With the release of Windows Server 2008 R2 comes an update to the company’s Web platform, Internet Information Services. Like R2, IIS 7.5 isn’t a massive upgrade, but it does provide some welcome administration improvements. In addition, the new version seems to acknowledge that Microsoft may have made IIS a little too Apache-like in previous iterations.
Few products in the Microsoft portfolio have seen as positive a turnaround as the Internet Information Services Web server.
Starting with IIS 6, Microsoft made significant improvements in the security profile of the Web server—improvements that have erased IIS’ bad security reputation. With IIS 7, Microsoft took many cues from open-source rival Apache, making IIS more modular in its deployment options and even relying on good old configuration files for much of the server’s setup and administration.
IIS 7.5 is a welcome update, improving the management and deployment options for the Microsoft Web server. Interestingly, it also seems like an acknowledgment that, for some Microsoft customers, IIS might have gone too far down the Apache road. Though others like where IIS has gone.
This new focus was clear once I fired up the IIS Management Console on Windows Server 2008 R2 and started to configure request filtering for the server. Request filtering makes it possible to build a more secure server configuration that is resistant to common attack techniques such as cross site scripting.
Request filtering was built into IIS in previous versions of the server, but setting it up required editing configuration files. This wasn’t exactly difficult, but IIS 7.5 makes it easier with the option to set up filtering using a standard GUI interface. I found this process to be relatively simple, and I liked that changes made here took effect immediately, without the need to restart the service.
Also new in IIS 7.5 is the graphical Configuration Editor, which is sort of like a regedit for IIS configuration. Using this tool, I could edit and view IIS configuration settings without the need to open up the web.config file.
Another welcome change in IIS 7.5 is the elevation of FTP as a full-fledged part of the server. In previous versions, setup and management of an FTP server in IIS were done pretty much separately from Web server management. In IIS 7.5, FTP administration is fully integrated into the IIS Management Console.