Windows NT Server 4.0 includes numerous features that make it an ideal platform for an intranet or Internet server. In addition to TCP/IP connectivity and utilities, Windows NT Server includes the Internet Information Server (IIS). IIS enables you to set up a Windows NT Server computer to function as a Web server, ftp server, and gopher server on an intranet or the Internet.
Before installing and configuring IIS, you should spend some time planning how your server will be structured. First, if possible, you should segregate your operating system and data files onto separate disks. The data files are your Web, ftp, and Gopher files that you want to serve to clients. Preferably, the two disks should be separate physical disks, but separate partitions or logical drives are an option.
The reasons for segregating the operating system from the data files include:
TIP: I strongly recommend implementing hardware-based RAID to mirror your drives and hot-swappable drives (level 5) if your server will be connected to the Internet. If you lose either the operating system or data disks, the mirrored drive can be replaced without taking down the server. In addition, using hardware-based RAID eliminates the performance overhead imposed by software-based RAID. See Chapter 28, "Protecting Your Disks."
Next, plan the amount of disk space you anticipate needing for each service. There is no rule of thumb for this; you simply need to determine the total size of files to be included in each folder and add an estimated amount for growth. If you prefer, you can employ volume sets, which enable you to add space to a logical drive through the addition of more physical disks.
The next step is to decide where your Web, ftp, and Gopher files will be stored on the data disk. By default, IIS creates a folder named InetPub on drive C. Create a folder on your data disk that will serve as the root folder for all of your Internet resources. For example, if you are using drive D to store the data, create D:\InetPub (or specify a name of your choosing).
After you've created the root folder for the Internet resources, create root folders within that folder for the Web, ftp, and Gopher services. For example, create folders named \InetPub\wwwroot, \InetPub\ftproot, and \InetPub\gophroot. Even if you are placing each resource on a separate disk, you still might want to place the folder one level deep under the root Internet resources folder.
For example, if you're placing Web resources only on drive D, create \InetPub\wwwroot instead of \wwwroot. By creating a general root folder, you allow the possibility of adding other Internet resources to the disk without restructuring the file system. If you later want to add ftp resources to the disk, for example, simply create \InetPub\ftproot. Figure 52.1 shows a sample directory structure that you might use as a starting point for your server.
This sample directory structure includes folders for Web, ftp, and Gopher resources.
NOTE: You must create the folders for the Internet resources before you can assign them in IIS. The sections, "Setting Up a Web Server," "Setting Up a Gopher Server," and "Setting Up an ftp Server," later in this chapter, explain how to assign resource root folders in Internet Service Manager.
Normally, a domain name such as www.foo.com refers to a single computer host. You can, however, configure a single server to appear as different hosts. You might, for example, create virtual servers, one for each department in your organization. In addition to a general Web site for the company at www.foo.com, you might also create servers called sales.foo.com, support.foo.com, service.foo.com, and so on. Each of the servers would be recognized by a different IP address in your DNS server, but all would be hosted on the same server. They are called virtual servers because they all are hosted on the same physical server. Note that only the Web service supports virtual servers--ftp and Gopher do not.
To create a virtual server, you must have a unique IP address for the virtual server. If you are acting as your own ISP, you simply choose an available IP address from your own subnet. If you connect through an outside ISP, you must contact the ISP and request an IP address for each virtual server.
After identifying the IP address of each server, you need to plan how you will create the directory structure to contain the files for the virtual servers. Each virtual server needs its own root directory, which can be located on the same disk as all other virtual servers' directories or on a separate disk. For example, your primary server Web root for www.foo.com might be D:\InetPub\wwwroot, and the root directory for sales.foo.com might be E:\InetPub\salesroot. Or if you are placing them on the same disk, you might use D:\InetPub\wwwroot for www.foo.com and D:\InetPub\salesroot for sales.foo.com.
If you create a home directory that does not have an IP address associated with it, that directory is used for all requests that contain server IP addresses not specified in any other home directory. The default directories created during installation of IIS are not associated with a specific IP address.
In addition to creating virtual servers, you can create virtual directories. A virtual directory exists as a physical directory on disk, but it appears under the root service directory even if it is located on another disk. In effect, virtual directories are like a mountable file system in which directories from disparate physical directories and disks can appear to be a homogenous directory structure.
For example, assume that your Web root is D:\InetPub\wwwroot and contains the general resources for your Web site. You also want to host three different product catalogs, but for fault tolerance, you want to place each catalog on a separate physical disk. So, you might create E:\InetPub\cat1root, F:\InetPub\cat2root, and G:\InetPub\cat3root. Then, you specify each of these three directories as virtual directories under D:\InetPub\wwwroot. When the client browses the site, it appears that the three catalog directories are subdirectories of wwwroot.
