Slashdot Mirror
Gartner Group Suggests Dumping IIS For Now
sachmet is one of the many readers who contributed news that "Gartner Group is now recommending that
IIS be replaced in corporate environments. This is based on the fact that TCO for IIS is rising due to the almost-weekly patches sent out by MS, and even then, it's nearly impossible to get patched quickly enough. Best part: 'Gartner remains concerned that viruses and worms will continue to attack IIS until Microsoft has released a completely rewritten, thoroughly and publicly tested, new release of IIS,' which they say has an 80% chance of happening by the end of next year." Gartner hasn't always said favorable things about Linux systems in the workplace, but the businesses that rely on this type of analysis to justify purchasing decisions may find this one interesting. Update: 09/24 22:04 GMT by T :As several people have pointed out, the 80% figure appears to be Gartner's odds that IIS won't be rewritten that soon, rather than the other way around (.673334 probability).
Gartner Group is usually not this anti-Microsoft, but given the events of the past week (who DIDN'T get hit by Nimda?), I can see why they're advocating switching, at least for the time being.
At work, we've been on-and-off contemplating switching a lot of our servers from IIS to something else. Our Linux and OpenBSD and Solaris boxes are all fine, but our unpatched IIS servers (the ones I don't admin, go fig) all got trashed. If you're gonna lose a day or two of work every month and you're paying the "cleanup people" $50 an hour or more, you can damn well bet you'll either start looking for new employees or new software.
- A.P.
"Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
Isn't it one of the greatest P2P app out there for automatic file sharing?
It is true though: companies relies on these reports to make decisions, so it's still relevant.
Just curious,
- RLJ
At least they appear to not be using IIS themselves, although their web-server has no indication of what server is behind it. This in itself indicates that it is not IIS.
Gartner wields a lot of influence, and this will raise heads. Congratulations.
gus
.. if only.
Of course it's easy to say 'replace' - just don't give any details and do some hand waving ...
:)
Although I am definately taking it down to the clusters' group and adding some more fuel for their fires
To be honest i'm surprised it took this long for a report like this to appear, I maintain a small network in a small company, we have mainly win machines except for one server and my laptop... the overhead on keeping the win machines patched (5 on the network) is crazy, I spend too much of my valuable time hunting down patches for machines.... luckily at the moment IIS is shutdown as all of the dev work is being completed on linux. however I have to keep the patches up to date otherwise I'll be spending a week or 2 updating the server in a month or so time.
Will MS really write a new IIS from scratch I doubt it, and if they did would it really improve on where things are now.... it would take n months to write, beta and then lauch IIS+ 1.0 then people would want to know it was ok, some would try it, but most people would want to see IIS+ 2.0 before moving their web applications to it..... timescale ? how long is a piece of string.... and would it be any better, would MS allow external code reviews (or opensource) to ensure that IIS+ was better / secure. I doubt it....
Regards
Dave
----
"Iceberg dead ahead..... oh sorry, only joking !"
A monkey in every office....
I've quit jobs due to PHB reliance on the morons over at Gartner.
"Unix will be a dead OS in three years." Quoth one, on his reasoning behind implemening MS solutions for the enterprise. (~ 1995)
An expensive Gartner "analyst" told him so.
Shoulda gave me that budget...
HooHa!
--
You sure got a purty mouth...
This is great but many companys can't switch easily because they have web apps based on ASP/ActiveX. Unless it's something small they are stuck since rewriting it isn't probably an option.
My PHB just saw this, screamed "MY PARADIGMS ARE MELTING!" and collapsed into a pile of goo. Many thanks to the Gartner Group!
And exactly what does IIS have to do with office?
Is it about time that the same is done with using NT/2000 as servers. Again both are loaded with bugs. Should all servers be move over to the more secure linux/unix..etc..etc.. operating systems ?
Cruise TT
The problem is not just that IIS is a vulnerable piece of crap. The problem is the point and click admins who can only run setup and never ever will check for patches.
So you ditch IIS and install Apache. Do you honestly think that the guy who couldn't be bothered to update it will be bothered to check for Apache vulnerabilities and fixes?
Yes, because you will have to ditch that guy! And your new unix-savvy admin will be more expensive.
Oh well, only a matter of time before they think of that. The product is only as good as it's admin, and certainly not better.
read the article, it says use apache or iPlanet. sheesh.. the article was out last week.. read first, then post.
using Internet-exposed IIS Web servers securely has a high cost of ownership. Enterprises using Microsoft's IIS Web server software have to update every IIS server with every Microsoft security patch that comes out -- almost weekly.
I imagine you would need to patch Apache fairly regularly as well. Its not like its immune to worms or security holes. In fact, apache.org was compromised this year due to a security hole.
I am in the process of converting from a Windows based web server to Debian/Apache, and the process is not without its problems. On the first try, Debian did not pick up both processors on my machine. Also, using mySQL, I can consistently crash my machine by trying to index a 5 million row table.
So, I have some problems. As you might when converting from Windows to Linux. Where do I go? I can't just call my Debian rep and ask him to help me fix my problems. I have to hunt for the answers and spend a lot of time figuring out just what the heck is wrong with my system.
So keep this in mind if you are switching because of TCO costs. Yes, you will need to patch once a week sticking with Windows. However, I don't think this report fully explains everything that may be involved when figuring out the TCO for a Linux system.
That said, I expect to be able to solve my problems and end up with a very nice server.
No, Thursday's out. How about never - is never good for you?
How much crack have you smoked today?
It's obvious you took a document about Windows and used a find/replace to change it to Linux.
The most obvious is the "crashes constantly" statement. What utter crap. Windows crashes constantly, usually for no apparent reason. The only times I've crashed my Linux box (SuSE 7.1) is when I am playing around with low level system configurations. I'm still learning Linux, so sometimes I do stupid things and don't know the proper way to recover (I'm getting better, though!).
Seek help. Your drug usage is destroying your brain cells.
-- Will program for bandwidth
I think this is a good indication of why you shouldn't just go with a single platform for all of your services. It may look good on paper, but the fact of the matter is that the Microsoft environment right now is so vunerable with regard to exploits, that it doesn't make sense any more.
This kind of attack can be seen in the ecosystem as well. If everything is homogeneous, then a single form of attack can do a great deal of devastation.
I guess the powers that be think that learning a new OS is bad, but it just proves "The Right tool, for the right job". Right now, IIS, is not it!
Not to mention "thoroughly and publicly tested". Hah! It's M$ for Christ's sake! Testing hurts the bottom line!
If at first you don't succeed, skydiving is not for you
More and more of these IIS "syadmins" (using the term loosely) will install Unix/Linux boxes, and forget about them, just like they installed the IIS boxes and forgot about them.
Then someone somewhere will find some little bug in some pre-installed convenience, some PHP shopping cart, some admin tool, some default password, something that comes on each machine. Then we'll have the same problem with some crazy Linux worm. And this time I bet the clueless M$-0wn3d media won't call it an "Internet worm", they'll be sure to call it a "Linux worm"!
Of course I could be wrong. Maybe Microsoft really can't code a proper webserver. But I think having sysadmins awake and at the wheel will help too.
Hmm, how about a web server that emails the admin saying "This web server will shut down in 15 days unless you run the up2date tool" or something similar? To force people to check for upgrades.
They DO NOT say that MS will do it with 80% probability next year. They say MS WON'T do it before then with 80% probability. This does not imply they will.
Sigh... Yet Another Blown Slashdot Editorial Comment...
Gartner recommends that enterprises hit by both Code Red and Nimda immediately investigate alternatives to IIS, including moving Web applications to Web server software from other vendors, such as iPlanet and Apache.
More info follows in their document. It is not very detailed, but they do explain themselves to some degree... just click the link to the cited document and read it.
