|
Content Type
|
Topic
|
Description
|
|
IIS 6.0 Deployment Guide
|
Reviewing Security Policies, Processes, and Procedures
|
Corrected Table 3.16, "Firewall and Router Security," to refer to port 445 instead of 455 for NetBIOS/SMB.
|
|
IIS 6.0 Operations Guide
|
Using Isolation to Secure Applications
|
Added topic with information about giving each application pool its own account identity to isolate applications on the Web server.
|
|
IIS 6.0 Operations Guide
|
Configuring Subauthentication and subordinate topics
|
Corrected references to the AnonymousPasswordSync metabase property.
|
|
IIS 6.0 Operations Guide
|
Encrypting Data When Running WMI–Based Remote Administration Scripts
|
Added important note that Windows Management Instrumentation (WMI) based scripts must be edited to encrypt authentication credentials and data after upgrading to SP1.
|
|
IIS 6.0 Operations Guide
|
Configuring Constrained Delegation for Kerberos
|
Added information about Kerberos authentication failing with a 401.3 error if not configured properly.
|
|
IIS 6.0 Operations Guide
|
Integrated Windows Authentication in IIS 6.0
Configuring Integrated Windows Authentication in IIS 6.0
Windows Authentication Provider in ASP.NET
Authentication in ASP.NET
|
Added information about the state of the Integrated Windows Authentication setting following installation of Windows Server 2003 Service Pack 1 (SP1) as part of a slipstream installation of a Windows Server 2003 operating system.
|
|
IIS 6.0 Operations Guide
|
Securing Sites with IP Address Restrictions
|
Added note about the disabling of the HTTP.sys cache when IP address restriction is used on a Web site.
|
|
IIS 6.0 Operations Guide
|
Enabling Kernel-Mode SSL
|
Added new topic about kernel-mode Secure Sockets Layer (SSL).
|
|
IIS 6.0 Operations Guide
|
Basic Authentication in IIS 6.0
|
Added information about administering users and adding them to groups with specific permissions when using Basic authentication.
|
|
IIS 6.0 Operations Guide
|
Requesting a New Server Certificate from an Online CA
Configuring SSL on a Web Server or Web Site
|
Clarified the following issues:
-
The Web Server Certificate Wizard is used to request new server certificates.
-
The request file generated by the Web Server Certificate Wizard is saved by default as C:\Certreq.txt.
-
SSL can be configured for a Web server or a Web site.
|
|
IIS 6.0 Operations Guide
|
Installing Server Certificates
|
Added note that a password must be specified before the certificate can be assigned to a Web server.
|
|
IIS 6.0 Operations Guide
|
Configuring SSL on a Web Server or Web Site
|
Added note explaining that users will receive an error message when browsing to a site that does not have SSL completely setup and the Require Secure Channel (SSL) check box is selected for the site.
|
|
IIS 6.0 Operations Guide
|
IIS 6.0 Security Best Practices
|
Added recommendation to use an encrypted remote connection with WMI-based administration scripts.
|
|
IIS 6.0 Operations Guide
|
Mapping Client Certificates with Directory Service Mapping
|
Added procedure for enabling directory sService mapping.
|
|
IIS 6.0 Operations Guide
|
Encrypting Data When Running WMI–Based Remote Administration Scripts
|
Added topic about establishing an encrypted connection when running WMI-based administration scripts on an IIS server over a remote connection.
|
|
IIS 6.0 Operations Guide
|
Configuring Subauthentication and subordinate topics
|
Corrected references to AnonymousPasswordSync metabase property and added IIsWebService node as recommended configurable location.
|
|
IIS 6.0 Operations Guide
|
Anonymous Authentication in IIS 6.0
|
Clarified that the IUSR_Computername account, which is a member of the Guests group on computers running IIS, has the same access as members of the Users group by default.
|
|
IIS 6.0 Operations Guide
|
Configuring SSL on a Web Server or Web Site
|
Added note that users will receive an error when browsing to a Web site that requires SSL if the process of setting up SSL is not complete.
|
|
IIS 6.0 Operations Guide
|
Enabling and Disabling Dynamic Content in IIS 6.0
|
Added reminder to disable Web service extensions when features are no longer required.
|
|
IIS 6.0 Operations Guide
|
Enabling Web Service Extensions
Enabling and Disabling Dynamic Content in IIS 6.0
|
Added important note that allowing unknown ISAPI extensions or CGI extensions to run on a Web server can leave the server susceptible to attack.
|
|
IIS 6.0 Operations Guide
|
Configuring Subauthentication on a New Installation of IIS 6.0
Configuring Subauthentication in IIS 5.0 Isolation Mode
|
Added node at which the AnonymousPasswordSync metabase property should be set.
