Modular architecture in IIS 7.0 aids Web server security

Introducing Windows Server 2008 By Mitch Tulloch Get a jump on evaluating Window Server 2008 -- with technical insights from Windows Server team. This practical introduction delivers real-world implementation scenarios and pragmatic advice for administering Windows Server in the enterprise.

One thing I really like about IIS 7.0 is its new modular architecture. What this means is that instead of IIS being a monolithic entity installed by default with only a few features available for optional installation, IIS 7.0 now has more than 40 separate setup components you can choose from and only a small set of these are installed by default. You can now install only IIS features you actually need on your Web server and leave the remaining features uninstalled. The benefits of doing this are fivefold:

• First, your system is more secure. Why? Because the only IIS binaries installed on your system are those you actually need. And the fewer binaries, the less attack surface there is on your machine.
• Second, your system is easier to service. Why? Because maintaining a server involves keeping it patched with the latest critical updates from Microsoft. But if you have only a subset of the available IIS modules installed on your machine, you have to patch only those modules -- you don't have to patch modules that aren't installed.
• Third, your system is easier to manage. For example, as we'll see in a moment, if the component supporting Basic authentication is not installed on your system, the configuration setting for this feature won't be present. And the fewer configuration settings that are surfaced, the less clutter the admin UI has and the easier it is to manage your server.
• Fourth, you can customize your Web server to function in a specific role in your environment.
• And fifth, you can reduce the memory footprint of your Web server by removing unnecessary modules. As a result, the amount of memory used by worker processes on your machine will be reduced, which can allow you to host more Web sites and Web applications on your machine -- something especially valuable in large hosting environments. Reducing the number of installed modules also means that fewer intra-process events are occurring, so this also frees up CPU cycles as well -- something that, again, is important in hosting environments.

Windows Server 2008 security extras Will Windows Server 2008's delay affect your security? Windows Server 2008 features worth watching

In addition, you can even create your own custom modules and use these to replace existing modules or add new features to your Web server. We'll talk about this later when we discuss the extensibility of the IIS 7.0 platform.

The following graphic shows the IIS 7.0 components available for you to install when you add the Web Server (IIS) role to your Windows Server 2008 machine. These components are called modules, and you can add or remove them from the Web server engine, depending on what you need.

Table 11-1 lists the different modules available in each category and provides a short description of what they do.

You can install these modules by adding role services and features to the Web Server (IIS) role using Server Manager. (Note that some of these modules cannot be selectively installed or uninstalled unless you uninstall the entire w3svc.) When you add the Web Server (IIS) role to your Windows Server 2008 server, a subset of available role services and features is installed by default (though you can also choose to add role services and features at this time or later).

Excerpted from "Introducing Windows Server 2008" by Mitch Tulloch with the Microsoft Windows Server Team . Reprinted by permission of Microsoft Press. All rights reserved. For more information, go to http://www.microsoft.com/MSPress/books/11163.aspx