From Mind To Words

Client Certificate Mapping in FTP 7 & FTP 7.5 - Step by Step - Part 4

2009-12-02T09:31:00Z

Moved to www.dotnetscraps.com

Client Certificate Mapping in FTP 7 & FTP 7.5 - Step by Step - Part 3

2009-12-01T21:34:00Z

Moved to www.dotnetscraps.com

Client Certificate Mapping in FTP 7 & FTP 7.5 - Step by Step - Part 2

2009-11-04T20:12:00Z

Moved to www.dotnetscraps.com

Client Certificate Mapping in FTP 7 & FTP 7.5 - Step by Step - Part 1

2009-11-02T01:50:00Z

Moved to www.dotnetscraps.com

“Parser Error Message: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.” when debug=”true” in .aspx page

2009-07-20T19:53:04Z

Just recently one of my customer faced the below mentioned error on his Windows Server 2008 SP2 box.

Read my post in our team blog on the issue: Parser Error Message: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

HTH.

Blind drop FTP in IIS 7/7.5

2009-05-10T20:46:00Z

I saw this topic floating around for few days and since it’s very interesting I thought of blogging it for everybody’s benefit.

If you haven’t heard about Blind Drop FTP have a look at this blog Creating a Blind Drop FTP Server.

I thought of testing the same on IIS 7 and IIS 7.5. Here is a step by step of the same..

For IIS 7, you will have to install OOB (Out of Band) Microsoft FTP Publishing Service 7.5 for IIS 7.0 (x64) or Microsoft FTP Publishing Service 7.5 for IIS 7.0 (x86) depending on your platform.

I am using Windows Server 2008 R2 RC1 for this scenario.

Creating directory structure:

I have created FTPRoot on my D drive and it has Incoming directory

Setting NTFS Permission on the directory

Right click on FTPRoot folder -> Properties -> Security

Click on Advanced button -> Change Permissions...

Uncheck the check box “Include inheritable permissions from this object’s parent” -> click Add

Select SYSTEM, Authenticated Users and Users and click Remove

Click OK and click OK again

Click Add... and select IUSR of the local machine

Click OK

Remove Read & execute and Read permission for IUSR as shown below. So IUSR group has only List folder contents permission of FTPRoot folder

Click OK and click OK again

Go to the Incoming folder and right click on the Incoming folder and click Properties.

Click Advanced -> Change Permissions

Uncheck the check box “Include inheritable permissions from this object’s parent” -> click Add

Select IUSR and click Edit...

Click on Apply to: and select “This folder only” -> click Clear All

Select Create files / write data, Create folders / append data, Write attributes, Write extended attributes and Read permissions as shown below

Click OK and click Apply

Click Add... and select IUSR of the local machine, click OK

Select List folder / read data, Read attributes, Read extended attributes and Read permissions as shown below

Click OK

Select the check box “Replace all child object permissions with inheritable permissions from this object” -> Click OK

Permissions on Incoming folder are as follows:

Click OK and click OK again

Configuring FTP in IIS:

Creating the FTP Site Basic Settings

Configuring FTP Authentication

Configuring FTP Authorization

Configuring FTP Request Filtering. Add Deny Command… LIST and NLST as shown below

Click on Incoming and click FTP Authorization Rules and verify that you have Anonymous Users with Read, Write permissions.

Now, let’s test the FTP site from a command prompt

Nice.

Check the FTP logfile and we see the following:

Wondering why we added that FTP Request Filtering setting above.

I tried “ls” command above to see if the files / folder are listed. I got the error 500 i.e. “internal server error” because the command is not allowed with a substatus 5 i.e. “Access is denied.” as per the FTP log above.

If you don’t add the above request filtering you will be able to see the Incoming folder but you won’t be able to change to the folder nor add file / folder in the FTPRoot folder. This looks like a neat workaround to what was default behavior in Windows Server 2003 IIS 6 FTP configuration.

HTH

HTTP Error 404.3 – Not Found, when browsing WCF application after reinstalling IIS

2009-05-07T02:43:00Z

Sometime back my friend had a weird issue on his machine. He was working on his WCF application and as per his requirement he ran some command which brought his IIS down.

So, to resolve the issue he reinstalled IIS and now his WCF application won’t work.

