External Web Access to IIS 6.0 Server

[ryan_powell]

Hi, Ive recently created a newly designed Intranet for our school full of various features that we'd like kids to be able to access from home. The IIS (6.0 win 2003) server is part of our domain and has direct access to the Internet via the EMBC proxy server.

 

I figured to make it directly accessible from the Internet we request an external IP from EMBC (which we've now recieved). At home if i put the IP into the browser i just get the standard 404 page not found error. In school the Intranet Works, and even using the External IP works. Could this be a configuration issue that hasn't been done on the server, or is this more of a problem regarding DNS / WINS to the IP, in which case i'd have to contact the Helpdesk with?

 

The server is set up to require authentication, so when kids access it they will be prompted for their domain credentials.

 

Oh, and before anyone mentions the difficulty the kids will have with remembering the IP, we will create a subdomain on the website to the IIS server, but again thats an EMBC issue.

 

Many Thanks

Ryan P

[Ric_]

To begin with, a note to the wise. Be careful what info is available... data protection and all that! Also remember what happened with that 'hacker' kid recently and remember that IIS isn't known for it's invulnerability from attacks.

 

Back to your Q... I would check that IIS (and the website) is running on the external interface. Also make sure that the relevant port forwarding (and open ports) is configured in your firewall.

[ryan_powell]

To begin with, a note to the wise. Be careful what info is available... data protection and all that! Also remember what happened with that 'hacker' kid recently and remember that IIS isn't known for it's invulnerability from attacks.

 

Back to your Q... I would check that IIS (and the website) is running on the external interface. Also make sure that the relevant port forwarding (and open ports) is configured in your firewall.

 

Thanks, I know that there is the chance of being hacked but there won't be any personal information online - just letters to parents, some revision games, homework etc.

 

How would i check the website is running on the external interface. Is there an obvious way of checking?

 

Thanks

[GrumbleDook]

Hi Ryan ... let me just run through a few quick things for setting up remote access to a server via EMBC and you can check them off as you go.

 

1. Access Control Lists are everything. Take the internal IP of your server (eg 10.14.12.34) and give the details of it to EMBC as an internet server. There is paperwork for this that has to be signed off by your Head and returned to the nominated person at your LA. Note that for Northants this is slightly different and if you PM me I will point you to the right person. This will then mean that EMBC open up the relevant ports so other schools on EMBC can access your server via IP Address.

 

2. DNS truly is everything. Then take the fully qualified host name of your server (eg http://www.school.county.sch.uk or moodle.school.county.sch.uk) and tell EMBC that this is the hostname for the internal address you have given them ... they will add it to their DNS records and other schools on EMBC can now access your server my the proper name.

 

3. External IPs are important too. Now you have a web server, you want your staff and students to access it at home. Tell EMBC that the internal address of x.x.x.x needs a public address. They will work their magic and give you an external IP. This is nice but not perfect ...

 

4. DNS once more becomes everything. Politely remind the folks over at Fujitsu Services that the external IP points to the same IP that hostname.school.county.ch.uk points to ... can they ensure that the same hostname points to the external IP too? Once again, take advice on paperwork needed to make this happen.

 

5. Relax and enjoy.

 

Ok ... there are some caveats.

 

Firstly, under instructions from DfES and Becta, RBCs will happily deal with .sch.uk domains ... these are the domains specifically set up for schools. They will even deal with .ac.uk ... but these really should be dealt with by UKERNA. There are some RBCs that will deal with other domains but EMBC only deal with Nominet as a Registrar and subsequently will only deal with .uk domains ... Fujitsu Services are under clear instructions not to handle anything other than .sch.uk domains ... please do not give the folks on the helpdesk grief over this ... it is not their fault.

 

If you do have a different domain then speak to your LA ICT Guru ... you may be able to negotiate, but it is doubtful without good grounds ... and they will probaby tell you to wait whilst they work with sorting another school out who is testing all this ...

 

Again ... try not to give them a hard time ... they will not move to fast on this until I am happy it works (yep ... my fault again ... sorry folks).

 

Back to the DNS. Make sure you have the correct DNS entries in your own domain and that the DNS headers are reflected in your site properties in IIS. Basically it means that if you use the domain flibble.local within school you must also have dns records for flibble.county.sch.uk too ... and that you have the headers set to *all* in IIS.

