Test Windows Server 2008 with MBSA

Microsoft provides a tool for Windows Server 2008 that tests for security misconfiguration. It comes with a graphical interface and a command line interface for both local and remote scans. It looks for vulnerabilities, performs assessment checks, and checks SQL Server 2005.

In addition to Windows Server 2008, MBSA runs on Windows Vista, Windows Server 2003, Windows XP, and Windows 2000 systems. It scans for misconfigurations on Internet Information Server (IIS), SQL Server, Internet Explorer, and MS Office.

MBSA is available for download from the Microsoft website. It is free to download and use on Windows systems. It comes with a readme.html document containing information on system requirements, scan options, and tool support options.

Source: Microsoft

Photo: Flickr

Web server round-up

Over the past year, we have discussed several web servers. For your convenience, here is a quick list of each one we have already mentioned, as well as a couple we did not, including links to their project sites.

Apache – This is the most widely used and the one we have spent the most time covering. It is free and open source and runs on nearly every platform available. It is released under the Apache license.

Microsoft IIS – As Microsoft’s proprietary web server, it only comes with and works on Windows. If for some reason you have to run this but do not have Windows, you will have to consider virtualization.

Sun Java System Web Server – This is Sun’s proprietary web server technology that is primarily intended for Sun appliances. Nevertheless, it is cross-platform, and Sun recently opened some of its code under a BSD license.

Ngnix – This is a lightweight web server that runs on both Unix and Windows machines. It has become the fourth most popular HTTP server and is available under a BSD-style license.

Lighttpd – This lightweight HTTP server is designed to take on heavy loads while maintaining a good balance, low memory and CPU usage. It powers YouTube, Wikipedia, and many other high-traffic sites. It is free and open source under a BSD style license.

Photo: Flickr

How to enable HTTPS on a Windows server

SSL stands for Secure Socket Layer and is the underlying technology that enables a website to use the HTTPS protocol. Why is this important? A website with an HTTPS URL provides website visitors with a secure connection for private transactions. It is essential for any type of online sales or exchange of private data.

Windows 2008 server relies on IIS to serve websites to users, and in order to configure a Windows server for SSL, you need to enable it in IIS.

“The implementation of SSL has changed from IIS 6.0 to IIS 7.0.  On Windows Server 2003, all SSL configuration was stored in the IIS metabase and encryption/decryption happened in user mode (required a lot of kernel/user mode transitions).  On Windows Vista and Windows Server® 2008, HTTP.sys handles SSL encryption/decryption in kernel mode, resulting in up to 20% better performance for secure connections.  “

Read the rest at Learn IIS

Photo: stock.xchng

Remotely managing your Windows web server

Question: How do I setup remote management of an IIS 7 server on Windows Server 2008?

Answer: By default, remote management is turned off. Therefore, you must turn it on before you can use any of its features. Although IIS is available for Vista and other versions of Microsoft Windows, remote management only works on Windows Server. You can install remote management with three easy steps:

1. Install the service called Web Management Service (WMSVC)
2. Turn on remote connections.
3. Set any other configurations you desire, such as ports, IP address and domain settings.
4. Start the WMSVC service. You can also set it to start up automatically at boot.

A full detailed description of each step is available on the Learn IIS website.

Tomorrow, we will learn about using the remote management software.

Photo: Flickr

How do I install FTP on IIS 7.5

Question: How do I install FTP on IIS 7.5 in Windows?

Answer: IIS (Internet Information Service) is a set of Microsoft’s Internet-based services. As a web server, it is second only to Apache HTTP Server, serving 29% of all websites. In addition to HTTP services, it also includes FTP. On Windows Server 2008, installing FTP is pretty painless. Just follow these easy steps:

1. Click Start on the taskbar and select Administrative Tools -> Server Manager
2. In the Server Manager window, click Roles to expand it and then select Web Server (IIS).
3. Now in the Web Server (IIS) pane, go to Role Services and click Add Role Services.
4. Now expand FTP Server in the Select Role Services page.
5. Choose FTP Service and click Next.
6. Finally, click Install and Close.

It is that simple. Now, you should have an FTP service running and ready to start receiving clients. In a future post, we will learn how to configure an FTP server.

Source: Learn IIS