They are a fairly respected organization, but will it be enough to sway IT department heads? Assuming it does, I don't think thousands of IIS servers are going to be swapped out tomorrow. So Microsoft has time to release a new version before everyone jumps ship.
Of course, releasing a new version opens up a whole new set of possible security flaws. Security quality assurance has never been Microsoft's strong point.
Vote monkeys into Congress. They are cheaper and more trustworthy.
Sorry dude, but regarding stability Linux is wanting. At most. My W2K and XP machines never crash.
Companies relying on IIS will most likely never dump it. I just started at a shop using ASPs, VB, and IIS with SQL Server. Top to bottom, a Microsoft shop. To convert all that VB to PHP/Perl/Python (yes, there are tools) is scarier for them than just staying with IIS and riding out the crashes, the viruses, and the constant reboot-to-make-it-go-away problems.
Better the devil you know than the devil you don't.
Most end-user business types aren't interested in what's technically superior. They're just interested in what's easiest. It's a time versus money thing; Microsoft gets them up and running faster in the short run. Once you start using MS software, it's a tarpit. It's easier and easier to continue to use MS once you have MS. And harder and harder to move to something better when all the problems start to appear.
A friend lost 3 work days last week (as did everybody in his company) when their systems got hit. He's been telling the boss for, what, three years now that IIS is a time bomb. Last week's events didn't convince the boss, of course - everybody knows windows is the only OS and IIS is the only web server so we have no choice etc.
I don't know whether to hope this report makes them reconsider - how is my friend supposed to feel if they run over and make Gartner-induced changes after his similar recommendations were repeatedly ignored just because he's a geek and we all know geeks hate microsoft but we smart business types know microsoft is rich so their products must be the best and I'm ranting and raving and need to stop now.
Um, no, the article says that a re-write is 80% likely to NOT occur before the end of 2002, i.e. only 20% like to occur.
Does anyone have a step-by-step manual for how to implement an IIS replacement? I have been riding the MS bandwagon for about 12 years now, and I'm finally starting to open my eyes to the alternatives now that they've proven themselves (this is my first /. post, by the way). My company uses IIS, but we don't use many of the features. We use the VPN, Web server (basic ASP queries against Access databases), and that's about it. I've installed Linux a couple of times, but only for testing purposes and to satisfy my growing curiousity.
To really get something out of the operating system, I need to be able to install and implement those features easily. The nice thing about IIS is that it's easy to install and administer for basic tasks for people used to the MS interface (most people that use computers). If I can be shown how easy it is to change to a Linux solution, I'd probably make the switch in a heartbeat. If nothing else, it'd cut back drastically on the number of patches/virii.
Any and all links are welcome!
As I read their article, what they're saying is that there's an 80% of this NOT happening before the end of the year. That's a pretty significant difference.
No offense... but they didn't say anything favoring Linux this time either. They said to dump IIS, they didn't suggest moving to Linux. There ARE other webservers for Windows.
If all this should have a reason, we would be the last to know.
C|Net ran the story here last Thursday (my submission to /. was rejected). The part I think is most important (emphasis mine):
.Net Web service that requires the use of IIS.
Gartner remains concerned that viruses and worms will continue to attack IIS until Microsoft has released a completely rewritten release of ISS that is thoroughly and publicly tested. Sufficient operational testing should follow to ensure that the initial wave of security vulnerabilities every software product experiences has been uncovered and fixed. This move should include any Microsoft
Maybe this is the chance for Mono Miguel has already seen?
Take a look at the data at:0 8/ index.html
.mil, and .br graphs!
http://www.securityspace.com/s_survey/data/2001
Since July IIS market share has been falling.
Check the
The share is flowing to Apache and Netscape servers.
Joao
Apache.org was comprimised due to a misconfiguration- not an exploit. Totally different. You could *not* write a nimda to take advantage of that.
"Gartner recommends that enterprises hit by both Code Red and Nimda immediately investigate alternatives to IIS..."
I think Gartner should be recommending an investment in competent IT staff if any enterprise was hit by both Code Red and Nimda, since the IIS exploits used in Nimda were the same as those in Code Red.
One of the biggest problems with getting Linux, OpenBSD, or any new OS widely adopted is that it costs a great deal to switch to a new system once a business has standardized on a different solution. So many corporations decided to use WinNT, and having made the investment need a great deal to sway them to something better. It has to be something very big, and these virii may do it. This could be good news for OS's competing with M$, because the investment thing works both ways. Once Linux is installed, companies are less likely to go back to Windows NT...
The article says that there is an 80% chance that there WON'T be a total re-write by year end 2002.
-Peter
Am I the only one who thinks this is the absolute wrong thing to do? As vulnerable as IIS has proved as of late, completely rewriting any piece of software runs the risk of not only reintroducing old exploits but possibly generating new ones. IIS is a very complex piece of software with years of thorough public testing (in the form of live deployments) already in place. By completely rewriting it, you throw out that experience and start from zero.
Come on!!! If APACHE was as widely used as IIS, they'd be writing patches weekly too.
If you're #1 in any market you have a target painted on your back by hackers. Period.
Why are the Honda Accord and Toyota Corolla the most stolen cars in the US?!? Is it because they are built wrong?!?!
Wow, then I tried to post this message and get a "Method 'POST' not allowed" error. Slashdot must be running on IIS, because no other webserver software is prone to problems.....
Why does the US Embassies in the Middle East keep getting bombed?!? It MUST be the fault of the Embassy builders for making their buildings "Bomb Prone"!!!
the overhead on keeping the win machines patched (5 on the network) is crazy, I spend too much of my valuable time hunting down patches for machines
.asp pages and custom server ActiveX objects then migrating from IIS is a fairly large expense. Even if you don't, the hassle of securely setting up a whole new web server is just asking for more holes to turn up. I'd be recommending companies don't ship at all, but pay attention to Microsoft's security bullitens (you ARE signed up, aren't you?)
Install Windows Critical Update Notification.
If it honestly takes you too long to visit the Windows Update web site once every week for the 5 machines, or get the users to visit the site and install the critical updates then there's a problem somewhere.
My Win2k machines WERE running IIS and had all critical updates installed. No Code Red. No Nimda. WTF is everyone else's problem? Even my web host which is running IIS didn't get hit.
As for rewriting IIS, it is a rather stupid idea. First of all the Code Red problem wasn't IIS at all, but the Index Server ISAPI DLL. Rewriting IIS will have zero effect on any of these extensions, much as rewriting Apache would have little effect on a bug in mod_php.
Honestly I don't get Gartner's points here - if you have a significant site with a large investment in
Fear: When you see B8 00 4C CD 21 and know what it means
IIS : Internationally Infected Servers
(who DIDN'T get hit by Nimda?)
I didn't. IIS can be secured -- many things that MS releases patches for are not exploitable if you follow sane security practices. Stuff like deleting all the ISAPI crap that comes in the default setup, and putting your web root in a nonstandard location (preferably on a different partition), deleting all sample files, enforcing proper filesystem permissions, and running any applications in an isolated process.
Of course, one of the advantages of Apache is that it ships in a relatively secure configuration by default, it's better for dummys who install stuff and plug it into the network without bothering to check the configuration. It's a whole lot better by default than IIS, that's for sure. Most of the MS patches are for various add-ons like index service that most people don't use anyway and should be shut off.
DISCLAIMER: I use Apache for the primary web server for the business I work at. We run IIS as the secondary server for load-balancing and have yet to be compromised by anything, even though patches don't always get applied immediately (usually pretty soon after release though). I think Apache is great, but want to point out that anything can be secured if you put some effort into it.
I was about to respond to this article, but Slashdot broke and wouldn't accept any postings and wouldn't let me log in for several minutes. Then, it continually timed out. Apache? Ha!
Love,
Bill
What would /. use for stories?
Think about it guys...1/2 of the discussion today involves MS.
If you guys hate MS so much why do you spend so much energy talking about it?
I'm still working on a clever footer.