Here is the scenario:

I am using Win 7 RC for our test; his was a Windows Vista box. I have IIS installed and have Microsoft .NET Framework 3.5.1 enabled, here’s the screenshot

I created a simple WCF page such that it proves WCF is working on the machine.

Now, let’s uninstall IIS. Look at the prompt here

The prompt says it will turn off the Windows Communication Foundation HTTP Activation.

On Windows Server 2008, it will prompt you something like this

On Windows Server 2008 R2 RC1, it shows like this

Click Yes

Click OK

IIS is uninstalled.

Check the inetsrv folder and you will find few files and the applicationHost.config remaining

Now, I reinstall IIS again and this time not selecting the WCF HTTP Activation because many of the times we will miss this option.

Start IIS Manager -> Expand Sites and this is what I see

All my other websites have Binding missing.

This is because the old applicationHost.config had the configuration information and when we uninstalled IIS, the skeleton of the new websites stayed. Hence we can see the websites but the configuration missing.

I added the Bindings manually and now the websites are looking good.

Let’s look at the original issue. I will browse the WCF application and it fails

I really love IIS 7 for all the good things. The error is self-explanatory and it clearly says the handler or the MIME mapping is missing.

The error code 0x80070032 means “The request is not supported”. IIS does not know what the file Service.svc is.

Open applicationHost.config and search for .svc and it returns with nothing.

Open, command prompt and go to C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation>

Run the command ServiceModelReg.exe –i

This command acts similar to what aspnet_regiis.exe –i does. ServiceModelReg.exe –i will install Windows Communication Foundation and update scriptmaps at the Metabase root i.e. in the applicationHost.config.

Open applicationHost.config and now look for .svc

You will find the following handler mappings

<add name="svc-Integrated" path="*.svc" verb="*" type="System.ServiceModel.Activation.HttpHandler, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="integratedMode" />
<add name="svc-ISAPI-2.0" path="*.svc" verb="*" modules="IsapiModule" scriptProcessor="%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness32" />
<add name="svc-ISAPI-2.0-64" path="*.svc" verb="*" modules="IsapiModule" scriptProcessor="%SystemRoot%\Microsoft.NET\Framework64\v2.0.50727\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness64" />

Browse the page again and now Service.svc executed fine.

HTH.

IIS 7/7.5 .net configuration settings using appcmd.exe and IIS Manager

2009-05-07T00:27:00Z

Just recently I came across an issue where customer was using appcmd.exe to make changes to the Application Settings and Configuration Settings he had made using IIS Manager. I am using Application Settings for this post but it holds true for all the ASP.NET settings from IIS Manager.

Application Settings using IIS Manager first at the Server Level, in our example it’s Sample

the setting gets reflected in web.config file in C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG folder.

Now, creating the new application settings on the Default Web Site, in our example it’s Sample2.

An entry is created in the web.config file at the website’s home directory, in our example its C:\inetpub\wwwroot folder.

If you create a new Application Settings at a virdir level, a new web.config will be created with the entry.

Now, the customer was following the article IIS 7.0: Remove an Application Setting and using appcmd.exe he wanted to remove the first entry i.e. Sample

The command he used as per the article was: appcmd.exe set config /commit:MACHINE /section:appSettings /-“[key=’Sample’,value=’1’]”

Result:

So, what’s going wrong?

Here the command is looking for the appSettings parameter and the key in MACHINE i.e. machine.config but it can not find it and hence the error. We now know the key is created in web.config, so what is the command to make the changes in web.config?

The correct command is: appcmd.exe set config /commit:WEBROOT /section:appSettings /-“[key=’Sample’,value=’1’]”

Check the IIS Manager and the entry is now removed.

Similarly, to remove appSettings from Default Web Site, the command is: appcmd.exe set config “Default Web Site” /section:appSettings /-“[key=’Sample2’,value=’2’]”

And to remove appSettings from NewVirDir i.e. the virtual directory under Default Web Site, the command is: appcmd.exe set config “Default Web Site/NewVirDir” /section:appSettings /-“[key=’Sample3’,value=’3’]”

Now, let’s create appSettings using appcmd.exe using the different variant’s and see where they get reflected

Machine.config in C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG

Web.config in C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG

applicationHost.config in C:\Windows\System32\inetsrv\config, since applicationHost.config is the global configuration file for IIS

applicationHost.config in C:\Windows\System32\inetsrv\config. The above command does not make much sense as it is not specific to Default Web Site and since it’s reflected in applicationHost.config it will apply for all web sites/virdir on the server which inherits the setting.

web.config in C:\inetpub\wwwroot folder

HTH.

