Overview of Internet Information Services

Internet Information Services (IIS) is a collection of programs that make up Microsoft's industrial-strength IIS Web server platform. It's included for free as part of Windows XP Professional. Besides the basic Web (HTTP) server, it also includes a File Transfer Protocol (FTP) server, an Indexing Service for site content searching, FrontPage and Visual InterDev publishing extensions, the ASP script processor, support for sophisticated multitier online transaction services, and a Simple Mail Transfer Protocol (SMTP) mail delivery server.

CAUTION

If you are part of a corporate network, before you go any further, check with your network administrators because policies may prohibit you from setting up a Web site on your own. Many legitimate security concerns are involved, and in some companies, you could be fired for violating established security policies. Check first if you're not sure what's permitted.

While I'm on the subject of warnings, I'll give one more that's important enough that I'll repeat it later in the chapter:

CAUTION

Installing Internet Information Services might sound like fun, but don't install it unless you're really sure you need it and are willing to keep up with its frequent bug fixes and maintenance alerts. IIS has been one of Microsoft's biggest sources of strange and dangerous security flaws. All sophisticated services come with a measure of risk, and IIS is very sophisticated.

Microsoft has produced some tools to help you keep up to date on IIS security. Visit www.microsoft.com/technet. At the left, select Security, Security Tools. Check out the contents of the page. The especially useful parts are the IIS Web Server Lockdown Wizard and the Checklists link. The Checklists link leads to two pages devoted to Internet Information Services 5.0.

What Does a Web Server Do?

I'll take you on a brief tour here. If you already are familiar with the function of Web servers, you can skip on down to "IIS Services and Requirements."

In the most basic sense, a Web server works like a call desk librarian: When you request a book by name, the librarian looks up the book's location, fetches the desired tome, passes it across the counter, and goes on to the next patron as quickly as possible. If the desired book is not in the shelves, the librarian will say so and again go on to the next client. The interactions are brief and involve no interpretation of the contentthat is, the content of the bookpassing back and forth.

The roles of a Web server and Web browser are very similar. A Web browser sends a short request message to a Web server. The request is a text string, mostly just the Uniform Resource Locator (URL) that you typed in or clicked. The server turns this "virtual" file name into a real or physical filename and passes the appropriate HTML, image, or other type of file back across the Internet. When the URL refers to an executable program or a script file, instead of returning the file itself, a Web server runs the program and passes back whatever the program generates as its response. The Web browser displays the result.

A Folder by Any Other Name Is… a Virtual Folder

The translation of the URL filename into a physical filename is generally straightforward. When you set up your Web site, you'll specify which directory contains the documents that you want to publish. The Web site has a home directory, which is the starting point for the translation of URL names into filenames. For example, if the home directory is c:\inetpub\wwwroot, then the URL filename

 /index.html 

returns the file

 c:\inetpub\wwwroot\index.html 

Any file or folder inside this home directory is available to Web browsers. For example, the URL

 /sales/catalog.html 

would return the file

 c:\inetpub\wwwroot\sales\catalog.html 

You can also add other folders on your computer to this mapping, even if they aren't in the home directory or its subfolders. They are called virtual directories because to Web visitors, they appear to be part of the home directory structure, but they aren't physically. You could instruct IIS to share folder c:\partlist with the virtual URL name of /parts, so that the URL

 /parts/index.html 

would return the file

 c:\partlist\index.html 

When IIS is installed, adding a virtual folder to your Web site is a piece of cake: This process is integrated right into Explorer and is just a right-click away.

Web servers can also use a process called redirection, where the server is told to make virtual directory whose content is stored on another Web server. When a Web browser requests a file in a redirected virtual directory, the Web server tells the browser program to go fetch the file from the other server (or an alternate location on the same server). Redirection is useful when you rearrange your siteit lets visitors using an old URL obtain the files they want even though they're stored in a new location.

Default DocumentsWhen "Nothing" Just Isn't Enough

In Web-speak, a home page is a URL that lists a server name but no filename, like "www.brainsville.com." So what does an empty or home page URL map to? For example, what file does www.brainsville.com refer to? You might guess that it corresponds to just the name of the server's home directory:

 c:\inetpub\wwwroot 

Indeed, it does, but this doesn't tell the server what content to return. The Web server has to look for a default document, the file that is to be returned whenever a URL names a folder but not a full filename. IIS looks first for a script file named default.asp. Failing that, default.html or default.htm will do. If a file by one of these names exists, it's returned as the content for this folder. If no default document can be found and "directory browsing" has been enabled for the folder, IIS simply returns a listing of all the files in the folder. Otherwise, it gives up and returns an error message.

MIMEs Make It Happen

Web browsers must be told how to interpret the content returned by the server. They don't know in advance whether they're going to get HTML text, a Microsoft Word document, an image, or something else. Windows determines a file's type from the end of its filenamefor example, .doc or .html, but this system isn't used by other operating systems, and the Web was designed specifically to encourage cooperation between different computers and operating systems. So, a standardized naming scheme was developed for the Web. Web browsers get file type information from the Content-type field returned in the response header. This information is called a file's MIME type.

NOTE

MIME stands for Multipurpose Internet Mail Extensions. Prior to MIME, there was no standardized way to encode or name message content other than plain ASCII text.

MIME type names are agreed-upon Internet standards, and it's the Web server's job to know how to label each of the files it shares. When it's sending out files, IIS uses the Windows File Types Registry to map file types like .doc and .html into MIME types, and you can add to the list any special types of files you share.

To Run or Not to Run

When a URL refers to a program file, a Web server either can send you the program file itself, which you can save or run on your computer, or it can run the program on its side and return the program's output to you. Whereas Web pages stored in HTML files are static, and only change when their owner edits them, dynamic Web created by programs are generated from scratch every time they're viewed, and thus can contain interactive, up-to-the minute information. Programs on the server's side can do virtually anything: search libraries, access your bank account, buy airline tickets, or move robots on the moon, and then return the results to you as a Web page. In fact, this flexibility is the crucial feature that made the World Wide Web cause such a sensation and made the Internet explode into a global phenomenon.

These programs are generically called CGI (Common Gateway Interface) programs, or server-side scripts, when written in a language such as ASP, Perl, JavaScript, VBScript, or another interpreted language supported by the Web server. Useful CGI programs and scripts can be created with programming know-how, or can be purchased or downloaded from the Net. For IIS, the distinction between "send the program file itself" and "run the program and return the output" is made by changing a Web folder's read, script, and execute attributes. Folders with the read attribute treat scripts and executable programs as data to be returned directly. With the script or execute attribute, scripts and programs, respectively, are run on the server, and their output is sent back to the person visiting your site.

Just to reassure you, you don't need to take advantage of all this complexity if you just want to publish some simple Web pages and make files available to Web visitors. IIS can publish Web pages out-of-the box with no programming.