An important point to understand about virtual directories, however, is that they do not appear in directory listings. For example, if a user connects to your ftp site, he or she will see the root folder, its contents, and any physical subdirectories of that root directory. Virtual directories, even though they are considered logical subdirectories of that root, do not appear in the directory listing. To access virtual directories, users must enter the resource name. To access a virtual directory named foofang on your ftp site, for example, the user would have to enter the ftp command cd foofang.
The fact that virtual directories do not appear in directory listings (or when Web directory browsing is enabled) offers a means of creating hidden resource directories. If the user knows the name and has the appropriate access to the directory through Windows NT's security database, he can open the directory and access its contents. Unless the user knows the virtual directory's name, he will never know that it exists.
You can create links to virtual directories as a means of making those directories and their contents accessible to everyone. For example, you can add a link in a Web page to each virtual directory or to a specific document in the directory. In this situation, you're using virtual directories primarily as a file management and segregation tool rather than a security tool.
Prior to or after installing IIS, complete these tasks to make your system available to the intranet or Internet:
NOTE: If you are connecting to the Internet through a service provider, that service provider will manage domain name resolution for your server. When you establish the account, provide the ISP with the host name and domain name of your server so the ISP can create the necessary DNS entries in its DNS server(s).
After completing the preceding tasks, use the following steps to install IIS:
2. If autoplay is enabled, click Browse this CD from the CD's autoplay window. Otherwise, open Windows Explorer.
3. Browse to the \platform\Inetsrv folder, where platform is your server platform type (such as I386, Alpha, Ppc, or Mips).
4. Double-click the file Inetstp to start the IIS Setup program.
5. Click OK at the initial information screen to display the Setup dialog box shown in Figure 52.2.
6. Choose which components you want to install and specify the directory in which to install IIS; then click OK.
7. Specify the root folders for each of the IIS services (see Figure 52.3).
Choose the IIS components to install and the installation directory.
If you specify nonexistent directories for the IIS services, Setup creates the directories for you.
If you have downloaded a later copy of IIS from Microsoft's Web site, simply double-click the file's icon to start the Setup program. Then, follow the preceding steps described to complete the installation.
NOTE: The Windows NT Server CD includes version 2.0 of IIS. Service Pack 2 includes version 3.0. If you apply Service Pack 2, it automatically upgrades IIS 2.0 to 3.0.
The Internet Service Manager is the utility that you use to manage the IIS Web, ftp, and Gopher services. Figure 52.4 shows the Internet Service Manager main window. In this example, only one server is being managed. You can, however, manage multiple servers across the network.
Internet Service Manager enables you to manage IIS services on multiple servers.
The IIS services are listed individually. You can display the services by server or by service, or you can use a special reports view. Figure 52.4 shows the reports view. To choose a different view, choose View and select the desired view from the menu.
To manage the properties of a service, just double-click the service's icon in the list. Internet Service Manager displays a property sheet for the service that you use to configure and manage the service. Figure 52.5 shows the property sheet for the ftp service. Figure 52.6 shows the property sheet for the Gopher service.
The ftp property sheet enables you to control all aspects of the ftp server.
In addition to using the Internet Service Manager, you also can use a Web browser such as Internet Explorer to manage the IIS services. To do so, you must have installed the HTML version of Internet Service Manager. If you did not do so when you installed IIS, you can do this now. Choose Start, Programs, Microsoft Internet Server, Internet Information Server Setup. After Setup starts, follow the prompts to the Add/Remove button and choose it. Select the Internet Service Manager (HTML) item, and follow the remaining prompts to add it to the system.
The Gopher property sheet enables you to control all aspects of the Gopher service.
After the HTML version of Internet Service Manager is added to the system, choose Start, Programs, Microsoft Internet Server, Internet Service Manager (HTML). Your default Web browser starts and loads the first of the Internet Service Manager Web pages (see Figure 52.7).
You can administer IIS services through your Web browser if you install the necessary software with IIS.
Note that you can administer all of the features of the IIS services through the browser. You can't start or stop IIS services with it, however, because of security limitations. You must use the Internet Service Manager or the Services object in Control Panel to start and stop the services.
After you have performed all the planning for your Web site and created the documents you want to serve to your clients, you're ready to start creating and managing the Web server. This section of the chapter explains the process in detail. Note, however, that some aspects are only mentioned briefly because they relate to connectivity rather than Web site creation.
After you install IIS and create the directory structure for your Web site, open the Internet Service Manager and double-click the Web service that you want to configure and manage. The Service page of the Web service property sheet appears, as shown in Figure 52.8. You use this property sheet to set general properties for the Web server.
Use the Service page to set general properties for the Web site such as logon and password authentication method.
The settings on the Service page are described in the following sections.