Manually migrating websites from IIS 5.0 to IIS 6.0 (or even IIS 5.0 to IIS 5.0)

2009-03-17T11:23:00Z

Just recently I came across an issue where a customer wanted to migrate websites from IIS 5 to IIS 6. The best and recommended option is to use “Internet Information Services 6.0 Migration Tool”. But there are a few limitations in using the Migration Tool they are listed in “Before You Begin” in the IIS6MigrationToolUserGuide.doc.

Here in our case we did not had network connectivity between the IIS 5 and IIS 6 servers. So, we decided to manually migrate the websites from IIS 5 to IIS 6.

Steps we follow:

Take a backup of IIS 5.0 and IIS 6.0 metabase, here is how you do it in IIS 5.0 and IIS 6.0.
Remember, you need to verify that the clients are not accessing the websites.
Copy the website contents
Install Internet Information Services (IIS) 6.0 Resource Kit Tools on IIS 6.0 server.
Copy the Metabase.bin file from IIS 5.0 server and paste it on IIS 6.0 server. You can find the Metabase.bin in C:\WINDOWS\system32\inetsrv folder.
Open Metabase Explorer
Click on Metabase –> Import Key…
Browse to the Metabase.bin and click Open, You will see a prompt as shown below, ignore it. Click OK
This is what you will see
Under Archive (Metabase.bin) expand LM –> W3SVC and you will see different nodes. I have 1 to 4 because I have 4 websites.
You can verify which website you want to migrate by clicking on the node and checking the ServerComment. In my case I would like to migrate website 3 which is “Dotnet Web Site”.
I would also like to migrate “Default Web Site” which is website 1.
Just click on 1 under Archive (Metabase.bin) and drag and drop it under (local) –> W3SVC. Remember not to drop it on 1 but on W3SVC.
You will get a prompt. If you don’t see the prompt you are not dropping the website correctly.
Select Replace the key.
Open IIS MMC, (Start –> Run type inetmgr). You will see the virtual directories/files/folder seen in the old IIS 5 mmc now displayed in IIS 6 mmc. See that virtual app PerlEx, that’s Perl website. I need to make sure that C:\Perl\eg\PerlEx folder exists to get it working. If it happens to be in a different location change it in IIS MMC and that should be good.
You can drag and drop other websites as well using Metabase Explorer and they will get reflected in the IIS 6 MMC.
Now, lets get Perl and PHP configured in IIS 6 as they won’t be configured by default. If you are using ActivePerl 5.10 as I am, the job is easy. Just install ActivePerl 5.10 and it will configure all the mappings. But if not, and you are just copy pasting the Perl folder from the old server. You will need to create the mappings for the Perl extensions.
This is how you do it.
1. Right click on Web Site (Default Web Site in our case)
2. Click Properties
3. Click Home Directory tab and click the Configuration… button
4. In Mappings, click Add..
5. Executable: C:\Perl\bin\PerlEx30.dll
6. Extensions: .aspl
7. Verbs, click Limit to: type GET,HEAD,POST
8. Check “Script engine” and “Verify that file exists”
9. Click OK
10. Repeat steps 5 to 9 for the below extensions:
11. .pl mapped to C:\Perl\bin\perl.exe "%s" %s
12. .plex mapped to C:\Perl\bin\PerlEx30.dll
13. .plx mapped to C:\Perl\bin\perlis.dll
This is how it will look like:
Now, when you browse a page with .pl or .plex extension, it gives 404. IIS logfile will show the error code as 404 1260. The error code means “ERROR_ACCESS_DISABLED_BY_POLICY”. This is caused because of the web server extension lockdown policy.
Click Web Service Extensions and lets create Web service extensions for Perl.
1. Click Add a new Web service extension
2. Extension name: type Perl CGI Extension
3. Click Add…
4. In Path to file: type C:\Perl\bin\perl.exe "%s" %s
5. Check the Set extension status to Allowed
6. Click OK
7. Now, create another extension with the name: Perl ISAPI Extension
8. In Path to file: type C:\Perl\bin\perlis.dll
9. Click another extension with the name: PerlEx ISAPI Extension
10. In Path to file: type C:\Perl\bin\PerlEx30.dll
We created three web service extensions as they are specific to their functionality. One is CGI, the other is for the ISAPI’s Perl and PerlEx respectively. So, in case if you are interested in serving only .plex or .aspl extensions create and enable only the respective ISAPI mapping and its Web Service extension.
Browse the Perl website and it works fine.
Now, lets create PHP Mapping and Web Service extension.
1. For Application Mapping
  1. Right click on Web Site (Php Web Site in our case)
  2. Click Properties
  3. Click Home Directory tab and click Configuration… button
  4. In Mappings, click Add..
  5. Executable: C:\PHP\php5isapi.dll
  6. Extensions: .php
  7. Verbs, click All verbs
  8. Check “Script engine” and “Verify that file exists”
  9. Click OK
2. For Web Service Extension
  1. Click Add a new Web service extension
  2. Extension name: type PHP
  3. Click Add…
  4. In Path to file: type C:\PHP\php5isapi.dll
  5. Check the Set extension status to Allowed
  6. Click OK
Browse, .php website and that works fine.
Now, for my “Dotnet Web Site”. I was lucky to have my Windows 2000 with a %SystemRoot% folder as WINDOWS. Sometimes you will see WINNT.
My “Dotnet Web Site” on IIS 5.0 is using .net 2.0 and I don’t have .net 2.0 installed on Windows Server 2003.
Check out the Application Mapping for the website
So, if your application requires .net 2.0 you need to install .net 2.0 on your machine. If the application is not specific to .net 2.0 and if it will work fine on .net 1.1 then just run “C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322>aspnet_regiis.exe -r” and it will remap all the ASP.NET scripts with .net 1.1 version.
I had to install .net 2.0 to get my application running.

