WebApps

How to log client IP when IIS is load balanced: the X-Forwarded-For Header (XFF)

Enamul Kh-MSFT — Wed, 05 Sep 2018 07:08:47 GMT

X-Forwarded-For Header (XFF) is essential whenever we have a Proxy or LoadBalancer between client browser and IIS. This way, the proxy or load balancer will forward the client's IP to IIS, hence giving the IIS the much needed info to track the incoming user. You need to check your Proxy or Load balancer documentation on how to enable XFF. Once it's enabled, you can follow this blog on how to add a custom logging field in IIS 8.5+ to log the XFF forwarded client-IP: 1. Launch IIS Manager UI (alternately, On an elevated command prompt, type inetmgr.exe) 2. Double-click "Logging" 3. Click "Select Fields" 4. Click "Add Field" 5. In the Add Custom Field window, type as follows 6. Click on "Apply" on the Actions pane on the top right corner Logs with incoming client IP will be recorded in the IIS Log (default location is %SystemDrive%\inetpub\logs\LogFiles). The new log files will have an extra "_x" to it's name.

FIPS compliant machinekey section for IIS Application

Enamul Kh-MSFT — Wed, 05 Sep 2018 07:01:31 GMT

One of my customers needed to configure his ASP.NET site under FIPS. The information was scattered in various MSDN blogs and docs. To prevent the good work go to waste, I am blogging it here so that others can be benefited as well: FIPS compliant machinekey section in web.config:

Decryption: AES Specifies that ASP.NET uses the AES (Rijndael) algorithm to encrypt and decrypt data. AES is the default algorithm and is the one that is used when the value of this attribute is Auto. This algorithm is compliant with the United States Federal Information Processing Standards (FIPS). Validation:

HMACSHA256 Specifies that ASP.NET uses the HMACSHA256 hash algorithm to validate data. This is the default value. This algorithm is compliant with the United Stated Federal Information Processing Standards (FIPS).
HMACSHA384 Specifies that ASP.NET uses the HMACSHA384 hash algorithm to validate data. This option is available for applications that require stronger security than is provided by the HMACSHA256 algorithm. This algorithm is compliant with the United States Federal Information Processing Standards (FIPS).
HMACSHA512 Specifies that ASP.NET uses the HMACSHA512 hash algorithm to validate data. This option is available for applications that require stronger security than is provided by the HMACSHA384 algorithm. This algorithm is compliant with the United States Federal Information Processing Standards (FIPS).

Do not forget:

Besides the above machinekey settings, you also need to ensure that the compilation section of your web.config and the page directives of individual aspx page should all have debug="false". A Debug="true" will throw a FIPs compliance error before any code in your ASPX pages can run.
If you like to test your code in Visual studio, please ensure FIPS is disabled
Also, FIPS needs to be enabled at the Machine/OS level.

Forcing IIS to write logs (HTTP and FTP)

Enamul Kh-MSFT — Wed, 05 Sep 2018 06:53:21 GMT

I was assisting a customer who was trying several different configurations but his IIS log was not reflecting any of these changes. This can be frustrating at times since you always expect the logs to be written corresponding to your actions. By default, starting with IIS 7.0, IIS HTTP logs are written once every 1 minute or at 64kb whichever comes first. The FTP logs are written once every 6 minutes. Basically the logs are buffered for performance reasons and are written at these predefined intervals. If these default values do not work for you, then please read on….. Steps to force IIS to write HTTP logs (forces all entries in the log buffer to be written from the buffer into the log file):

Open a command prompt with administrative privilege
cd C:\Windows\System32
netsh http flush logbuffer

Steps to force IIS to write FTP logs (forces all entries in the log buffer to be written from the buffer into the log file):

Call the FlushLog method which works at the FTP site level. There is no control in the IIS Manager that calls the method. You can call the method programmatically using the sample code that is provided here: https://docs.microsoft.com/en-us/iis/configuration/system.applicationHost/sites/site/ftpServer/flushlog

How to programmatically determine if a user is authorized in an IIS Website

Enamul Kh-MSFT — Wed, 05 Sep 2018 06:49:38 GMT

A customer had a unique need of verifying authorized users against a website that runs on IIS. The code is short and simple if you know what component and method(s) to invoke.

using System;

using System.Collections.Generic;

using System.Linq;

using System.Text;

using System.Threading.Tasks;

using Microsoft.Web.Management.Server;

namespace ConsoleApp1

{

class Program

{

static void Main(string[] args)

{

string message = null;

string isUserFound = "No";

string sprovider = null;

string userName = "john.doe";

ManagementAuthorizationInfoCollection authorizedCollection = ManagementAuthorization.GetAuthorizedUsers("Default Web Site", true, 0, 10);

sprovider = "Provider: " + ManagementAuthorization.Provider;

