Psst! Did you know DevelopmentNow is a mobile web site design agency?

Contact us for help mobilizing your site, or to sign up for our beta Mobile Web SDK!
all groups > iis security > february 2007 >

iis security : Default Website - Best Practise?



Shaun Sawyer
2/21/2007 2:30:56 AM
Hi,

Can anybody let me know what the current 'best practise' is in regards to
the Default Web Site?

Depending on who I speak to I get a different answer, therefore, I am trying
to find where it is defined (whitepaper, KB article etc.)

Is it best to delete the Default Website or disable it?
If I keep the Default Web Site, is setting the home folder path and log file
path to a dedicated NTFS volume enough in regards to file location?

Thanks in advance...
wjzhang NO[at]SPAM online.microsoft.com (
2/21/2007 3:53:05 PM
Hi Shaun,

Yes, deleting the default web site is not recommended. This is because the
Default Web Site's ID in IIS metabase is 1 by default, i.e: /LM/W3SVC/1 .
You can check this by using Metabase Explorer utility in IIS 6.0 resource
kit tools:

Internet Information Services (IIS) 6.0 Resource Kit Tools
http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=56fc
92ee-a71a-4c73-b628-ade629c89499

Some web application's uses the path /LM/W3SVC/1 by default. If the site is
deleted, the installer cannot find this path and the installation process
fails.

Setting the home folder path of the default web site and log file path to a
dedicated NTFS volume shouldn't affect anything because most of web
application installation are using virtual directories. Even if it refers
to the Default Web Site's physical path, the installer should look for the
Path property under /LMW3SVC/1/Root to locate it and copy files.

Please let me know if you have any further question.

Thanks for using MSDN newsgroup and have a nice day.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx.

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
Roger Abell [MVP]
2/25/2007 10:05:17 AM
Personally, if I attempt to install something and it is so dumb
as to assume the w3svc instance into which I want it installed,
then I do not what that crap code installed anyway.

The practice of moving the default site, or any other for that
matter, to a NTFS partition used only for web content originated
with attempts to prevent use of parent path traversal from getting
to executables. If parent paths is enabled, this is still a valid
practice as far as I can tell, although not necessarily to prevent
execution of what it can potentially make accessible.

Roger

[quoted text, click to view]

Shaun Sawyer
2/26/2007 2:40:05 AM
Thanks WenJun,

I was aware of the metabase property. If a default website I assumed, i
usually get around that by temporarilly setting the ID to 1 during the
website installation and setting back to the original site ID when the
installation has completed.

As I have to reference the Microsoft Best Practise recomendation in my
design documentation (company requirement), could you point to where this is
stated?

Thanks again
Shaun


[quoted text, click to view]
Shaun Sawyer
2/26/2007 2:46:08 AM
I agree entirely; unfortunately I have to deal with some dumb software until
the company gets it act together and rewrites it code.....

[quoted text, click to view]
wjzhang NO[at]SPAM online.microsoft.com (
2/27/2007 10:06:31 AM
You are welcome Shaun.

There is indeed not a 'Best Practise' article on this. However the
following is the standard guide about how to make a new Default Web Site
and change the identifier to 1:

1) Backup the metabase

2) Rename the Default Web Site eg. old Default Web Site, and add a Host
Header to it eg. old

3) Create a new web site, name it Default Web Site, keep default settings:

- make sure to add proper Web Site Home Directory Path eg.c:\inetpub\wwwroot

4) Note the identifier of the new web site (click on web sites), close IIS

5) open cmd prompt, cd \inetpub\adminscripts

6) adsutil move w3svc/1 w3svc/20050831

7) adsutil move w3svc/<new identifier> w3svc/1

8) Open IIS, expand Default Web Sites

You should now see everything was recreated inside the Default Web Site.


Please let me know if you have any further question or concern on this.

Have a great day.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx.

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
wjzhang NO[at]SPAM online.microsoft.com (
3/1/2007 10:18:35 AM
Hi Shaun,

Just want to check if you have any further question or concern regarding to
this issue? If so, please feel free to post here and we will follow up.

Have a nice day.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx.

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
Shaun Sawyer
3/1/2007 11:31:17 AM
Hi WenJun

I think that you have provided some very helpful advice; especially the
adsutil commands that have now made their way into a very useful batch file!!
Thank you for all your assistance, it is most appreciated.

Regards
Shaun

[quoted text, click to view]
wjzhang NO[at]SPAM online.microsoft.com (
3/2/2007 12:00:00 AM
You are welcome Shuan. It's always my pleasure to be of assistance.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx.

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
AddThis Social Bookmark Button