 

Then we have to look at whether you are using ISA in front of the web server too ... or some sort of firewall appliance. Do you go straight out or via ISA or other proxy first on this server? Is it firewalled off?

[GrumbleDook]

How would i check the website is running on the external interface. Is there an obvious way of checking?

 

Thanks

 

An easy way of checking that the web server is running on the EMBC internal address (eg 10.12.14.36) would be to ask another local school to try and access it via that IP. If they can access it then the port forwarding / ACLs are working and it may just be the exertnal to internal NAT that is not working with the EMBC ... if you give the EMBC helpdesk a ring they can check the EMBC internal address befoer checking the external one.

 

Occasionally they may send a message back saying something is done *pending* receiving the paperwork from your LA ... check with this.

[ryan_powell]

Hiya GrumbleDook, We completed the external IP request form on EMBC's webview. Which after some time they got back to use with an Ip address. If it's important the IP they gave us is 213.249.???.???.

 

Any ways, we don't use ISA and the server is behind the EMBC firewall, we don't have local firewalls as EMBC claims they 'should' be suficent.

 

4. DNS once more becomes everything. Politely remind the folks over at Fujitsu Services that the external IP points to the same IP that hostname.school.county.ch.uk points to ... can they ensure that the same hostname points to the external IP too? Once again, take advice on paperwork needed to make this happen.

 

Is this only relevent if we want our school website to be hosted on the IIS server. The current plan is to still host the school website with EMBC and merely put either a link back to the IIS server on the site or create a subdomain.

 

Sorry if i seem a little 'thick' on some of this stuff. I've never done this before, tis a very exciting time for me

 

Cheers

 

P.S Sorry wrote this message whilst you posted your second response, so it may not make too much sense reading on from the previous msg.

[GrumbleDook]

Hiya GrumbleDook, We completed the external IP request form on EMBC's webview. Which after some time they got back to use with an Ip address. If it's important the IP they gave us is 213.249.151.2.

 

What is the EMBC internal address of the server?

 

Any ways, we don't use ISA and the server is behind the EMBC firewall, we don't have local firewalls as EMBC claims they 'should' be sufficient.

 

*SNORT*

 

Sorry ... knee-jerk reaction ... I have to admit to being distrusting of this ... this relies on a number of things that I am not 100% happy about and until I am I would rather be careful ... and then we have the other issue of not wanting to have to change the way we run our network internally ... so our firewall also is out NAT device too

 

4. DNS once more becomes everything. Politely remind the folks over at Fujitsu Services that the external IP points to the same IP that hostname.school.county.ch.uk points to ... can they ensure that the same hostname points to the external IP too? Once again, take advice on paperwork needed to make this happen.

 

Is this only relevent if we want our school website to be hosted on the IIS server. The current plan is to still host the school website with EMBC and merely put either a link back to the IIS server on the site or create a subdomain.

 

Sorry if i seem a little 'thick' on some of this stuff. I've never done this before, tis a very exciting time for me

 

Cheers

 

P.S Sorry wrote this message whilst you posted your second response, so it may not make too much sense reading on from the previous psg.

 

The full hostname is still desirable. The whole system of DNS was setup so people don't have to remember number ... if your website (hosted on EMBC) is http://www.school.county.sch.uk then make the intranet server (now an internet server) stuff.school.county.sch.uk ... this can also make life easy for checking things. It means that whilst in school you can interogate the EMBC DNS boxes to see if they truly do point to the IPs you want ...

 

If you let me have the internal address I will vpn in and check to see if I see it.

[ryan_powell]

GrumbleDook ill PM you the details as i'd rather not post everything live on the forum. Is it just the internal IP and host name ('server.domain.lea.sch.uk' format) of the server that you want?

[GrumbleDook]

I was going to suggest that you get some form of IM running and add me as a buddy / friend / freak ...

 

MSN Messenger or AIM / iChat is best for me.

[ITWombat]

Thanks, I know that there is the chance of being hacked but there won't be any personal information online - just letters to parents, some revision games, homework etc.

 

Even if you don't think the web server contains no valuable information,

it is machine on the internal LAN.

If it is compromised a hacker is just a hop away from getting at something really juicy like a domain controller, email server or the file server whch has pupil reports, staff appraisals etc.

 

The usual advice is to put an externally facing server in the DMZ. You are lucky in that your server doesn't require Active Directory authentication or access to the SIMS database.