This is LOOOOONG past due...
I think MS OWES it to the millions of users to take the entirety of their products off the shelf, and to keep them off the shelf until they are fully fully fully tested and THEN release them...
I'm tired of buying software and having to update it the next day because of 40 new security issues and then having to do it again the next week...
DEVELOPMENT time and BETA release time is when you should be scouring these monoliths of megabytes for their faults...not after MS as a company has INFESTED millions of computers.
"Just Smile and Nod." --Huck
so after weeks of everyone telling you to shutdown IIS b/c it is vunerable to such-and-such you are only going to listen to the Group? Blah.
;))
They have been told over and over to keep their software updated and patched yet they don't. What is going to start them doing it now?
I highly doubt that this is going to change anything. MS wrote a piece of shit software (go figure) and now the customers are paying the price (if they paid anything in the first place
I am sick and tired of seeing my logs flooded w/that crap. Fuck stupid admins. Anyone w/a brain can fix the problem. Give me the god damn job. I will make sure it ain't broken.
"Where do you want your security hole today?"
If you are serving static pages you could easily switch.
if you are serving up pages that are dynamic that depend on database connections and what not this might prove to be a bit more troublesome, particularly if you are addicted to ADO and VbScript, but doable
I think, however, you have no choice not to switch if you depend on COM components hosted in MTS and depend on MTS to handle transactions for you unless you wish to write your own transaction monitor for the next couple of months.
I'm still working on a clever footer.
Hrmm, let's see, you start with
I imagine you would need to patch Apache fairly regularly as well.
So, are there any other unfounded allegations in your imagination that you'd like to share with us? About how the sky is really purple, or the moon is made of cheese, perhaps?
apache.org [apache.org] was compromised this year due to a security hole.
Umm, and your point is? If Brinks' head office was broken into, would you claim that their armored cars are insecure as well?
Also, using mySQL, I can consistently crash my machine by trying to index a 5 million row table.
So use a real SQL database then. MySQL is a toy. At the very least you should try Postgres, if not Oracle.
I have to hunt for the answers and spend a lot of time figuring out just what the heck is wrong with my system.
I can tell you what is wrong with your system right now: It's run by someone who doesn't know what he's doing. You could easily fix your problem by resigning and recommending management hire someone qualified.
You must not be doing anything with them. Just in my office I've got 2 Linux boxes with uptimes in the months and they're running all kinds of services. Meanwhile, the corporate Exchange 2000 / Windows 2000 servers are now on a 2-3 day reboot cycle to keep them from eating up a gigabyte of RAM.
It doesn't have to be Linux.
You can run Apache on Win32.
Looks to me like they're saying there's an 80% chance of MS *NOT* having IIS rewritten by the end of next year...
In recent dealings with the latest worms, I found a tool from Microsoft called Hfnetchk that will, with a valid connection to the internet, tell you exactly what patches you do or do not have installed. They cross list them by article (eg Q123455) and also by another form (eg MS01-077).
We're running Windows 2000 Adv Server (yeah yeah, I know, but we don't have the Cold Fusion package for Linux) with IIS 5, and were having an average of 30-45 minutes uptime before getting blasted by the worm(s).
After using the hfnetchk and downloading quite a few patches (burn them to a CD, having to reload the system isn't out of the question, even if it is working now), we have had about 5 days uptime, and *knocks on wood* no infections, although the log says there have been attempts.
Even though I'm spoiled to the ease at which I can find Linux updates, I found that the tool was very useful, especially since Microsoft's site is so unorganized when it comes to downloading patches and updates (I want a list, not having to search for something, especially when it never works right) that this tool was a big time saver for me.
And they said zombies weren't real!
Your post has shown a lot more insight than that Gartner report which is unsurprising given the typical quality of Gartner's work. The main problem with IIS isn't that there are exploits for it, after all there are exploits for every major piece of server software from BIND to Apache to Sendmail. The problem is that there is no decent pathway to funnel patches to users of IIS.
I foolishly used to go to the Windows Update site to download all the security patches thinking that I was being smart only to find out after being infected by Nimda that Windows Update Doesn't Have IIS patches. Now considering that this is Microsoft's most central and visible update site plus the fact that IIS worms have caused so much damage over the past year, one wonders why IIS patches aren't on the windows update site or at the very least there isn't a site similar to Windows Update just for IIS?
Gartner is wrong for telling people to switch webservers because admins haven't applied a patch that is almost a year old (that's right, the CodeRed/Nimda patch is that old) because it is tackling the symptoms and not the root cause. Gartner should be bitching Microsoft out for not having a sophisticated update system in place similar to apt-get & cron but with a GUI for the clueless admin instead of asking people to blindly switch web servers as if the Ramen worm and Sadmind didn't affect non-MSFT platforms.
The more people who use non-MSFT platforms, the more worms we'll see on non-MSFt platforms. Instead of looking for the web server silver bullet, we shoyld be encouraging admins to take responsibility and do thier freaking jobs.
Uh, actually, the 5 vulnerabilities that Nimda exploited have all been patched for more than 3 months (one dating back to August of 2000). Maybe IIS shouldn't be used by administrators who have no clue what they're doing, but for people with somewhat of an IQ and the ability to patch their systems, IIS is a fairly good alternative to running another webserver.
Yes, my girlfriend is a BitchX
Hmmm, guess who won't be invited to TechED NEXT year...
--- Mercutio was right.
Do it.
If you celebrate Xmas, befriend me (538
Actually, what it says is that there is an 80% chance that a rewrite will not occur before the end of 2002. That means that there is no chances given that there ever will be a rewrite.
That a competently managed shop has well patched
servers and doesn't necessarily see the need to dump IIS. The problem exists at shops where the
computing environment is decided as an ideological
rather than a practical decision; and in such
cases, it will not be possible to switch until
the box explodes and burns the place to the ground, and perhaps not even then.
Does anybody have any stats on the time spent administrating Linux boxes vs. NT boxes, and how much time is spent learning the systems in order to administrate them at a competent level?
Imagine if business did dump all of it's IIS servers and replaced them with Apache - how many 'point and click' admins would suddenly be unemployed?
I mean christ, I hear people complaining about how complicated Apache is in comparison to IIS and I think to myself "if you can't figure this shit out, you have no business being a network admin because YOU'RE TOO STUPID TO DO THE JOB!".
Seriously, any network admin that bitches about Apache (which is bloody easy to use, in comparison to most previous tools) is too fucking braindead to be let anywhere near a server. Switching to Apache would at least show an organization where some of its dead weight is in the IS department.
Max
My god carries a hammer. Your god died nailed to a tree. Any questions?
Right now the MS consultants are making a lot off money off on these worms. But if enough corporate sites go to Apache on Linux you'll likely see a lot more worms/viruses/trojans writen for Linux and Apache. Sure these systems are more secure, but there are plenty of skilled crackers that will find a way to screw up these systems if there get to be enough systems out there. An let's face it. If the people who currently run unpatched IIS servers switch to Apache, there will be a lot of unpatched Apache servers. Right now Microsoft is the Apache advocate's best friend, because they attract the largest number of lazy admins. If this changes, you'll likly see a lot more attacks going after Apache.
IIS isn't the only problem. Since outlook treats users like they are stupid (hey, let me open this attachment for you) it has become my biggest potential problem. Users are going to be stupid so they really need an email client that is just as stupid (hey let me display this text for you and nothing else). I have a hard time stopping people from turning the Autopreview and Preview Pane back on after I go around and shut them off. Why does your email client need to be able to execute scripts anyway? Oh and let's not forget Outlook's ugly step-sister, Outlook Haxpress.
So does this mean that Gartner's website has been hacked?
I'm sorry what did you say? I couldn't hear you because I was busy getting ANOTHER FIRST POST in the new article. Maybe one of these days, if you keep trying, you'll be almost as 1337 as me. Until then, keep rambling garbage like "WHOOO HOOOOT!" and such so you can continue to sound like a raving homeless man with Down's syndrome in the subway station.