Console.WriteLine("{0}", sprovider);

// Search the returned collection.

foreach (ManagementAuthorizationInfo authorizedInfo in authorizedCollection)

{

// Check to see if the user is already in the allowed users collection.

if (userName.Equals(authorizedInfo.Name))

{

isUserFound = "yes";

}

Console.WriteLine("Does John.doe exist? {0}",isUserFound);

Console.WriteLine("done calling Microsoft.Web.Management.dll. Hit any key");

Console.ReadLine();

}

Powershell ISE crashes on exit while using Microsoft.Web.Management.dll

Enamul Kh-MSFT — Wed, 05 Sep 2018 06:37:09 GMT

I was helping a customer other day on a stubborn crash whenever Powershell-ISE and Microsoft.Web.Management.dll are put together. While calling Microsoft.Web.Management.dll from Powershell-ISE or WMIprvse.exe, upon exit, it was throwing Runtime.InteropServices.InvalidComObject error while crashing the Powershell-ISE or WMIprvse.exe. Loading/calling the same DLL on the same machine from a C# console application did NOT exhibit this behavior. Error details from Event Log: - https://schemas.microsoft.com/win/2004/08/events/event"> - 1001 4 0 0x80000000000000 6366 Application MYMACHINE - 125883710853 5 PowerShell Not available 0 PowerShell_ISE.exe 10.0.10586.117 Runtime.InteropServices.InvalidComObject Runtime.InteropServices.InvalidComObject unknown System.StubHelpers.StubHelpers.GetCOMIPFromRCW Repro steps: -First verify that IIS Default Web Site is up and running without any issues (we will be referencing this site in the powershell script) -Launch Powershell ISE in admin mode -Run following commands one after another [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.Web.Management") if (-Not ([Microsoft.Web.Management.Server.ManagementAuthorization]::GetAuthorizedUsers("Default Web Site", $true, 0, 10) | ? Name -eq YourDomain\YourUserName)) { $false } else { $true } exit -ISE crashes. -Error logged in the Eventlog The solution: Replace the exit with [System.Environment]::Exit(0)

Enabling “Transfer-encoding: chunked” in the response header with IIS

Enamul Kh-MSFT — Mon, 26 Mar 2018 03:42:24 GMT

While assisting a customer on configuring ARR (Application Request Routing), we found that chunked transfer encoding was not working properly. After bit of workaround, we were able to fix it up. Here is a summary of the troubleshooting session. Quick Note: "Chunked" is a type of transfer encoding by which the message body is transmitted to the client as chunks that are stamped with the size of the chunks (see section 14.40 of RFC 2068). With chunked transfer encoding, the client can make sure that it has received all of the data that the server sends. Chunked transfer encoding is similar to MIME encoding in relation to Internet mail (see RFC 822). The specific differences between MIME encoding and chunked transfer encoding are discussed in section 19.4 of RFC 2068. To enable chunked transfer encoding, set the value for AspEnableChunkedEncoding to True for the site, the server, or the virtual directory that you want to enable chunked transfer encoding for:

Open a command prompt.
Change to the Inetpub\Adminscripts folder.
Run the following: cscript adsutil.vbs set /W3SVC/AspEnableChunkedEncoding "TRUE"

How to remove NEGOTIATE from IIS Windows Authentication

Enamul Kh-MSFT — Mon, 26 Mar 2018 03:26:48 GMT

I was assisting a customer just the other day who was having a dejavu of removing Negotiate from IIS Windows Authentication. After clicking the "Remove" button, if he restarted the machine, the Negotiate would reappear! This is because the setting is by default locked. You need to do from the IIS Configuration Editor. Here is how to do it:

Open IIS Manager (just type inetmgr.exe on your Start--->Run)

Select "Configuration Editor" under management

Change the Section to system.webServer/security/authentication/windowsAuthentication

Click on the providers item, and then click Edit Items on the right. Select the "Negotiate" item and click "Remove":

Click Apply

Alternately, you can do it from the command line as follows:

appcmd.exe set config "Virtual/path/to/application" -section:system.webServer/security/authentication/windowsAuthentication /-"providers.[value='Negotiate']" /commit:apphost

Server object error 'ASP 0177 : 8000ffff'

Enamul Kh-MSFT — Mon, 26 Mar 2018 02:59:58 GMT

I was assisting a customer who was struggling with this intermittent error. An iisreset would alleviate the problem temporarily only to resurface within few days again. This is the error details: Server object error 'ASP 0177 : 8000ffff' Server.CreateObject Failed ShowReport.asp, line 36 This problem occurs if a website that you browse is an Active Server Pages (ASP) page that calls a .NET-managed component. Note This .NET-managed component uses .NET interop functionality. Here is how we fixed the issue:

Click Start, click Run, type regedit, and then click OK. (NOTE: Registry changes can impact your server severely. You need to test this on a Test server first and only to promote to Production after adequate testing)
Locate and then click one of the following registry subkeys, depending on the version of Windows that is running on your computer. If your computer is running a 32-bit version of Windows, click the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_IGNORE_ZONES_INITIALIZATION_FAILURE_KB945701
Programs that are 32-bit and run on a 64-bit version of Windows operate in WOW64 mode. These programs access registry keys and values that are stored in a different registry subkey. If you are running 32-bit programs on a 64-bit version of Windows, click the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_IGNORE_ZONES_INITIALIZATION_FAILURE_KB945701
Note If the FEATURE_IGNORE_ZONES_INITIALIZATION_FAILURE_KB945701 subkey does not exist, you must manually create it.
Right-click FEATURE_IGNORE_ZONES_INITIALIZATION_FAILURE_KB945701, point to New, and then click DWORD Value.
Type w3wp.exe to name the new registry entry, and then press ENTER.
Right-click w3wp.exe, and then click Modify.
In the Value data box, type 1, and then click OK.
Exit Registry Editor.
Reboot your server.

IIS Manager shows Authorization warning when testing a Physical Path

Enamul Kh-MSFT — Sat, 24 Mar 2018 03:47:00 GMT

Time to time, customers ask us about this warning. This is a by-design "benign" warning simply telling us a verification has been deferred to runtime. This can be ignored in most cases. If you select your Application pool in IIS Manager and choose the basic settings, you will see following window: Now if you click on "Test Settings…", you may see a yellow icon next to Authorization section and a corresponding warning message as follows: Here is the warning details: The server is configured to use pass-through authentication with a built-in account to access the specified physical path. However, IIS Manager cannot verify whether the built-in account has access. Make sure that the application pool identity has Read access to the physical path. If this server is joined to a domain, and the application pool identity is NetworkService or LocalSystem, verify that \$ has Read access to the physical path. Then test these settings again. This is just a warning, not Error. Path authorization couldn't be tested at configuration time, but it will be tested at runtime.

Binding a Certificate in IIS using C# and Powershell

Enamul Kh-MSFT — Fri, 23 Mar 2018 22:29:43 GMT

Other day I was assisting a customer who had a unique need of binding a Certificate from within C# code using Powershell. A direct API call won't work due to some constraints, so Powershell was the other viable option. Customer also didn't want any Powershell window to pop-up, so we needed to code around it. Here is the code sample:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Management.Automation;
using System.Collections.ObjectModel;

namespace ExecutePowershell
{
 class Program
 {
 static void Main(string[] args)
 {
 ExecutePowershellClass pwrshell = new ExecutePowershellClass();
 pwrshell.ExecuteCommand();
 Console.ReadLine();
 }
 }
 class ExecutePowershellClass
 {
 public void ExecuteCommand()
 {
 using (PowerShell myPowerShellInstance = PowerShell.Create())
 {
 //powershell script to get version number and list of processes currently executing in the machine.
 string sScript= "$PSVersionTable.PSVersion;get-process"; //REPLACE THIS sScript WITH THE POWERSHELL 
 //COMMAND BELOW. BASICALLY BUILD YOUR OWN STRING BASED ON YOUR NEED

// use "AddScript" to add the contents of a script file to the end of the execution pipeline.
 myPowerShellInstance.AddScript(sScript);

// invoke execution on the pipeline (collecting output)
 Collection PSOutput = myPowerShellInstance.Invoke();

// loop through each output object item
 foreach (PSObject outputItem in PSOutput)
 {
 if (outputItem != null)
 {
 Console.WriteLine(outputItem.ToString());
 }
 }
 }
 }
 }
}

Powershell COMMAND to bind a certificate

# Import IIS web administration Module
Import-Module WebAdministration

New-SelfSignedCertificate -DnsName website.test.com -CertStoreLocation cert:\LocalMachine\My

$certificate = Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.subject -like "*website.test.com*"} | Select-Object -ExpandProperty Thumbprint

Write-Host $certificate

Get-WebBinding -Port 443 -Name website.test.com | Remove-WebBinding

Remove-Item -Path "IIS:\SslBindings\*!443!website.test.com"

New-WebBinding -Name "Default Web Site" -IPAddress "*" -HostHeader "website.test.com" -Port 443 -Protocol https -SslFlags 0

get-item -Path "cert:\localmachine\my\$certificate" | new-item -path IIS:\SslBindings\0.0.0.0!443!website.test.com -Value $certificate -Force

Note: You need to modify the hostname and binding accordingly.