More IIS Tips

• Patch, Patch, Patch! - Okay, we in the IIS world do have to patch our systems and make hotfixes. However, as a former Solaris admin I had to do the same thing there, so I'm not sure why this is a big surprise. You really need to keep up with the patches. Microsoft is of course the definitive source, but if you can also use the highly-regarded www.cert.org. Simply search on "IIS".
  
  Well there you have it: 10 tips for IIS admins to improve their servers. Some of the tips might become obsolete once IIS 6 is gold, but, for now at least, W2K and NT IIS admins should apply a few of these today and sleep a little better at night.
  
• Secure Your Server with Simple Fixes - Sure people are going to attack sites, but you don't have to be a sitting duck if you're willing to make even a small effort.

  First off, don't advertise the fact that you run IIS by showing your HTTP server header. Remove or replace it using something like ServerMask -- probably the best twenty-five bucks you'll ever spend. You can go further than this by removing unnecessary file extensions to more effectively camouflage your server environment, and scanning request URLs for signs of exploits.

  There are number of commercial products that carry out user input scanning, and Microsoft offers a free tool called URLScan that does the job. URLScan runs in conjunction with IISLockDown, a standard security package that should probably be installed on every IIS server on the planet. These are simple fixes that can pay off big-time, so implement them now!
  

• Tune Your Server - Tuning IIS is no small topic -- whole books and courses are dedicated to it. But some good, basic help is available online, such as this piece from IIS guru Brett Hill, or this Knowledge Base article from Microsoft itself. However, if you don't feel like getting your hands dirty -- or can't afford the time and expense of turning yourself into an expert -- take a look at XTune, from the makers of XCache. Its performance-tuning wizards step you through the process of tuning your IIS environment, and make expert recommendations along the way.
  
• Customize Your Error Pages - Although this is quite simple to do, few people seem to take advantage of error page customization. Just select the "Custom Errors" tab in MMC and map each error, such as 404, to the appropriate HTML or ASP template.
  If you want an even easier solution -- or if you want to let developers handle the mapping without giving them access to the MMC -- use a product like CustomError.
  
• Dive Into the MetaBase - If you think Apache is powerful because it has a config file, then take a look at the MetaBase. You can do just about anything you want with IIS by editing the MetaBase. For example, you can create virtual directories and servers; stop, start and pause Websites; and create, delete, enable and disable applications.
  
  Microsoft provides a GUI utility called MetaEdit, which is somewhat similar to RegEdit, to help you read from and write to the MetaBase. Download the latest version here. But to really impress those UNIX admins -- and to take full advantage of the MetaBase by learning how to manipulate it programmatically -- you'll want to try out the command-line interface, officially called the IIS Administration Script Utility. Its short name is adsutil.vbs and you'll find it in C:\inetpub\adminscripts, or in %SystemRoot%\system32\inetsrv\adminsamples, together with a host of other useful administrative scripts.
  
  A word of caution though: just like Apache conf files, the MetaBase is pretty crucial to the functioning of your Web server, so don't ruin it. Back it up first.
  
• Add Spell Checking to Your URLs - Apache folks always brag about cool little tricks that Apache is capable of -- especially because of the wealth of modules that can extend the server's basic functionality. Among the coolest of these is the ability to fix URL typos using a module called mod_speling.
  
  Well, thanks to Port80 Software, it now appears that IIS admins can do this trick too, using an ISAPI filter called URLSpellCheck. You can check it out right on their site, by trying URLs like www.urlspellcheck.com/fak.htm, www.urlspellcheck.com/faq1.htm -- or any other simple typo you care to make.
  
• Rewrite Your URLs - Cleaning your URLs has all sorts of benefits -- it can improve the security of your site, ease migration woes, and provide an extra layer of abstraction to your Web applications. Moving from ColdFusion to an ASP-based site, for example, is no big deal if you can remap the URLs.
  
  Apache users have long bragged about the huge power of mod_rewrite -- the standard Apache module for URL rewriting. Well, there are now literally a dozen versions of this type of product for IIS -- many of them quite a bit easier to use than mod_rewrite, which tends to presume familiarity with regular _expression arcana. Check out, for example, IIS ReWrite or ISAPI ReWrite. So brag no more, Apache partisans!
  
• Add Browser Detection - There are many ways to build Websites, but to assume that everybody has a certain browser or screen size is just plain stupid. Simple _JavaScript sniff-scripts exist for client-side browser detection, but if you're an IIS user you can do better with a product called BrowserHawk from CyScape. The Apache world doesn't really have something comparable to this popular, mature and well-supported product.

  Speaking of CyScape, they've recently added an interesting-looking related product called CountryHawk that helps with location detection, but so far I haven't had the language- or location-sensitive content to warrant trying it out.

• Gzip Site Content - Browsers can handle Gzipped and deflated content and decompress it on the fly. While IIS 5 had a gzip feature built-in, it's pretty much broken. Enter products like Pipeboost that give us better functionality -- similar to what Apache users have enjoyed with mod_gzip. Don't waste your bandwidth -- even Google encodes its content, and their pages are tiny.