 

@Ric_

To be fair to MS, although IIS4 was like Swiss cheese and IiS5 less so, version 6 hasn't had any really jaw droppingly bad flaws.

[ryan_powell]

ITWombat i've been researching some of the security implications you mentioned prior to your concern. I think IIS 6.0 is prety secure, and although GrumbleDook will Snort i'm confident in EMBC's ability of supreme Server protector(s).

 

Active directory authentication is (or will be) required in order to access the server from the internet. That should stop kids and people fooling around from being able to access any information. But ofcourse I think anyone really wanting to hack the server will probably manage it. Think about Microsoft they effectively invented computer secuity (don't laugh) and they still get hacked on occasion (don't laugh).

 

And Sims.Net data and private pupil / staff info is all located on the admin domain which is locked down edIT and required further authentication.

 

Hopefully we'll be pretty secure \\:D/

[Roberto]

To begin with, a note to the wise. Be careful what info is available... data protection and all that! Also remember what happened with that 'hacker' kid recently and remember that IIS isn't known for it's invulnerability from attacks.

 

I think you'll find that this 'legend' does not apply to IIS 6 in any shape or form. In fact if you just want to sit down and count numbers of vulnerability patches for each product (flawed I know, but people seem to like doing it) you'll find it compares favourably to Apache.

 

I'd certainly agree with worrying about data protection. In my experience though most breaches of data security / integrity of that kind tend to come from human error - What price the foolproof security system when all your teaching staff log into it and walk out of the room for half an hour leaving confidential personal student information up on the screen. Or (my favourate this one!) check their emails and read confidential ones on a computer connected to the classroom projector!

[ryan_powell]

Hi. Anyone have any ideas...

 

We've now got the server visible from the Internet after emailing the helpdesk.

 

Anyway. When we put the Server Public IP address into the browser i get the enter credentials message come up. I enter my administrative credentials and the server accepts them. However it returns an error page stating that there could have been a DNS Error or the page is unavailiable.

 

Inside school, the server works. although I cannot access the hosted Intranet using the server itself. E.g. Entering http://odyssey on a workstation opens the Intranet. But entering it in the server's browser or using the Public IP off-site returns the DNS / Page Unavailable error.

 

Any Ideas?

 

Thanks

[ryan_powell]

Hi. Anyone have any ideas...

 

We've now got the server visible from the Internet after emailing the helpdesk.

 

Anyway. When we put the Server Public IP address into the browser i get the enter credentials message come up. I enter my administrative credentials and the server accepts them. However it returns an error page stating that there could have been a DNS Error or the page is unavailiable.

 

Inside school, the server works. although I cannot access the hosted Intranet using the server itself. E.g. Entering

http://odyssey 

on a workstation opens the Intranet. But entering it in the server's browser or using the Public IP off-site returns the DNS / Page Unavailable error.

 

Any Ideas?

 

Thanks

[webman]

I think IIS 6.0 is prety secure

 

8O :?

[Roberto]

I think IIS 6.0 is prety secure

 

8O :?

 

http://secunia.com/product/1438/

 

http://msmvps.com/blogs/bernard/archive/2004/06/10/7882.aspx

 

3 IIS 6 vulnerabilities might be 3 more than you'd want in an ideal world but I think it compares pretty well with Apache, for example.

 

http://secunia.com/product/9633/

http://secunia.com/product/73/

http://secunia.com/product/72/

 

I've never had an IIS server of any version that was under my control exploited, personally.

[webman]

In my opinion, the reason for those figures are down to the closed source nature of IIS - how many other vulnerabilities are there that we don't know about waiting to be exploited?

[Roberto]

If open source were a panacea then why did Apache take between 3 and 33 hits?

 

My point was, and still is, that when you actually look at the hard info on IIS 6 the "legend" of IIS being useless doesn't stand up the way it did with previous versions. We're supposed to be in the education business after all. The OP made a choice which is supported by the currently available figures, and carping on about it doesn't help.

 

Anyway, I'm done on that subject, because turning the thread into a IIS vs Apache or Open Source vs. Closed Source thread wasn't my intention and I've got about as much interest in those topics as I have in the Exclusive Sky Sports channel's feature on olympic nose-hair growing.

[Roberto]

Hi. Anyone have any ideas...