-The AC Avenger
Joel on software makes the case much better than I can.
href=http://www.joelonsoftware.com/stories/stor
When VPNs are outlawed, only outlaws have VPNs.
According to Mindcraft, Apache is the most widely used webserver- wanna try making that statement again?
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Rewriting is always an option. It's not a pretty one, but it CAN be done if you're dedicated enough.
Case in point - last year I saw the dead-end coming for my company's Enterprise solution, which was written in ASP/COM. The argument (er... *ahem*, discussion) I had with the higher-ups concluded that we HAD to continue moving forward. We couldn't wait 6 months for a rewrite (ambitious at best).
Fine, I said. Then let me do everything concurrently. Here's how it works:
Install Tomcat onto your Windows NT Server running IIS, along with JRE 1.3 and the HotSpot Server.
Link Tomcat in with IIS using the mod_isapi.dll you can get from the Tomcat site. Also install Tomcat as a service using jk_nt_service.exe.
Keep your Java session abstracted. The main session remains as-is within your ASP application. Write a bit of java.net code to hook in through a custom ASP page (note: security - ordinary clients can't access this page) to retrieve and update any session variables. This can be done by reading the ASPSESSION cookie, and spoofing it in your requests to IIS.
Any NEW components, write in Java. Remember - session variables get retrieved and saved from the ASP side still.
As you're working on new components, when you can arrange it, convert old components to Java one by one. Session still remains on ASP.
Wash, rinse, repeat until all components have been written in Java. Once this is done, convert your login into Java, and change your abstracted Session to be a Java session instead of hooking into IIS for the ASP one.
Voila. You are now 100% Java. Now get rid of IIS and switch to something else. This is the approach that my team took to rid ourselves of the VB horror that someone left me when I joined. It took about 8 months of solid effort, but it worked. We are now rid of all reliance on MS technologies from our site. We also managed to do it quickly because of good code layout, and the use of the most wonderful Velocity templates also available from the Jakarta site. This helped a lot.
The point is, you CAN do a rewrite. What you usually are NOT allowed to do is a code freeze. So... work around it! The beauty of this solution is that you are running two separate applications (technically) for a time. Keep a consistent look, and the users can't tell the difference between the ASP and the Java side. Change one function at a time, slowly, and eventually you'll reach the Utopia you're looking for.
You can accomplish anything you set your mind to. The impossible just takes a little longer.
Secondly, the timing couldn't be worse for Microsoft. With XP only just hitting the shelves, this has the potential to seriously cripple the uptake of the new OS. (Note: I'm saying "potential" as you're bound to get plenty of execs who argue that nobody ever got fired for buying Microsoft. Even when it puts the entire company's public profile at risk.)
Thirdly, this also comes at a critical point in time, with respect to the European Union anti-trust investigation, the British fair trading investigation, and the US' very own anti-trust Lawsuit Revisited. Should the market-share of IIS continue to grow at the current rate, competitors may be able to argue the case that companies aren't heeding the report because they can't. That could seriously jeapordise Microsoft's arguments that they are not a monopoly, and that "future threats" could affect their market-share.
(Let's face it - if this isn't a "future threat", I don't know what is.)
Fourthly, this comes at a time when the economy is seriously wounded, and yet Microsoft's pricing continues to rise. As other posters have noted, this might persuade some accounts departments to start pushing the alternatives.
Lastly, homeless shelters are still pretty full, from the collapse of the dot-coms. This makes computer expertise very cheap. ("Will Code For Food" no longer sounds such a joke.) Thus, there is really little need to hold onto "old hands", who command high fees. You could probably pick up a webmaster and a couple of ASP/PHP/Perl gurus by going to the local K-Marts and asking the people collecting the carts. They'd cost a fraction of what most companies are paying for their IIS expert, and they'd probably worship the ground the management walk on.
HOWEVER, this is purely speculative. Although what I've written is a plausable scenario, companies could equally well ignore the report, the anti-trust lawyers might deem it too tenuous to be usable in court (if they notice it at all), and Microsoft might remain King Of The Hill by sheer default.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
There ARE other webservers for Windows.
That's exactly right... there is Apache, which is a fine webserver for Windows. My public library just installed a new system which runs on an NT/2000 Server, uses a Sysbase backend database, web browser clients, and the http server on that Windows server box is Apache with perl modules.
Look, look. See, see
A feeling of having made the same mistake before: Deja Foobar
So what you're saying is they may find this one interesting since it puts down Microsoft, but they should disregard the others because they put down Linux? Just checking..
-- If no truths are spoken then no lies can hide --
There is no business-based reason to use IIS.
Does anyone know what Gartner has been saying about web servers in the last few years? Have they ever been pushing IIS?
- Sig this!
((Dis)-claimer: I used to work for a Gartner pseudo-competitor.) For Gartner to make that "80% chance of rewritten IIS by next year" claim, they must have some knowledge that an effort to do that is already underway, and is being promised privately to at least some customers. A claim like that out of the blue, with no evidence other than "MS should do this, in a perfect world" would not merit an 80% probability.
Where the info leaked from, I wouldn't know, although the most obvious source would be a Gartner customer who was already considering dropping IIS and then had MS promise them that such an effort was underway. So when the customer checked with Gartner about whether they were aware of such a rewrite effort in the works, Gartner poked around for additional confirmation and must have gotten at least some.
For a compatible IIS rewrite to be fully released in 15 months, I'd say it'd have to at least be in an "alpha release" state now and going to beta early next year. Just speculation, of course. A lot of testing is needed for complete rewrites if you want to retain any reasonable backwards compatibility. I presume that at least is obvious enough for Gartner to have factored that in.
Also, why precisely 80%? Well FYI, from what I've read, Gartner has an internal rule not to have probability figures in the 40-60% range, since they are too wishy-washy, and basically it indicates the analyst doesn't have much confidence in their prediction. Such claims don't make it past the editor. Most of the probability figures I've seen from them are 80%ish, with the wording presumably adjusted to make the claim fit at least that degree of certainty.
--Say you're a good MS admin and you ghave dutifully patched up your IIS machine and never got hit with Code Red or Nimda on your servers BUT your Win9x users who don't run Outlook (Express either) go to an infected webpage: How will not using IIS help?
.DAT files were'nt ready until the next day and the "Fix" is so-so at best.
--Yes the patch was there for months; but SARC (et al) was cuaght off guard,
--I"m not blaming anti - virus companies but I am confused how IIS is the sole badguy.
--You can get hit with this thing from many directions (assuming WinXX.)
--Gartner even says you "Can't Patch Fast Enough"
This
The problem is you will still have Admins and developers accepting un-reviewed default configurations for Apache or iPlanet - transferring the arena of vulnerability.
This article reinforces the notion that security can be achieved with the right purchases - rather that the right process and personnel.
jeremiah cornelius
"Flyin' in just a sweet place,
Never been known to fail..."
The submitter says that IIS needs to be rewritten, something that "[Gartner says] has an 80% chance of happening by the end of next year." This is incorrect.
The actual quote is: "Gartner believes that this rewriting will not occur before year-end 2002 (0.8 probability)." That means there's an 80% probability that the preceeding statement is true, and that statement is that MS will _not_ have completed a rewrite in that timeframe.
So instead of MS being 80% likely to fix the problem, they're 80% UNlikely to do so in the timeframe specified.
Ideology breeds Hypocrisy. Just how much is up to you.
Remember, Apache is released under a BSD style license. Therefor it would require little effort for them to re-write IIS since they could just use the code base from apache :)
This sig has been temporarily disconnected or is no longer in service
Do what I do. I'm too f-ing lazy to keep up with the weekly patches. So I spent a couple hours a year ago and properly configured my IIS servers, following the published checklists. Now I review bug after bug and say "ok, that one can't impact me so I'll patch it later."