|
|
IIS 6.0 Operations Guide
|
Creating an Authorization Policy Store in Authorization Manager
Setting the Scope for the Application
|
Clarified items in the procedure that must be typed exactly as shown in order for the authorization policy store for IIS 6.0 URL Authorization to be configured successfully.
|
|
IIS 6.0 Operations Guide
|
Setting Metabase Properties for URL Authorization
|
Removed semi-colons from sample script.
|
|
IIS 6.0 Operations Guide
|
Adding Urlauth.dll as a New Web Service Extension
|
Added procedure for adding Urlauth.dll as a new Web service extension.
|
|
IIS 6.0 Operations Guide
|
Adding the IIS Worker Process to the Readers Role
|
Added procedure for adding the IIS worker process to the Reader role.
|
|
IIS 6.0 Operations Guide
|
Exporting a Client Certificate for One-to-One Mapping
|
Added note that client certificate mapping programs for IIS 6.0 and Windows Active directory services accept certificates formatted as either binary or Base-64 encoded.
|
|
IIS 6.0 Operations Guide
|
Setting NTFS Permissions for Directories or Files and subordinate topics
|
Clarified that IIS Manager is used to set permissions on Web sites, directories, and virtual directories, and that to set permissions for individual files you must use a programmatic solution, such as Adsutil.vbs.
|
|
IIS 6.0 Operations Guide
|
Advanced Digest Authentication in IIS 6.0
Digest Authentication in IIS 6.0
UseDigestSSP Metabase Property
|
Added note that the WWW service must be restarted for a change in the UseDigestSSP metabase property to take effect.
|
|
IIS 6.0 Operations Guide
|
Configuring SSL Host Headers
Obtaining and Installing a Wildcard Server Certificate
Configuring Server Bindings for SSL Host Headers
Advanced Digest Authentication
|
Added new topics that explain how to obtain and install a wildcard server certificate that can be used for Web sites that have the same IP address:port binding, as well as how to use Adsutil.vbs to configure SSL host headers and how to ensure that secure content is not served for an HTTP request.
|
|
IIS 6.0 Technical Reference
|
Advanced Digest Authentication
|
Added information about configuring the registry keys DigestPartialContextCacheTTL and DigestContextCacheTTL.
|
|
IIS 6.0 Technical Reference
|
.NET Passport Authentication
|
Added information about configuring Web sites to conform to .NET Passport privacy guidelines.
|
|
IIS 6.0 Technical Reference
|
Digest Authentication
|
Added information about the issue where logging on with a user principal name (UPN) in the form username@domain.top-leveldomain fails.
|
|
IIS 6.0 Technical Reference
|
Integrated Windows Authentication
|
Added information about the state of the Integrated Windows Authentication setting following installation of Windows Server 2003 Service Pack 1 (SP1) as part of a slipstream installation of a Windows Server 2003 operating system.
|
|
IIS 6.0 Technical Reference
|
Authentication Methods Supported in IIS 6.0
|
Added information about the importance of using authentication with IIS when resources on the Web server need to be restricted to approved users, and clarified that IIS goes in order from the most secure to the least secure authentication method when multiple authentication methods are configured.
|
|
IIS 6.0 Technical Reference
|
Integrated Windows Authentication
|
Added information that a user logged on to the local computer as a domain user will not be prompted to authenticate if they access a network computer in that same domain.
|
|
IIS 6.0 Technical Reference
|
Controlling Access to a Database on a Web Server
|
Added topic with information about controlling access to databases from Web applications.
|
|
IIS 6.0 Technical Reference
|
Access Control Lists
|
Added three tables outlining the default Access Control Lists (ACLs) and privileges for the IIS_WPG group.
|
|
IIS 6.0 Technical Reference
|
Kernel-Mode SSL
|
Added topic about running SSL in kernel mode instead of user mode (the default) in Windows 2003 Server SP1.
|
|
IIS 6.0 Technical Reference
|
Configuring Application Pool Identity in IIS 6.0
|
Added section about the IIS_WPG group.
|
|
IIS 6.0 Technical Reference
|
SSL and SF_NOTIFY_READ_RAW_DATA Filters
|
Added information about how SF_NOTIFY_READ_RAW_DATA works with SSL when running worker process isolation mode.
|
|
IIS 6.0 Technical Reference
|
Using URL Authorization
|
Removed semi-colons from sample script.
|
|
IIS 6.0 Technical Reference
|
Digest Authentication
Advanced Digest Authentication
|
Added note that the WWW service must be restarted for a change in the UseDigestSSP metabase property to take effect.
|