|
Consolidate Your Web Servers with IIS 6.0
The latest version of IIS is perhaps the best reason to move to Windows Server 2003
by Danielle Ruest and Nelson Ruest
Posted February 12, 2004
For This Solution: Windows Server 2003, all editions, Internet Information Services 6.0, ASP-to-ASP.NET conversion tool, Internet Information Services 6.0 Migration Tool
Sitting on the fence and waiting for others to migrate to Windows Server 2003 first? A conservative approach is often considered the best approach when it comes to upgrades. The customary signal that an operating system is ready for wide deployment is Microsoft's release of the first service pack. This might be changing though. Despite the lack of a service pack for Windows Server 2003, there's evidence Webmasters find it ready for prime time today.
Consider each time you set up a new Web server with Windows 2000 (We won't even discuss Windows NT—you aren't still using this platform for Web servers, are you?): You have to apply a series of different patches and/or service packs before you can even use the server. Although this might become the case with Windows Server in time, it isn't now. Of course, you can slipstream the service packs on Windows 2000, that is, integrate them directly to your installation source code so that you don't need to apply them once Windows 2000 is installed, but this isn't the only reason it isn't as practical as Windows Server 2003 to host Web sites.
One of the greatest areas where Windows 2000 and Windows Server 2003 differ is with Internet Information Services (IIS). As you know, Windows 2000 hosts IIS 5.0 and Windows Server hosts IIS 6.0. The difference between the two lies in the architecture underpinning each. Another significant difference is in the installation; Windows 2000 automatically installs IIS 5.0, whereas in Windows Server 2003 you need to install IIS separately. In addition, the default installation of IIS 5.0 enables everything from Web-based Distributed Authoring and Versioning (WebDAV) to the IIS HTML Administration Tool, whereas the installation of IIS 6.0 doesn't enable any extraneous components (see Figure 1). In IIS 5.0, you need to run the IIS Lockdown Wizard, whereas IIS 6.0 is locked down by default. To further protect your IIS 5.0 server, you need to install URLScan, a utility that, as its name suggests, will scan URLs to verify that they meet defined requirements before passing them on to IIS. In IIS 6.0, URLScan is practically obsolete because IIS manages URLs natively.
There are more reasons why IIS 6.0 is the right choice. It natively supports the .NET Framework because the latter is integrated to the Windows Server 2003 operating system. This means you can migrate all of your applications to ASP.NET to further profit from advanced security features (see the sidebar, "Migrating to IIS 6.0"). IIS 6.0 is faster, leaner, and meaner than any previous version letting you run multiple Web sites on the same server—almost double the number of sites as IIS 5.0 according to some tests—and that includes sites with static or dynamic content. In fact, you can use IIS 6.0 to pool your Web resources and demand more from your servers.
Pool Your Web Resources
IIS 6.0 boasts a brand new application execution architecture that can go a long way toward securing your Web sites from malicious intent and providing greater stability for your Web applications. Windows 2000 and IIS 5.0 included an architecture that provided the potential for compromise. This is because it includes three different application execution modes: In-Process, Pooled Out-of-Process, and Isolated Out-of-Process (see Figure 2).
The first, In-Process, lets applications execute in the same process as the Inetinfo.exe service. This means that if someone can corrupt an application, he or she can potentially corrupt the entire Web service on the server hosting the application.
Back to top
|