There is no reason a properly configured but completely unpatched IIS 4 or IIS 5 server could not have survived both the Nimda and Code Red worms.
Nimda made use of the Unicode directory traversal bug, which only lets you move around on the drive where the web documents are stored. Move the wwwroot to another drive, set file permissions as tight as possible, remove the sample applications, and you would have been safe. Every one of those is on any decent IIS admin's checklist.
Code Red made use of a bug in the Index Server. Removing unused mappings is near the top of every decent IIS admin's list. In fact, one IIS server I have didn't have the patch applied when Code Red hit. I didn't bother to apply it until almost a month later.
This is admittedly an old story; I don't know if M$ is still legally implementing this particular "innovative" license restriction nowadays. Does anybody know?
There are other transaction server frameworks- many of them scale to larger loads than MTS could ever dream of being able to handle...
Products offered by:
IBM (CICS)
Sybase (EAServer, Jaguar CTS)
Unisys (WebTS)
Compaq (NonStop Java Transaction server)
SAP (ITS)
There's quite a few of them that work rather well- some of them, of course, require new hardware. In the long run, though, which is more crushing- the web site being down for a day or more or spending more than you initially planned fixing the problem?
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
I installed the OS, and it's been running ever since. The product, in this case, is better then the admin. I knew my limitations and chose an OS that I knew would be secure and safe to place on the net, and over time, I've learned how to activate more and more of it's functionality.
With MS, I would have had to install, then hunt for patches, then disable services that I didn't need. In that case, yes, the product is only as good as the admin. But this doesn't have to be the case.
take your sig and shove it
It's ok, tell him he can leverage his synergy and ride the crest of the wave onto the shores of linux
My Win2k BSOD's at least once a day. My linux box on the other hand:
4:05pm up 87 days, 21:17, 20 users, load average: 0.22, 0.13, 0.10
The windows box I use as a desktop machine. The linux box is running mail services, apache, tomcat, irc, DNS, etc. And incidentally the only reason that it went down 87 days ago is because I had some flaky memory which I replaced and it hasn't batted an eye since.
Oh, and my Linux laptop doesn't ever crash either should you care.
It means that businesses and people will not be using .Net until these security issues are taken care of. You can not have Internet security problems and then say "Trust us with your credit card numbers." People will not listen. They will go somewhere else. If Microsoft is betting the farm on .Net, they need to get these security problems taken care of. Otherwise they are toast.
Gartner and its ilk are mercenaries. They don't care for anything but money and attention in the most immediate sense. There's always another sucker down the road, these guys think. Well, you screwball liars, you and your cohorts on Wall Street, pumped & dumped the entire Internet economy. Neither you nor the big six accounting firms have much credibility left in the tech industry.
Microsoft should release patches, as often is neccessary to patch security holes. Don't pick on them for this. Pick on them for not remembering the KISS rule (Keep it simple, stupid), which would have avoided most of the problems in the first place.
System 1: IIS on Windows NT:
System 2: standard Mandrake-Linux distro with manual install of current versions of Apache, PHP, mySQL, OpenSSL and mod_ssl.
Now which system do you want to administer today ?
Flourescent (adj): smelling like ground wheat.
Jumpstart the tartan drive.
There is no reason for those point and click admins to remain ignorant, except all that MS BS about "new mindsets" and "completely different" aproaches to programing. I can only imagine how knowledgable and valuable some of my frinds would be if they had not wasted a good portion of the last ten years chasing ever changing MS interfaces, specs and patches. Rise! and free yourselves.
Remember, it's not your ability to manipulate a product that makes you worth something. It's your ability to poduce results from given resources.
Friends don't help friends install M$ junk.
Gartner believes that this rewriting will not occur before year-end 2002 (0.8 probability).
Big difference.
I'm sure I will be be trounced by negitive moddings just for suggesting that a Microsoft product works...however...
"This is based on the fact that TCO for IIS is rising due to the almost-weekly patches sent out by MS"
Bull. Yeah, because it's so amazingly hard to open IE, Pull down "Tools", hit "Windows Update", select "Critical Updates Package", a hit "Download".
Ohhhhhhh yeah. I can see how that's raising the TCO incredibly. Heaven forbit you have to hire sysadmins that know how to use Windows Update. *whew*
Come on... That's such a load of crap. Keeping IIS patched is so amazingly simple. Heck, just install the "Critical Update Notification". When the little globe appears in the task-bar, click it (and it pops up little tooltip notifications until you pay attention--for those more dense sysadmins) and it will automatically take you to the WIndows Update page with Critical Updates selected. Double-click globe, hit "Download" button. Man... Hope I just didn't raise the TCO of IIS by explaining this super-complex process that will require everyone to get new certification and spend days perfecting their technique. *rolls eyes*
-Jayde
What's a sig?
Yeah, that's right kids... when it's pro-Microsoft, Gartner are paid shills. When it's critical of Microsoft, Gartner are an unbiased research agency deserving of our undivided attention.
Step-by-step docs aren't worth dick. They exist, and they tell you how to get one specific task done (get Apache running / install PHP / get CGI to execute etc), but that is about it. You get the job done, but you will probably do it in an dumb/inefficient way. I bought Apache - The Definitive Guide when I found the the step-by-step manuals inadequate, and boy do I love that book. It took a couple of days to read and it was extremely informative and interesting. I ended up doing a complete overhaul on my site and things are a lot cleaner now.
How much do these academic, suit-wearing monkeys earn again?
were having an average of 30-45 minutes uptime before getting blasted by the worm(s).
After using the hfnetchk and downloading quite a few patches (burn them to a CD, having to reload the system isn't out of the question, even if it is working now), we have had about 5 days uptime
Pardon me, but what the hell are you running on your systems to get such lousy uptime? I know it's chic to blast windows uptime on slashdot, but I maintain our NT 4 servers at work, and our main production server runs IIS 4, SQL Server 7, Rockliffe MailSite, Webmaster ConferenceRoom IRC server, among other things, and our uptime is measured in months. Our website is not super-busy, but it's not slow either.
I think the most insulting part of that advert is "Proven round the clock reliability". Proven what? It's new, it hasn't proven squat. Once it stays up over a year, at least, then it's proven. Until then it proven to be a misleading advert.
BTW: Proven means if I'm a web store, my IIS isn't down for more the 5 minutes a year (Five 9s). Fat chance of that happening.
Many of the critical patches for IIS are an entirely separate, often CLI versioned, process. Windows update does a great job of most patching, but it doesn't extend to IIS.
I believe you are correct with that analysis. Should it have read:
"there is a 20% chance of MS rewriting IIS by the end of next year"
-- these are only opinions and they might not be mine.
My question is why can't MS just write code that auto updates itself from a patch database at MS every day instead of depending on users to do the updates themselves. Heck. Even doing a windowsupdate utility that fires off a warning stating there are patches available for your IIS server instead or making them hard to find or not knowing what ones you need to keep your IIS server updated.
This is insane! Why does MS need to make it so hard to keep your web server or your customers web servers up to date. Tools and automation could simplify it. Its not that hard.
Understang most users keep a simple IIS server just for webaccess. They don't run websites or ecomerce from them. Its impossible to keep they all up to date without some help or windows updating tools.
This is a real suggestion: look at Apache/PHP/mySQL running on Mac OS X. I'm an ASP programmer that has discovered PHP, but get floored by intertacting w. Linux. OS X Server is easier that NT/2000, with the strenth and flexability of Linux...
I use SecureIIS... a kickbutt app. Written by the guys who discovered most of IIS's shortcoming's.
No Nymda
No CodeRed
No Overflows
Its easy to install and configure. N-E-1 who runs IIS can afford this app.
Check it at
eeye.com
Huper the Sysadmin
I think it is obvious. debian, apt-get update/upgrade nightly. and you are set.
