Psst! Did you know DevelopmentNow is a mobile web site design agency?

Contact us for help mobilizing your site, or to sign up for our beta Mobile Web SDK!
all groups > iis security > march 2004 >

iis security : IIS Won't Work W/Symantec Security/Virus?



Blue Whale
3/13/2004 2:04:50 PM
I have been trying to install IIS on this Dell 1Ghz
Pentium III Workstation with Win2000Pro.
I am installing a local Intranet Web & using
FrontPage2002.
I finally got the IIS installed but I had to remove Norton
Internet Security and Anti-Virus 2004 to do it and IIS
will not work when I re-install these programs. Between
the security programs and the SP4 download upgrade, I
really messed the computer up! I had to re-install Win2000.
I now find that there are issues with Symantec Products in
relation with Internet Information Services(IIS). I really
need some input on what I can do about the apparent
software conflicts and what other Security and Anti-Virus
programs will work with IIS if no solution can be found
for the Symantec Products. I cannot get a Pentium 4
$8,000.00 Workstation at this time that uses hyper-
threading that a technician suggested MAY solve the
conflict.
Blue Whale (Wayne)
3/14/2004 5:26:48 AM
Thanks for the tips Ken,
Yes, I had completed the re-installation of Win2000Pro
with the SP4 upgrades and patches without the Security and
Virus programs installed and everything is running
smoothly including IIS.
1-I will try the scrip blocker and firewall suggestions.
2-Clairfying the hyperthreading remark suggested to
me...Was that the pentium 4 allowes hidden programs to run
in the background (like sucurity & anti-virus) without
interfearing with the program your working in, more or
less! But I thought that was an odd suggestion since I
believe Symantec makes software for large servers so they
must know something?
3-I will try the slow installation of the security & anti-
virus programs and see if I can locate the problem that
way.
Thanks again,
Blue Whale (Wayne)
[quoted text, click to view]
Blue Whale (Wayne)
3/14/2004 5:55:40 AM
Karl,
Thanks for the input.
1-As I posted I have everything working now but without
the Internet Security and Anti-Virus installed.
2-Sorry, no error messages pop up! When I stated, (Doesn't
Work) I meant that I could not select any of the IIS icons
in Control Panel with the security programs installed.
They are not grayed out but no amount of clicking will
launch the program!. That has changed. I now have full
control of IIS but without the security programs
installed. When I install Symantec Internet Security &
Norton Anti-Virus I cannot select the Icons nor can I find
IIS in Explore.
3-Yes, when I get this up and running I will take your
suggestion and "Lock it Down".
4-The Tech. that stated the Hyperthreading remark want's,
I guess, to provide a new pentium 4 model, which is great
except for the price tag. This Dell Workstation is for our
small office of 8 workstations Intranet Information Web
Site and will be used for developing a test web site for
the Internet hence the IIS installation.
We will use an off-site Web provider to host and service
our site when we eventually complete and initiate it.
Karl, thanks for the info. I'll work on your suggestions
this Monday,
Thanks again,
Blue Whale (Wayne)
[quoted text, click to view]
Karl Levinson [x y] mvp
3/14/2004 7:50:17 AM
Additionally, define "doesn't work." If you post the error message or
description of how it isn't working, and/or search www.google.com and
www.google.com/advanced_group_search for that error message, you may find
your answer.

I agree, the hyperthreading recommendation is complete nonsense.

You probably want to exclude both the firewall logs and the IIS logs from
being scanned by either on-demand or on-access anti-virus, to avoid
problems.

If you're running IIS, be sure you secure it, especially if it is visible on
the Internet. That includes running URLScan and the security checklists for
both Windows and IIS, all free from www.microsoft.com/technet/security
Also, see here:

http://securityadmin.info/faq.asp#harden

Last, Windows workstations do not make very good web servers except for
testing, because there is a limit of 10 max concurrent incoming network
connections, which translates into about 2 max users connecting at a time.
That means people will probably not be able to get to your web site all the
time. The only fix is to upgrade to Windows 2003 or 2000 Server or use
another OS such as OpenBSD, FreeBSD, Linux, etc.


[quoted text, click to view]

Karl Levinson [x y] mvp
3/14/2004 7:51:42 AM
Oh, and to confirm whether the firewall is the problem and see what you need
to open, try to access the web page and then immediately after check your
firewall logs for things that are being blocked inbound. Then add a rule to
allow, say, destination port TCP 80 inbound,etc. For any suspected firewall
problem, check the firewall logs first.