TCP Port. The TCP port setting specifies the TCP port number to use for the service. All TCP applications and processes are assigned a unique identification number called a TCP port. Port numbers for server applications are assigned predefined numbers, while client applications are assigned port numbers dynamically.
Well Known Port numbers for service applications are defined by standards and are called Well Known Port Numbers. The default port for HTTP is port 80, and IIS defaults to port 80. You should always use the default port value for servers connecting to the Internet. In most cases with intranets, there is no need to specify a number other than the default value of 80.
For more information about TCP port assignments and standards, access:
ftp://ds.internic.net/std/std2.txt
Connection Timeout. This value specifies the amount of time in seconds that can pass before the server will disconnect an inactive user. This ensures that if the HTTP protocol fails to close a connection, it will be terminated after the timeout period. The default value is 900 seconds.
Maximum Connections. This value specifies the maximum number of concurrent HTTP connections the server will process. The default value is 100,000. The value you choose depends partly on the complexity of the Web pages you are serving (amount of graphics, for example), the bandwidth of your connection to the Internet or intranet traffic load, server load capacity, and other factors that vary according to your site. The default value should certainly accommodate most sites. If you want to restrict the number of connections because you have relatively low bandwidth, reduce this value.
Username and Password. These values specify the username and password used by the Web server to authenticate remote user access to the Web services. IIS creates a user account named IUSR_computername, where computername is the name of the IIS host. If the computer name is SRV, for example, IIS creates the user account IUSR_SRV and grants that account the right to log on locally. When a user attempts to connect to the Web service, IIS uses this user account, which I'll call the IUSR account, and its associated password to log on to the system.
The password for the IUSR account is randomly generated by IIS at setup. Therefore, there is no way for you to know the IUSR password even if you have Administrator privileges. The password you enter in the Password text box must match the password associated with the IUSR account in Windows NT's security database. Therefore, IIS automatically inserts the username and password for you. If you change the password in Internet Service Manager, you must also change the password for the IUSR account with User Manager.
Password Authentication Options. The Password Authentication options control how user logon is authenticated. The settings are explained in the following list:
Adding a Comment. The Comment text box enables you to add a comment string. This string appears under the Comment field in the Internet Service Manager when you view the servers by using Report view. You might use this string to include identifying comments about the server to differentiate it in the report from other Web servers.
Use the Directories property page (see Figure 52.9) to create and manage Web server directories. When you install IIS, it creates the InetPub directory and places the wwwroot, ftproot, and gophroot directories in it. (You have the option during Setup to change the location of the directories and their names.) In addition, Setup creates a Scripts directory to contain various scripts. It also creates the directory \WINNT\system32\inetsrv\iisadmin to contain the IIS administration tools, scripts, and HTML documents.
The Directories page enables you to create and manage Web directories and virtual servers.
You can specify only one home directory per server, and the Home directory is indicated as such in the directory list. The following two controls appear on the Directories page:
Adding Directories. To add virtual directories or create a home directory for the Web service, click the Add button. Internet Service Manager displays the dialog box shown in Figure 52.10.
You can create a home directory or virtual server by using the Directory Properties dialog box.
You can have only one home directory per Web server. If you use the controls in the Directory Properties dialog box to create a new home directory, Internet Service Manager displays a message explaining that only one home directory can exist per Web server. If you choose to create the new home directory, IIS automatically creates an alias for the old home directory and converts it to a virtual directory.
There are several controls on the Directory Properties dialog box:
Adding Multiple IP Addresses. When you create a virtual Web server, you assign a unique IP address to it. In addition to specifying the virtual server's address in the Directory Properties dialog box, you also must add the IP address to the TCP/IP protocol for the server. To do so:
2. Log on as Administrator, and open the Network object in Control Panel.
3. In the Network property sheet, click the Protocols tab, and then double-click the TCP/IP protocol to open its property sheet (see Figure 52.11).
You must assign a primary IP address to the server, and you do so through the IP Address page of the TCP/IP property sheet.
5. Click the Advanced button to display the Advanced IP Addressing property page (see Figure 52.12).
Use the Advanced IP Addressing to assign multiple IP addresses to a single network card in the server.
7. Click the Add button to display the TCP/IP Address dialog box (see Figure 52.13).
Use the TCP/IP Address dialog box to enter additional IP addresses for the selected network adapter.
9. Repeat steps 7 and 8 to add additional virtual server IP addresses as needed.
10. Click OK as needed to close all Network property sheets.
The Logging page of the WWW Service Properties sheet (see Figure 52.14) enables you to configure logging options for the Web server. The controls on the left half of the Logging property page are self-explanatory. Use these controls to enable logging and specify the following: location of the log file, frequency at which the log file is replaced, and format of the log file.
