual Studio 2008 & .NET Framework for Smart Client and Next Generation Web Development, What’s new in Windows Server 2008 for ISVs, What's Hot in SQL Server 2008 for our Customers and ISVs, and Integrating Business Solutions with Microsoft Office SharePoint

• Register Today in a city near you!

• Brisbane: 20 November 2007 (Microsoft Brisbane Office, Level 9, Waterfront Place, 1 Eagle Street, Brisbane, Queensland 4000)

• Melbourne: 27 November 2007 (Microsoft Melbourne Office, Level 5, 4 Freshwater Place, Southbank Victoria 3006)

• Sydney: 3 December 2007 (Department of State and Regional Development, Parkes Room, Level 47, MLC Centre, 19 Martin Place, Sydney New South Wales 2000)

• Perth: 6 December 2007 (Perth Microsoft Office, Level 14 QV1 Building, 250 St Georges Terrace, Perth Western Australia 6000)

• Adelaide: 7 December 2007 (Adelaide Microsoft Office, Level 2 Santos Building, 91 King William Street Adelaide South Australia 5000)

P.S. – in the afternoon, partners will have the opportunity for partnering with Microsoft in the healthcare industry. We’ll give you an overview of the significant investments Microsoft is making in healthcare around the world including the Connected Health Framework, Common User Interface and Health Connection Engine. You’ll also see real examples of exciting mobile devices and applications and learn why Microsoft and Intel together provide the ultimate platform for mobility in healthcare.

- jorke

Stacks of IIS 7.0 Webcasts - come get it while its hot!

jorkeo — Fri, 28 Sep 2007 03:11:35 GMT

Heaps of IIS7 webcasts coming up, great if you like staying up and playing in the early morning as that's when these webcasts will be aussie time but if you don't mind waiting a little while they should be archived and you can watch them at your leisure.

· What’s New in Microsoft Internet Information Services 7.0 for IT Professionals
Tuesday, October 02, 2007 11:30 AM Pacific Time (US & Canada)
Be one of the first to take a look at all the changes coming in the new, redesigned Internet Information Services (IIS) 7. This session focuses on new troubleshooting features, a breakdown of architecture and security improvements and the new IIS 7 configuration system. We also walk through demos showcasing IIS delegation administration control to non-administrators and new diagnostics tools. Also featured are the entirely new User Interface (UI) and configuration system

· Microsoft Internet Information Services 7.0 Diagnostics & Troubleshooting
Thursday, October 04, 2007 9:30 AM Pacific Time (US & Canada)
Ever want to know what's really happening inside your Web server? Like what requests are executing or what AppDomains are loaded in processes? Have you wanted to trace a request but only when it's failing? Come to this session to see how IIS7 is expanding its monitoring & diagnostics capability through features like Runtime Status & Control data that allow you to see not just which worker processes are serving which pools, but also what requests are executing in them and their current state (including what module they're in and how long they've been there!). We'll also be showing you a new feature called Failed Request Tracing that will allow you to configure IIS to trace requests for a specific URL and only flush those trace logs to disk if the request meets a failure condition that YOU define. Want to find out why your clients are hitting 401's? or why a request for a static file is taking WAY too long? Use Failed Request Tracing to view this data. Also covered is how you can instrument new managed modules and capture that tracing in IIS trace logs (like Failed Request Tracing), as well as how to route ASP.net Page Trace events into IIS trace logs. Come to this session to see how IIS7 is enabling you to finally get under the hood and see what's really happening.

· Securing and Tuning Microsoft Internet Information Services 7.0
Tuesday, October 09, 2007 11:30 AM Pacific Time (US & Canada)
Come learn how to take advantage of the new, modular architecture of IIS7 and Server Core to build a web server that is highly customized to only the functionality that you need, without unnecessary components installed on the machine. We’ll walk through how IIS installs and works on Server Core. You’ll learn how to remotely administer an IIS installation on Server Core using PowerShell scripts accessing the new remoteable managed administration interface, or manage IIS locally using our new AppCmd command-line interface. You’ll be able to see different types of dynamic applications (ASP and PHP) working on a Server Core installation of IIS. Get a deep dive into this exciting new configuration for lower cost of ownership and greater security.

· Deploying and Managing Web Farms
Thursday, October 11, 2007 9:30 AM Pacific Time (US & Canada)
Learn how to deploy and manage Web Farms using new features in IIS 7, like UNC support. When it comes to Web farms for shared hosting or enterprise, synchronizing your configuration across several nodes is the most important feature that you need. Come learn more about the new Internet Information Services 7 configuration system that replaces the metabase, and how it optimizes Web farm scenarios. Do you want to point your Web server configuration at a central location? Do you want to quickly add new nodes without painful replication and manual tasks? Shared configuration helps you accomplish fault tolerance, load balancing and fail-over. In this session, we outline the fundamental new changes and how to turn these features into a great solution.

· Secure, Simplified Web Publishing using Microsoft Internet Information Services 7.0
Tuesday, October 16, 2007 11:30 AM Pacific Time (US & Canada)
Learn how web publishing is changing for Microsoft Internet Information Services (IIS) 7.0. This session takes and in-depth look at the new FTP service for IIS 7, with demonstrations that showcase new features such as FTP over SSL, enhanced security features, and improved supportability options. We will also discuss Microsoft's plans for a version of the FrontPage Server Extensions for Windows Server 2008 and Windows Vista, as well as a new WebDAV implementation for IIS 7.

· Securely Delegating Remote Web Site Administration With Internet Information Services 7.0
Thursday, October 18, 2007 9:30 AM Pacific Time (US & Canada)
Remote administration and feature delegation—the coolest new features in Internet Information Services (IIS) 7. How do you enable low privilege users to connect to only their Web site or application without the nightmare of metabase ACLs? How do you allow users to change some feature settings but not others? How do you extend the UI so that new tasks can be accomplished easily? These are the types of solutions we show you. First, we review remote administration and how to use custom modules for enabling user scenarios. Then, we chat about how to give non-admins access to just their Web site and only specific settings like Default Documents

· Windows SharePoint Services and Windows Server 2008
Tuesday, October 23, 2007 11:30 AM Pacific Time (US & Canada)
Collaboration, Web application platform, and self service blogs and wikis are just a few reasons you should look at this role. Security, performance, and management and more is why SharePoint on Windows Server 2008 is more than compelling.

· Automating Microsoft Internet Information Services 7.0
Thursday, October 25, 2007 9:30 AM Pacific Time (US & Canada)
Tired of spending long nights doing the same tasks over and over? Save time and get your life back though automation. Come take a look at all the new ways to automate tasks within IIS7 by using Powershell, our revamped WMI provider, APPCMD.EXE and the new managed code administration API all from the command line! We’ll show you how to use the command line by automate common tasks to complex configurations. Some of the things you’ll learn include how do unattended installs of IIS7, setting up thousands of sites in a matter of minutes, and managing installations of IIS on Server Core. This is a must see for any Admin!

- jorke

Technorati Tags: iis7, webcasts, windows server 2008

Silverlight 1.0 released

jorkeo — Thu, 06 Sep 2007 03:56:14 GMT

Earlier today Scottgu posted Silverlight 1.0 has been released. I'm pretty excited about this especially about the cross-platform capability with "Moonlight", so silverlight now works on linux.

Hosting providers can easily host this now, with no change to their hosting environment - check out the Halo 3 video, this is silverlight 1.0, and Home Shopping Network

come get some!

-jorke

Tags: Silverlight, Linux, Halo, Hosting