[quoted text, click to view]

Ken Schaefer
3/14/2004 1:24:07 PM
Hi,

I believe Norton Internet Security includes a firewall of some kind. In
order for people (including yourself) to access your webserver, you will
probably need to configure a rule in your firewall that allows access to
your webserver.

Norton Antivirus involves a "script blocker" option (you can turn this
option off). This blocker is an additional layer of protection against
script based viruses (in case there's no definition available yet for the
virus). However, this script blocker can also block webpages running that
utilise the File System Object (I believe a default install of IIS on
Windows 2000 includes some pages that utilise the FSO). So, I would
recommend disabling the "Script Blocking" feature in NAV.

Lastly, the hyperthreading thing is *not* going to help you whatsoever with
this problem. I'm not sure which tech you spoke to, at what company, but
hyperthreading merely provides two virtual CPUs on a single physical CPU.
Any decent security software is going to protect you no matter how many CPUs
you have (physical or virtual)!

What I suggest is that you
a) install Windows 2000 Pro

b) download the network install of SP4, so you can install it later without
being connected to the internet
http://www.microsoft.com/Windows2000/downloads/servicepacks/sp4/download.asp
There's a link to download the network install on this page

c) disconnect from the internet, and install IIS

d) install SP4 (that you saved to your hard disk before)

e) reconnect to the internet, visit WindowsUpdate site, and install the
post-service pack 4 updates.

Now you are up-to-date with your patches, and you should be relatively
secure. Verify that your IIS installation is working.

Now, install the security software 1 application at a time. After you
install each application, verify that you can still access IIS. If you
can't, configure that application so that you can access IIS. Then, install
the next application..

Cheers
Ken

[quoted text, click to view]
: I have been trying to install IIS on this Dell 1Ghz
: Pentium III Workstation with Win2000Pro.
: I am installing a local Intranet Web & using
: FrontPage2002.
: I finally got the IIS installed but I had to remove Norton
: Internet Security and Anti-Virus 2004 to do it and IIS
: will not work when I re-install these programs. Between
: the security programs and the SP4 download upgrade, I
: really messed the computer up! I had to re-install Win2000.
: I now find that there are issues with Symantec Products in
: relation with Internet Information Services(IIS). I really
: need some input on what I can do about the apparent
: software conflicts and what other Security and Anti-Virus
: programs will work with IIS if no solution can be found
: for the Symantec Products. I cannot get a Pentium 4
: $8,000.00 Workstation at this time that uses hyper-
: threading that a technician suggested MAY solve the
: conflict.
: A frustrated Blue Whale

jcochran.nospam NO[at]SPAM naplesgov.com
3/14/2004 2:57:59 PM
On Sat, 13 Mar 2004 14:04:50 -0800, "Blue Whale"
[quoted text, click to view]

The technician is wrong. Norton has several issues with IIS, most
notably that it blocks scripts by default. In addition it is a
firewall product and may block the HTTP protocol incoming by default
or you may have inadvertently set it to block incoming traffic. All
this is configurable, see Symantec's tech support options for help.

jcochran.nospam NO[at]SPAM naplesgov.com
3/14/2004 3:01:06 PM
On Sun, 14 Mar 2004 05:26:48 -0800, "Blue Whale \(Wayne\)"
[quoted text, click to view]

And here is why that suggestion is nonsense. The job of security and
anti-virus software *is* to interfere when it believes security is
about to be breached.

Besides, your techician is wrong on the hyperthreading in general, and
it looks like he misread the article in PC Magazine that made him
think this.

[quoted text, click to view]

Okay, that part is often debated... :)

[quoted text, click to view]

Slow installation? Just don't do the automatic installation, and read
the support information available.

Jeff

[quoted text, click to view]
Ken Schaefer
3/15/2004 11:11:44 AM

[quoted text, click to view]
..
: 2-Clairfying the hyperthreading remark suggested to
: me...Was that the pentium 4 allowes hidden programs to run
: in the background (like sucurity & anti-virus) without
: interfearing with the program your working in, more or
: less! But I thought that was an odd suggestion since I
: believe Symantec makes software for large servers so they
: must know something?

Hyperthreading does allow multiple programs to run simultaneously (up to a
point). It's two "virtual" CPUs on a single physical CPU. This allows better
mutli-tasking, where the machine needs to do two things at once, since one
operatin will not be blocked by the first (both can run simultaneously).

However AV software, or firewall software, is designed to scan/block
everything that you configure. All hyperthreading means is that this
scanning or blocking will be done in a more timely (ie quicker) manner.

:-)

Cheers
Ken

AddThis Social Bookmark Button