
Event Briefing: Introducing IIS7: Microsoft's Next Generation Web Server
This was a one day event held by Microsoft at the British Library Conference Centre in London on May 23rd 2007.
It was aimed at IT Professionals and also Internet hosting companies (RackSpace staff attended in large numbers).
So this was a day looking at the current Beta 3 release of Longhorn Server focusing just on IIS7.
I have tried to roll-up all the various points made in the day into separate sections of interest.
Security
MS are building on the proven security of IIS6.
Examples quoted: “No critical IIS 6 hotfixes since RTM”
With IIS6 pretty much all of the components were installed but disabled, with IIS7 the design is modular with few dependencies between modules. This allows you to just install the components you need thus reducing the attack surface.
All application pools are sandboxed by default. New sites are automatically assigned to a unique pool which is associated with a unique SID. A temporary applicationpool.config is created at runtime which contains only the settings for that pool with only the unique SID allowed access. It is not possible for any other pool to read the configuration of another pool.
Architecture
IIS6 had a monolithic implementation; you installed either all or nothing.
IIS7 is split into 40 modules which allows a minimal installation for a designated role. The request pipeline is now generic with any modules being able to plug into it. All modules extend the server functionality through a public module API which makes it easier for developers to extend functionality.
Unlike IIS6 the UI is easier to extend, it is designed to be extensible, modular and it is built on .NET.
ScalabilityMS are building on the proven scalability of IIS6.Example quoted: “MySpace – 23 Billion Page Views/Month”, “Microsoft.com – 10K Req/sec & 300K Connections”, “Match.com 30 million page views daily”
IIS7 supports shared configuration to aid management of web farms. This allows each web server to load their config at start-up from a central resource and there is the option to cache that information should the config server go offline. However, MS are still looking at potential polling options for when the config server comes back online.
Administration & Management
The IIS Manager UI is now task oriented (similar to the ISA 2004 experience). It has a context sensitive “Actions” pane and the familiar IIS tabs have nearly all gone being replaced by icons.
Both IIS and ASP.NET configuration are both performed in the one UI. You can view health and diagnostics and there is built in remote administration over https (using a wizard driven self cert certificate so no need to install a separate certificate server).
Remote Admin: The admin website is gone so all admin has to be performed from an installed client on Windows 2003 or XP (client may ship with a service pack) but it should be native on Vista. You can use Windows and non-Windows credentials, IIS7 has its own users called IIS Manager Users. Users are added to sites for management delegation, you cannot allocate sites to users. These users are only used by the WMSVC and Admin UI, no other IIS components and importantly they do not map to Windows user accounts.
To enable remote admin you must install the Management Service and them enable it.
The UI is designed so that it is simple to manage either 1 or 1000 sites. It has a filter box so that partially typing a site or app pool name will then only show matching sites in the UI.
Tracing and Diagnostics
IIS7 has prescriptive error messages which give better guidance of where to look for a problem. Also built in failed request tracing that can log the entire request process to aid diagnosis or a problem.
Secure FTP
Microsoft’s implementation of FTP hadn’t developed from the IIS4 release. It didn’t support current internet standards such as SSH, UTF8 and IPv6. The new version called Secure FTP will support SSL but not SSH. It will not ship with the RTM but will be delivered out of band.
What’s Not In IIS7
Currently no publishing method. WEBdav was Microsoft’s preferred publishing method but it hasn’t really caught on as a standard and so it is not in this release of IIS. Secure FTP should come along out of band but probably won’t be there for RTM. It is interesting to note the WEBdav is owned by the Exchange team and SharePoint 2007 again seems to use its own version (not all the WEBdav features work in the SharePoint implementation but those features just aren’t required).
FPSE (FrontPage Server Extensions) have also been dropped but might return out of band.
Content replication is not supported as there is no replacement for Application Center Server 2000. The current thoughts are UNC storage on fast SAN (or equivalent) and use shared configuration for the IIS configuration. MS are to produce a White Paper in due course.
Web application written in .NET2 that make use of http handlers won’t work with IIS7, you will get a 500.22 error. There is, however, a migration path to get the functionality working using a command line tool.
No Admin, Website, POP3, NNTP or IIS5 Worker Process Isolation Mode.