*poof*
What comes first, finding a teacher or becoming a student?
If there's anyone reading this who's in charge of "decision-making" at the "enterprise level" --
/. but by almost every pundit on the web. Where was Gartner? Wouldn't it have saved you a ton of money if they had pointed out the probability of problems with security and patching in 1999 instead of late 2001? Isn't it amazing that they were near last to the table with this finding?
The question you should be asking yourself is not "Should I be replacing my IIS systems with Linux+Apache?" but, rather, "If I am relying on Gartner for recommendations on conditions in the future, why didn't they see this coming a year ago?"
Well more than a year ago, the security benefits of open source were explored not only by
Why does Gartner put probabilities on their expectations without showing their work? Does anyone go back in history and look at these probabilities?
Doesn't Gartner have an interest in pressing the solutions that people expect them to press? And here's a HUGE question... if you're using the exact same solutions as every one of your competitors, are you prepared to give up the idea that IT could give your company a competitive advantage? Do your bosses agree with this?
Meet in person? You do realise that means you would have to leave your house, don't you?
Its a big, scary, grown up world out here kid. Pace yourself.
It seems to me that IIS (and Win2k server) has two main problems.
1. It ships with everything enabled by default.
2. The number of security patches you need to apply to your servers on an ongoing basis.
Why can't Microsoft write a tool to make both of these tasks easy and painless?
When first run this app could list everything turned on by default, tell you what it does then give your the option to turn it off. This app should be able to drill right down to individual ISAPI extensions & sample code.
The app should also come with a service that acts like the HFNetChk tool, but works automaticly: At a specified time period it should connect to microsoft's update servers, D/L the patches, e-mail the administrator telling them that these patches are now available. The admin opens up their Microsoft Security Console, which shows all servers, what new patches are available the admin click a button to apply patches....
Yes: an admin can (and prob. should) do all of the above manually, but at the end of the day, a set of apps like this would go along way to improving IISs reputation)
file...wow
start--> run --> http://www.freebsd.org/doc/en_US.ISO8859-1/books/h andbook/install.html
Read, download, install. 1 simple patch.
At least where I work, it has been a complete joke recently, losing 1 or more days each time a new virus comes out because our sysadmin can lock the system down enough to not give any of us any sort of admin rights on our computers but not enough to stop the spread of all these virii. The fact that we don't have a good NA compounds the issue of MS products being rushed and barely usable at best. MS has written some good applications, but they have not QA'd them enough to release them. Maybe they will start looking into their release process.
Replacing IIS in the corporate environment? Not going to happen any time soon. Why? Here's why:
I try to keep an open mind and I have been actively working on getting most of my apps working under Apache/Red Hat Linux.
I hate the fact that my IIS boxes are such easy targets and I hate the fact MS doesn't give a shit (if they released SP7 for NT4, it would've helped a lot of people out there).
I don't have a choice, but I'm keeping my options by playing around with Apache. Who knows what tomorrow may bring?
I'm not a MS-flunkie and I'm not going to rely on a corporation who doesn't security seriously.
POKE 53281,1 POKE 53280,0
You don't need the browser on the server. You need some of the HTML related libraries on there that only get shipped with the browser.
Your question should really be "Why doesn't Microsoft ship a libhtml.rpm type of package instead of making us install IE(n+1)?".
The browser is no more "built-in" to the system than Konquerer is built into Linux (it's a user mode HTML renderer that the default GUI shell uses).
Fear: When you see B8 00 4C CD 21 and know what it means
I am a NT 4 and Win2k MCSE (can't believe I am admitting on /. I should post this Anonymous Coward.) I take every chance to remind the high-ups that blindly choosing one platform for all network functions is a BAD IDEA. Lets face it - if there is one thing *nix platforms and Open Source apps can do, is provide a QUALITY piece of infrastrucutre software.
Conversely, large applications (ERP's, N-tier web interfaces blah blah) work better on NT (generally) because the API is friendlier to your clients (which are naturally running MS.) If you don't believe me, try installing Sybase Enterprise Application Server on Unix and get clients to save files and print locally.
Being a Business major, I understand what MS brings to the table in TCO - mainly that they will always have the lights on, but so will Sun, HP-UX, and possibly Red Hat. The truth of the matter is that the OS level is going to be smaller of concern than the applications that run on them. I think that any PHB that decides on a platform across the board is managing from the advertisements in CIO magazine. I say you define your network logicaly and wisely pick your physical model utilizing the best solutions for each problem (infrasturucre = Linux, Database = Sun / HP-UX etc., App servers, desktops, misc servers = NT/2K.)
They can find personnel who know both well, and command a higher salary - or have redundant admins because you hire unix admins who have such a disdain for MS they won't touch it and the MS admins who have no clue about Unix. It may cost more, but tough luck - cost of doing business.
--cgeek--
Jesse Wolfe Sr. Manager Systems Integration
IIS requires the Server version of NT or Windows 2000, which is much more expensive than the NT Workstation or Win2k Professional (aka win2k workstation).
Apache will run just fine on the workstation version of the OS- and with a little tuning in the registry the two OS versions are virtually identical.
Yeah, my bad, sorry. I read that as an 80% probability that somethhing will be done before the end of next year. Sometimes it's not so clear if you're not devoting 100% attention to it...
APACHE is the worest web server I have seen on the market. The other open source servers lack.....(WORKABLE SOLUTION) The open source aplications are weak substandard pieces of crap. If they were truely functional, iis would not be as popular right now...IIS rocks and is solid and strong. That is why Slashdot will be converting over to them tomorrow.
Fact: All OSes and web servers have remotely exploitable vulnerabilities
Fact: The scum that write these worms will target the most popular platform to get maximum impact.
Fact: IIS holds a lion's share of the web server market for corporate installations and business
Fact: There are a bunch of incompetent sysadmins out there who can't take the five minutes to follow MS' IIS Security Checklist (which would've foiled Code Red) or apply SP2 (which would've foiled Code Red II and Nimda)
So, if we all dump IIS and go with, for example, Solaris+IPlanet, or Linux+Apache, the same lousy SA's will still not apply their patches and the Scum will not be writing worms for Linux+Apache or Solaris or whatever.
The _REAL_ solution is to get people to be smart about installing Internet servers and make it dirt simple on all platforms to apply patches (MS has made great strides in this with the Network Hotfix Checker and the soon-to-be-released HF auto downloader).
Blaming MS for lazy sysadmins isn't going to help anyone.
The problem is that you can't trust MS's patches.
Personally I trust script kiddies even less. If I see a published bug that allows root access from remote sites I close the damn thing straight away.
I remember SP6 very well. Downloaded the SP6a patch and had my eval boxes working before I deployed. There is NO excuse for waiting three months with an open root compromise though.
The proper action with CRed and Nimda isn't to rush to patch the server, but to change the firewall to prevent malicious requests.
No. By the time you've done this it is too late - the worm has already hit you. If you'd applied the patch (even taken a week, hell a month even, to evaluate it) then you wouldn't have to firewall things after the fact.
To do otherwise is to risk having to reinstall the OS (without the patch) to get your servers working again.
You don't reinstall after a root compromise? What sort of admin are you?
The risk of patching a single file or two with a hotfix (which saves backups anyhow for rollback) is significantly less than having your server root compromised.
Fear: When you see B8 00 4C CD 21 and know what it means
That ad also ran in DDJ a month or two ago. So what's your point?
Its the Microsoft "all-in-one" solution as much as it is the server. Once you get into asp, activeX, etc you're entering a more patch intensive environment. Patch the IIS, patch the client, patch the OS, and so on.
Granted, a bad admin is a bad admin, but if you had to hedge your bets you'd also go with Apache. That's what the Gartner Group does, it tells you where to place your bets.
The most important factor is the estimate of future exploits. For IIS its pretty high, for Apache not so much.
