July
 2004

Just five years after the first World Wide Web protocols were authored in 1991, Microsoft began including a Web server application within its larger business-class Windows platform.

Today, four revisions later, Microsoft’s Internet Information Server is at version 6.0, a component, or service, of Windows Server 2003. While it’s still too early to determine whether Redmond’s latest incarnation will be able to put a dent in the overwhelming market share now claimed by the open-source Apache Web server, first impressions are positive.

IIS 6.0 enters a market already dominated by Apache. According to a June 2004 survey of more than 51 million Web sites conducted by Internet research firm Netcraft (www.netcraft.com), Apache owned 67 percent of the market, followed by various versions of IIS with 21 percent (public Web sites and corporate intranets are not included in this tally).

I’ve been following the machinations of Web server software more closely than usual as I prepare to update the NT 4.0/IIS 4.0 software currently hosting our corporate parent’s multiple Web sites to a foundation composed of Server 2003 and IIS 6.0.

In gearing up for the migration I’ve been doing rather extensive reading up on both apps, perusing Microsoft-supplied white papers as well as a number of non-Microsoft-sourced articles and books.

Apache’s appeal

Although we’ve already decided to move to IIS 6.0 - much of the code on our sites is written using Microsoft’s Active Server Pages scripting language and switching wasn’t an option - Apache’s allure is hard to ignore. In fact, were we starting from scratch, we would have used Apache to host our company’s Web sites.

Apache’s success comes down to two factors: cost and reliability. Indeed, cost is the most compelling: Since the software is open source, it’s free for the taking and users can deploy as many copies of the software on as many servers as they choose.

Often, Apache runs on a distro of Linux, and gets paired with the database mySQL and the PHP scripting language to form a very low-cost Web server installation capable of a wide range of interactivity.

By contrast, IIS has had to overcome a series of performance issues, not the least of which is a significant security hole, users say. Default installations of both versions 4.0 and 5.0 of IIS brought with them a variety of services that frequently left servers vulnerable to external intrusions.

With this in mind, virus writers would frequently target IIS, knowing many system administrators didn’t have the time or resources to update massive installations (often in the hundreds of servers) with the latest security patches.

In addition, the process of installing patches required administrators to take each server offline and reboot the machine before using it again. This added another level of inconvenience for administrators and sometimes led to complacency instead of staying current with the latest updates.

First impressions important

With those shortcomings in mind, IIS 6.0 has left some positive impressions.

For one thing, Microsoft addressed the app’s security concerns. It was widely reported that Bill Gates delayed the imminent release of Windows Server 2003 after an especially nasty virus attacked Windows 2000 and NT.

Gates himself called together the software’s team leaders and pushed back the app’s release date by several months to refocus the programmers on security.

That emphasis on security is very clear when one reads the white papers and proceeds through the server installation.

Now, when Server 2003 goes to its default installation, a very minimal set of services is made automatically active, and the IIS isn’t one of them.

Instead, administrators must consciously select IIS to make it active, unlike past versions (including Windows 2000) where IIS was installed automatically.

Once the server is installed, even the latest version of ASP, ASP.Net, isn’t automatically made active in order to decrease what Microsoft calls in its white papers the “attack surface.”

Activating the advanced .Net framework is a discrete and conscious choice. Because each feature that gets turned on increases the risk that the server could come under possible attack, Microsoft engineered Server 2003 with tools that make it very clear to users which vulnerabilities they might be exposed to once certain services are activated.

From small to large

One of my biggest criticisms of IIS’ earlier versions was the app’s propensity to turn minor failures into large ones.

It wasn’t uncommon for IIS to crash despite process isolation safeguards designed to protect the software in the event of disruptive code or other external factors.

Because IIS can be used to host multiple Web sites from a single server, a problem in one site had the potential of forcing all the sites down in the event of a crash.

Thankfully, IIS 6.0 has a totally new request processing architecture, called worker process isolation mode, which allows it to separate the operations of the Web server (answering requests and delivering pages) from the processing of site and application code.

Thanks to that design, applications can be completely isolated from each other, with up to 2,000 application pools per server.

According to Microsoft, isolation mode prevents a glitch from one application or site from stopping or disrupting another site hosted by IIS.

In addition, separating applications or sites into separate worker processes simplifies management. Users can now take one site or app offline without degrading the performance of other sites, and maintenance tasks such as debugging, swaps and bandwidth management can be conducted independently.

One feature I’m looking forward to trying is health monitoring. The server monitors site health by pinging worker processes periodically to determine if there’s any blockage. If a worker process is blocked, IIS terminates the worker process automatically and creates another one in its place.

An associated communication channel also lets IIS monitor worker process performance. Any drop in the channel alerts IIS to potential problems.

Theoretically, this type of protection could eliminate site failures stemming from less-than-perfect code or other internal errors. It’s the equivalent of an “automatic reboot” on a very micro-type of scale.

Microsoft is promising a lot with IIS 6.0 and I look forward to letting you know how the process works and if these promises prove to be reality - at least in our case. If any of you have experience with IIS 6.0 or earlier versions, I’d like to include your feedback as well.

Editor’s note: White paper information was provided from the document “Technical Overview of Internet Information Services,” published by Microsoft and last updated February 2004. You can find it by going to the Microsoft Knowledge Base on www.microsoft.com and searching for the title.

Hays Goodman is the webmaster for Newspapers & Technology and GMToday, a Milwaukee-area portal. He has been involved in professional Internet development for six years, and welcomes your comments, feedback and suggestions for future Tips & Tricks columns. Write to him at webmaster@conleynet.com and include your contact information.