Microsoft Internet Information Services (IIS, formerly called Internet Information Server) is a set of Internet-based services for servers using Microsoft Windows. It is the world's second most popular web server in terms of overall websites, behind Apache HTTP Server. As of October 2007 it served 37.13% of all websites and 38.23% of all active websites according to Netcraft.[1] The servers currently include FTP, SMTP, NNTP, and HTTP/HTTPS.
Versions
IIS 1.0, Windows NT 3.51 available as a free add-on
IIS 2.0, Windows NT 4.0
IIS 3.0, Windows NT 4.0 Service Pack 3
IIS 4.0, Windows NT 4.0 Option Pack
IIS 5.0, Windows 2000
IIS 5.1, Windows XP Professional
IIS 6.0, Windows Server 2003 and Windows XP Professional x64 Edition
IIS 7.0, Windows Vista and Windows Server 2008
History of IIS
IIS was initially released as an additional set of Internet based services for Windows NT 3.51. IIS 2.0 followed adding support for the Windows NT 4.0 operating system and IIS 3.0 introduced the Active Server Pages dynamic scripting environment.
IIS 4.0 dropped support for the Gopher protocol and was bundled with Windows NT as a separate "Option Pack" CD-ROM.
The current shipping version of IIS is 7.0 for Windows Vista, 6.0 for Windows Server 2003 and IIS 5.1 for Windows XP Professional. Windows XP has a restricted version of IIS 5.1 that supports only 10 simultaneous connections and a single web site.[2] IIS 6.0 added support for IPv6. A FastCGI module is also available for IIS5.1, IIS6[3] and IIS7.[4]
Windows Vista does not install IIS 7.0 by default, but it can be selected among the list of optionally installed components. IIS 7.0 on Vista does not limit the number of connections allowed but restricts performance based on active concurrent requests.
Security
Earli er versions of IIS were hit with a spate of vulnerabilities, chief among them CA-2001-19 which led to the infamous Code Red worm; however, version 7.0 currently has no reported issues that affect it. In perspective, as of 11 September 2007, the free software Apache web server has one unpatched reported issue,[5] affecting only MS Windows systems, and rated "less critical". In IIS 6.0, Microsoft has opted to change the behavior of pre-installed ISAPI handlers,[6] many of which were culprits in the vulnerabilities on 4.0 and 5.0, thus reducing the attack surface of IIS. In addition, IIS 6.0 added a feature called "Web Service Extensions" that prevents IIS from launching any program without explicit permission by an administrator. With the current release, IIS 7.0, the components were modularized, so that only the required components have to be installed, thus further reducing the attack surface. In addition, security features such as URLFiltering were added that rejects suspicious URLs based on a user defined rule set.
In IIS 5.1 and lower, by default all websites were run in-process and under the System account,[7] a default Windows account with elevated rights. Under 6.0 all request handling processes have been brought under a Network Services account which has significantly fewer privileges. In particular this means that if there is an exploit in a feature or custom code, it wouldn't necessarily compromise the entire system given the sandboxed environment the worker processes run in. IIS 6.0 also contained a new kernel HTTP stack (http.sys) with a stricter HTTP request parser and response cache for both static and dynamic content.
Answered by
Nishu's
, an ibibo Master,
at
9:38 AM on July 22, 2008