In MS's defense their new securty tools are pretty nifty and there has to be some kind of boiling point where even the lowliest user knows the importance of patches after the 10th time their machine has been wiped due to a virus. That day may never come, or it may be next week, but no one is holding their breath.
Apache runs just fine on NT, as do many other web servers such as Notes, Websphere, and others. They aren't telling everyone to dump Windows NT and IIS, just IIS.
As a rock-in-roll Physicist once said, No matter where you go, there you are.
Seriously, this tool is junk. In building a 4.0 server today I applied sp6a, and the post-sp6a rollup, only to have hfnetchk.exe warn me that 4 patches were missing. So I search MS for the patches, only to find that they were included in post-sp6a. Wanting to be on the safe side, I download the individual pathces and apply each one, rebooting after each. Then I run hfnetchk.exe again and it wans me about the same 4 patches.
Can you say BUGGY MS CRAP?
anyone else notice that "nimda" is "admin" backwards?
Service packs can be even worse -- by the time the OS is re-stabilized, the service packs are usually hopelessly out of date, the documentation for them fluctuates almost daily, and very few of their support sites or personnel seem to accept the idea that honesty is the best policy, instead relying on corporate supplied FUD and arrogance about market share to tell the unfortunate user(s) that "it must be their machine, because we don't see that kind of problem here in Redmond..." [insert obligatory ostrich photo here.
Gartner's point isn't that the WinXX OS's can't be kept stable, it is that the TCO (total cost of ownership) for the software and endless admin chores do not compare favorably with other choices any more.
I agree: my life is about ten times simpler since I dumped M$ products for everything except a few non-essential word processing, spreadsheet, and imaging apps on one M$ workstation so that I can exchange files with clients when they need M$ based softcopies of project data, etc.
...Open Source isn't the only answer -- but it's almost always a better value than the alternatives...
I must have posted this at least a dozen times to /. alone over the past few months. It's been posted to ntbugtraq and every other support mailing list.
R el easeID=24168
Here it is, one more time. Live it, learn it, love it.
http://www.microsoft.com/Downloads/Release.asp?
Besides as of right now there has been any major patches for about a month and you just need to do Win2k SP2 plus the August hotfix rollup. Over WinNT4 SP6a plus a similar rollup hotfix.
Trying www.gartner.com...
Connected to www.gartner.com.
Escape character is '^]'.
HEAD / HTTP/1.0
HTTP/1.1 200 OK
Server: Netscape-Enterprise/4.1
Date: Mon, 24 Sep 2001 22:12:25 GMT
Content-type: text/html
Content-length: 0
Connection: close
The issue I have is that we have many applications running on IIS/COM and everytime MSFT adds a new patch, then we have to retest every application. Assuming a 4-6 week testing/release cycle, I cound employ people permanently just releasing patches. The question is would it be different on any other environment (LAMP, SUN). Would the cost of converting all applications be worth it?
Say, 1/2 of the applications running on IIS/ASP be converted, will we suffer from the "toilet seat" theory. (For those who do no know what that is, it states, if you invent something invent the best toilet seat thus you can sell it to everyone since everyone has at least one toilet - yes there is a mercedes corollary) If LAMP becomes popular, and because of its open source nature, would people then attach it?
These are the questions I am supposed to give an answer to my managers by tommorrow morning, so the timing of this article and couldn't be anymore relevant.
Larzgold
btw - when my life theory site is up, I will let you know so you can learn about my stupid theories
moreover, we're even willing to help some good netizens to help themselves, by offering this easily recognizable set of URLs, to help get started, spreading even more good news.
has anyone seen these guys lately? no wonder the felonious bad toll LieSense scam is failing.
Yes, Apache is based of the NCSA webserver and was derived primarily from a base of patches to that original server. It's name was derived from the original incarnation being referred to as a "patchy webserver". Or so the lore goes :).
So it's quite possible that IIS is based in some part on the original NCSA server but not certain.
This sig has been temporarily disconnected or is no longer in service
I am amazed that people give Gartner, Giga and the rest any credibility at all. We don't hire them to make impartial analyses of the market. We hire them to push our product. If they concluded that the competition was better then they would never get another gig from us in the future.
What is amazing however is that the same people who purchase PR fluff then go and read other people's PR fluff and believe it.
People who really know about technology don't spend their time writing PR fluff for Gartner etc.
The idea that companies using IIS can switch to something else simply because security maintenance is lower cost is pretty idiotic. If you have an IIS site you are almost certainly doing so because you have a reason and will probably have a non-negligible switching cost. If you have developed ASP scripts you can't just switch to Apache overnight.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
This is hardly possible, since AFAIK, IIS is the only server which can parse asp scripts, which is why these morons are running IIS. There are thrid party options to run asp on Apache, but they are exorbitantly expensive.
Be aware, that 'goo' is considered a hazardous waste, and must be disposed of at an authorized facility.
I recently installed DirectX on my sister's PC so her kids could play a particular game that required it. After four hours of downloading, installing, re-installing, upgrading (of course you can't uninstall DirectX - amazing...), changing sound card, upgrading drivers, etc, the PC was left with no sound in ANY games at all. This is a classic - Microsoft makes it 'easy' to upgrade and your system is left in a mess that can't be undone without a Windows re-install.
With this sort of philosophy, it's easy to understand why IIS/NT patching is also a mess.
I'm in the position at my place of employment that I have to ensure the uptime of all our IIS boxen. We've yet to be infected by one worm or have any security compromisations of any way, shape or form.
.asp and .asa and you are pretty right. I mean who here has actually used a .idq file and couldn't survive without them?
This isn't because I'm on top of security patches before they are released, it's just a basic principle I learnt before I even knew what a sysadmin was... dont run anything you dont have to. Admittedly out of the box IIS is a pig and full of holes, but remove the default website, the administration site, and all script mappings except
Glenn
The Smrt way to trade CFDs on the ASX
The uptimes that I listed were after fresh OS installs, meaning that the initial worm attack caught us off guard... (I'm a linux sysadmin who was told to manage a Win2k box)
Also, just because the server is running fine doesn't mean that you shouldn't reboot it once in a while. It frees up memory, clears bogus pointers, etc.
If your uptime is measured in months, maybe you should stop comparing uptimes like the jocks in the lockerrooms who compare the sizes of their 'equipment'. It makes sense to cycle any windows box (server or not) relatively frequently. Not doing so is just poor administration. (Only because Windows has poor memory management and garbage collecting.) My linux webserver has an uptime of going on 11 months, and that was only because I moved into a new office. Couldn't turn down the window.
And they said zombies weren't real!
Hmm, weird, trying to change the password brings up the download popup, lol, maybe they should use IIS instead?
:wq
Onki --
The truth is, IIS isn't a bad web server. Why everyone makes it out to be is beyond me. Everything has exploits. Everything is going to have "patches" or "fixes". If you properly configure your IIS server (remove "internet printer" ISAPI driver, default directories, etc.) and make sure security measures are in place (Running OS on a different partition/security than the "inetpub" partition).. and keep up with the patches (by checking Shavlik's personal security advisor or by using Microsoft's HotFix checker) you'll be fine. It's amazingly stupid that the patches to protect against CodeRed came out almost a year ago, along with patches to protect against NIMDA. It's ridiculous if someone, who is knowingly running IIS on a server (NT4 or otherwise) does not keep up with such fixes. Now then again, there are a lot of people who install Win2k with default options.. and that includes IIS (I believe so anyhow?).. and in that case, the user most likely will not know to keep up with patches/hotfixes. Then again, Windows 2000 isn't a "consumer" OS, it's meant for a business environment where hotfixes/patches/systems should be managed by an IT staff.
Not All Who Wander Are Lost
Here's how I look at it (and with one IIS box on the Internet at a colo location, the rest being UNIX or Linux).