You can log Web server activity to a file or to a SQL/ODBC database.
The controls on the right side of the property sheet let you cause all logging to go to a database rather than a log file. When you select the Log to SQL/ODBC Database option button, the controls on the right side of the page become accessible. Set these values according to the database you're using to log the server activity.
The Advanced page of the WWW Service Properties sheet (see Figure 52.15) enables you to control advanced logon and server load settings.
Use the Advanced page to set advanced access and server load options.
By default, all IP addresses are granted access to the Web server. You can, however, restrict access by specific addresses. Two option buttons on the Advanced page, Granted Access and Denied Access, control the default state for all connections. If you select Granted Access, all users are granted access except those you specifically prohibit. If you select Denied Access, all users are denied access except those you specifically allow access.
To add a single computer or group of computers to the list of users to be granted or denied, click the Add button. The resulting dialog box enables you to add to the list of IP addresses that are granted or denied access. If you're entering a single computer, you can click the button beside the IP address box to specify a FQDN for the host to be granted or denied. Otherwise, enter the IP address of the computer. For a group of computers, specify an IP address and subnet mask to identify the group.
The Limit Network Use By All Internet Services On The Computer check box on the Advanced property page enables you to limit the amount of traffic created on the network by all Internet services on the computer. In effect, this lets you "throttle down" the traffic if it becomes excessive and begins to overload your connection.
The Maximum Network Use spin control enables you to specify the maximum bandwidth, in kilobytes per second, of all Internet services on the selected server. Determine the maximum amount of bandwidth you want to impose, and then use the control to set it.
You use the Internet Service Manager to configure and manage the ftp server in IIS. To configure an ftp server, simply double-click the server's name in Internet Service Manager. The first property page you see is the Service page (see Figure 52.16).
Use the Service property page to configure general options for the ftp server.
The following controls appear on the Service page:
The Messages page (see Figure 52.17) enables you to specify the welcome messages the ftp user sees when specific events occur, including connection, disconnection, and maximum connections reached.
Use the Messages page to define the messages that ftp users see when specific connection events occur.
These messages include:
The Directories page (see Figure 52.18) enables you to add new directories to the ftp directory structure and define the way in which directory listings are displayed to the users.
Use the Directories page to add, configure, and remove directories from the ftp directory structure. You also can specify the directory listing method to use.
To add directories to the ftp directory structure, click Add. You'll see the Directory Properties dialog box, as shown in Figure 52.19.
You can specify the home directory for the ftp site and add virtual directories to the directory structure.
To specify the home directory for the ftp site, enter the directory path in the Directory text box or click the Browse button to browse to it. Note that you can have only one home directory for the ftp site, and this home directory appears as the root, or uppermost directory, of the ftp site. If you assign a new home directory, Internet Service Manager automatically generates an alias for the old home directory, and it becomes a subdirectory of the new home directory.
TIP: To create a new home directory and not create an alias for the old home directory, double-click the old home directory in the Directory list. Doing so opens a property sheet for the directory in which you can specify the path to the new home directory.
Keep in mind that the User Name and Password controls are only enabled if you specify a UNC share name in the Directory text box to indicate a resource on the network. The User Name and Password define the account that must be used to log on to the remote network computer to access the resource.
The Directory Listing Style group enables you to specify the way in which files are listed to ftp users. If you select UNIX, the directory listing appears like a UNIX directory listing. Selecting MS-DOS causes the directory listing to use a typical DOS directory list format. Many browsers expect the ftp site to use the UNIX format, so you should select UNIX for maximum compatibility with remote users. If you're setting up an ftp site that will only be accessed across an intranet via the ftp command line and not by browsers, the DOS option works well and provides novice users with a less intimidating display of information.
The Service page of the Gopher service property sheet (see Figure 52.20) enables you to specify general configuration settings for the Gopher service. These settings include the TCP port for the connection, connection timeout, and other general settings.
Use the Service page to configure general Gopher settings.
The controls on the Service page include the following:
The Directories page of the Gopher Service property sheet enables you to define the home directory and virtual directories that will make up the directory structure for your site. To add a directory or change the home directory, click Add. You'll see a simple Directory Properties dialog box such as the one shown in Figure 52.21.
You have only a few options to specify for a Gopher directory. User Name and Password controls are dimmed unless you specify a UNC path name to the directory.
As with an ftp directory, you can create a new home directory, automatically creating an alias for the old home directory and demoting it to a subdirectory of the new home directory. Or, you can create a new virtual directory. Keep in mind that the User Name and Password controls are unavailable unless you specify a UNC path to a directory on a network computer. This username and password specify the account the service will use to connect to the remote computer to access the shared network directory.
© Copyright, Macmillan Computer Publishing. All rights reserved.