Incase if you are planning to restore old IIS 5.0 metabase on a newly installed Windows Server 2000 IIS 5.0 server. The steps above can help you move the websites from old metabase to the new IIS 5 server. You can either install IIS 6 Resource Kit or just copy the Metabase Explorer folder i.e. C:\Program Files\IIS Resources\Metabase Explorer to the IIS 5 server.

NOTE: Please play around with this in your test environment before you use it on your production servers. Leverage Microsoft PSS if you have complexities in your existing websites which you need to migrate.

HTH

Binding Issue: WWW Service did not register the URL prefix http://*:80

2009-03-05T15:50:00Z

Sometime back I was working on an incident with a customer who was facing an issue when trying to access his application on Windows Server 2008. I will reproduce the issue using Apache for everyone’s benefit.

If you have a server that has some kind of monitoring tool which is web based or some application which needs port 80 or port 443, then you can face this issue.

Scenario:

I am installing Apache 2.2.11 on my Windows Server 2008 machine which has IIS 7 installed on it. So, wondering why I am trying to install Apache on Windows Server 2008, simply because it’s a web server.

Checkout the screenshot below. Apache will be installed on Port 80 (default setting). Sometimes some application will silently get installed on your machine on port 80.

After sometime, I get the following error:

Checked the Event Viewer and I see the Event as shown below. Looks like Apache wanted to bind itself on 0.0.0.0:80 and fails as it does not have access.

Opened Command prompt as an Administrator and ran “netstat –ano”

I see port 80 is controlled by PID 4 i.e System.

Now, stopped IIS Services by firing “iisreset /stop”.

Started Apache 2.2 service from Services.msc and fired “iisreset” again.

Opened, IIS Manager and I see all websites on port 80 stopped.

Check the Event Viewer

Run “netstat –ano” and this is what I see:

PID 1256 or Apache HTTP Server has control over port 80 and hence the issue.

So what is the issue, checkout the article: You receive a "The process cannot access the file because it is being used by another process" error message when you try to start a Web site in the Internet Information Services MMC snap-in.

<snip>

Typically, this issue occurs when one or more of the following conditions are true:

Another process is using port 80 or port 443 on the computer that is running IIS. By default, IIS uses port 80 as the default TCP port and port 443 for Secure Sockets Layer (SSL).

The ListenOnlyList registry subkey is not configured correctly on the computer that’s running IIS.

</snip>

Solution:

Run Apache on a different port i.e. other than port 80
Get a new IP Address and configure IIS to run on a particular IP Address by configuring ListenOnlyList

On Windows Server 2008, you can use netsh to add the ListenOnlyList.

Verifying the same in the registry.

HTH.