 

We've now got the server visible from the Internet after emailing the helpdesk.

 

Anyway. When we put the Server Public IP address into the browser i get the enter credentials message come up. I enter my administrative credentials and the server accepts them. However it returns an error page stating that there could have been a DNS Error or the page is unavailiable.

 

Inside school, the server works. although I cannot access the hosted Intranet using the server itself. E.g. Entering http://odyssey on a workstation opens the Intranet. But entering it in the server's browser or using the Public IP off-site returns the DNS / Page Unavailable error.

 

Any Ideas?

 

Thanks

 

Having had a think about this for a while, the following spring to mind as worth checking if you have not already.

 

First, what is the exact error message you get.

Is it from the server? Or from a proxy between the home user and the web server?

 

Have you defined host headers as a requirement for reaching the site.

Do you have redirects in place? Can you check the HTML links in the page code?

 

If so, do any of these re-direct to the intranet 'http://odyssey' internal address rather than to whatever appropriate FQDN or IP address you're using for external users?

 

Assuming IIS logging is turned on, you should be able to extract the host/server conversation for one of these connection attempts to see what exactly is happening. It should be possible to see from that at what stage things begin to fall apart.

 

Incidentally, if you're logging in with your Active Directory credentials, I _do_ hope you're using SSL at that point.

[GrumbleDook]

I've had a bit more of a chat with Ryan about this ... and i am scratching my head with some of the description.

 

A little background.

 

The school connects via EMBC. They use the EMBC ranges and have seperate admin / curriculum domains.

 

The admin domain is .county.sch.uk ... with a netbios name of . The curriculum domain is ..county.sch.uk ... the server in question is on the curriculum domain but registered externally as host..county.sch.uk ...

 

The intranet server (hosted on the curriculum domain, can be accessed using http:// whilst in school (IIS appears to be integrated authentication and lets users right in ...) but if you try to access it via the FQDN that is registered in external DNS (and internal) it will not allow you to authenticate.

 

I think that this is more to do with IIS handly authentication than DNS (but that probaby does not help) and so Ryan is going to try and change the access levels tomorrow to see what works best.

 

If anyone else has any ideas I am sure Ryan would appreciate them.

[Roberto]

The intranet server (hosted on the curriculum domain, can be accessed using http:// whilst in school (IIS appears to be integrated authentication and lets users right in ...) but if you try to access it via the FQDN that is registered in external DNS (and internal) it will not allow you to authenticate.

 

Just to be clear about this, if this is all hosted on the same IP range, does the FQDN point to the same actual network card from both external and internal clients?

 

Does it definately fail auth when being accessed by FQDN internally?

 

Do the netbios / wins name of odyssey and the FQDN point to the same network card "internally"? Where is "internal" and "external" delimited? On the site or at the hosting company's external gateway to the internet at large? E.G. Are they routing onto the internet directly or onto a MAN/WAN?

 

I think that this is more to do with IIS handly authentication than DNS (but that probaby does not help) and so Ryan is going to try and change the access levels tomorrow to see what works best.

 

I'd be looking at the IIS logs AND the event viewer at this point. That would show where the exact breaking point is.

[GrumbleDook]

Curriculum and Admin on seperate ranges, linked via a router that routes in 3 ways ... admin | curriculum, admin | EMBC, curriculum | EMBC. The admin range hosts the admin domain that is school.county.sch.uk ... the curriculum hosts the curriculum domain which is schoolshortenedname.school.county.sch.uk ... and within this domain is a server (server.schoolsshortenedname.school.sch.uk) that needs to have the address of server.school.county.sch.uk ...

 

Confused?

 

Yeah ... I was when he described it to me.

 

Obviously http://server works fine within the curriculum network, but server.school.county.sch.uk takes you to the site but fails to authenticate (IIS / Windows integrated authentication?)

 

Likewise, trying to access externally causes an issue. I have suggested the lowering of auth level on IIS for the site and building it back up again.

 

Also, a good check of DNS is in order methinks.

[ryan_powell]

Good news, guys the server's working.

 

We had to contcat EMBC to put the server onto the group for direct internet connections. Then i had to configure the IIS to allow active directory integrated authentication.

 

But everything works.

 

Thanks for all of your replies and help. Especially Grumbledook and webman

[webman]

Lol, don't mention it

[GrumbleDook]

No worries ... happy to help.