.shtml, .asp, and .pl. Period. I have one DLL allowed, and that's SDIIS.DLL, for RSA AceServer authentication, and that's done in a virtual directory with its own mapping for just that dll. The rest of it that I deleted is a gaping large maw of security hell and buffer overflows like Index Server, .htr files, and .idc files.
:). If people install Red Hat with a default install instead of IIS and think switching to Linux solves their problems, someone will make another Ramen worm.
1. Most of IIS you don't need. My script mappings in IIS are
2. My web root is not in the \inetpub directory.
3. ALL extraneous services are turned off.
4. ALL web directories except the site's are turned off.
IIS is an insecure piece of crap in its default install, but Apache and Netscape/iPlanet can be as well.
It's a matter of actually auditing your systems, whether they run Linux, NT, or some other OS, and making sure that you audit them properly and only allow what you need. Make sure the system serves its purpose. And make sure IUSR_ only has read access to \winnt, and only gets create/read/write access to \winnt\system32\logfiles. Period. You also want to make sure it has read access to its webroot directory, and no ability to write anything except to that one logging directory.
This was not an issue of the virus. This was an issue of poor adminstration.
I just went through 3 days of logfiles from that NT server (4.0, SP6A, with over 50 hotfixes ARGH!), and because we followed some basic configuration guidelines that come naturally with Apache admins apparently, we had 17,000 attempted break-ins, and 404's for all.
You can't point and click your way to good security. It's a matter of making sure that you only allow in what you want, and making sure the patches are THERE.
Apparently this isn't a problem with some Linux distributions, especially Debian and Slackware, because they actually care enough to not install many things you do not need. Red Hat is another issue
It's not just an IIS problem. It's an administration problem. People have to be educated to not turn on world+dog with their web server, and keep up with patches, or else this happens. I hope at the least it causes some admins to realize that ANY OS+Web Server must be configured properly before putting it out on the Internet for public view, because not even a PIX is going to protect you from bad configuration.
I have a Win2k Server sitting next to me that has been up (really fully up) for almost a year. If you know what you're doing, you can build a stable and reliable server/box in Windows. Fairly easy actually. It's running IIS, Exchange, and SQL server. Gigabyte of RAM, P3-800. ASUS P3B-F motherboard. The Intel i440BX chipset rocks.
Not All Who Wander Are Lost
I would like to avoid installing source code. But sometimes you need to correct things immediately (PHP, mySQL) instead of waiting for the official updated packages to become available, or the distro simply does not offer what you need (the mod_ssl, OpenSSL and Apache combination).
You're not the only one in suggesting Debian over Mandrake, which, I agree, seems to be positioned more for desktop use.
But for now, I'll just try to keep the uptime going.
Flourescent (adj): smelling like ground wheat.
What was that sound?
That was a paradigm shifting without a clutch...
Do a google search on second system syndrome.
I work at a large silly valley employer who just
found out yet again that this is just as real an
effect today as it was 25 years ago.
MS also provides a tool called 'QChain', which allows you to install patches without multiple reboots (a valid gripe elsewhere in the parent thread). It's available here.
Inertia is Microsoft's greatest advantage and selling point. At this stage in the game, I don't see them winning back any ground they lose.
Aren't these the same guys that said you could save a ton of money by switching from PCs to Sun's Java Network Computer.
[VBScript talking to COM objects; hardly bleeding edge technology]
.NET, they are soon to be Legacy technology.
With the impending arrival of
First, if it were a "pay per play" I'd be far more interested in seeing it work properly than I would be if I were just clicking a box that said "Install web server?"
Second, attacks would make it much less likely that anyone would pay for their product until it was far more secure.
The same would be true for the other virus-prone applications bundled with the Windows operating systems: I wouldn't consider Outlook Express if I had to pay for an e-mail client, especially with all the viruses that it retransmits. Internet explorer? There's not a chance I would purchase an ActiveX container for surfing the web, but since that big blue "e" is already sitting on the screen and doesn't take me a half hour to download, sure, I'll use it.
And now the D.O.J. has dropped their only chance to prevent the tragedy from repeating itself on XP.
John
1) Microsoft Makes Shitware
.CHUMP
DUH! That's been a well-known fact for over 25 years, and Gartner only figured this out lately?
2) Only Dumbfucks Use Microsoft Shitware
How many times do you have to fuck a loser in the ass before he finally says "owwww"?
Gartner finally said "owwww." Losers.
Dumbfucks like Gartner are why Macroshit has been shitting giant turds on the entire computer industry, turning what used to be a respectable industry full of talented computer people into a point-n-drool clusterfuck of rampant stupidity.
Oh well, better late than never.
Oh yeah, one more news item for ya Gartner:
3) BOHICA
Bend Over, Here It Comes, Again
The new Macroshit licence model will hopefully put Macroshit out of business, but not until they've reamed not a few dumbfucks in the ass so hard that the victims also go out of business. Anyone dumb enough to base their business model on Macroshit products doesn't deserve to be in business anyway.
.NET should be called
Gartner Jizz-On-Face Group finally woke up, with their face covered with more glaze than a Krusty-Kreme donut, and an asshole that hurts. Big surprise there... NOT!
Winbloz XP eXtreme dumbPhuckery
Q: How many MCSE's does it take to solve a Winblows Problem?
A: none, they Must Consult Someone Else
definition:
MCSE: (noun) Macroshit Cock Sucking Expert;
1) a person who sucks Bill Gates' dick 24/7/365, which is more cock-up-time than any Macroshit product.
2) a synonym for 'Shit For Brains'
3) a person who has no concept of how computers work, doesn't want to know how computers work and only knows how to roll a mouse and cash a paycheck.
blah
Gartner FINALLY woke up.
Too bad they've been sucking Macroshit cock for so long now that no one takes them seriously anymore, except for dumbfucks who are cock-fed jizz-jockeys like them.
All I can do is laugh at them:
HAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA!!!
SUCKERS!!!
Piss On All You God Damned Queer BillGates-DickSuckers!!!
Here's some props for my buddy John Ashcroft:
Jail Microsoft for selling shit.
The real problem here is that M$ will never be able to keep up with the # of hacks against it's product base - and as noted, these are relatively unsophisticated hacks.
.001% of them working on base hacks, the entire infrastructure built on the M$ business model is in serious jeapordy. (I'm beginning to suspect the port of .NET to GNU was solely in hopes of having a port to a platform that actually WORKS!)
Do the math, and I'm afraid you'll find ~ 500 million users on the net, and with just
In the future, closed source servers are looking like a very real dead end. You can't keep enough programmers on these projects with the M$ beauracratic bottlenecks to actually make a dependable product last for more than a few weeks unmolested.
Even as a unix/linux admin, this worries the hell out of me. The US gets billions of dollars injected into the economy via M$, and I, for one, don't want it to take a nose dive despite my horrible opinion of the platform.
Can anyone suggest a way for the company to survive in this field, short of opening the source for peer review and massive alteration? I've been considering the problem since I dumped my MCSE and started working on real server platforms, and I'm still stumped on how you make it work, real time, without the injection of half a million programmers/hackers.
TIA
Chris, Anonymous Coward at large.
I have a bunch of IIS servers behind a linux box running Apache as reverse proxy. It filters all malformed URL's and so far no hits by any worm.
This can be a pretty good solution to all these corps stuck with ASP sites while they migrate to JSP.
HTML is obsolete. It's time for a new, simpler and richer markup language.
It's spelled check here in the States.
Your quest for a nice server will be a lot easier if you dump MySQL. With the amount of data you are handling you *need* PostgreSQL.
Don't want to start a db flame war, but come on, you've read about Tim Perdue's experiment at Sourceforge.
MySQL is convenient but thats about it. Otherwise its just a speedy SQL frontend to the filesystem.
PostgreSQL on the other hand is a real, bad-ass, ACID-compliant mother that is almost ready to go toe to toe with Oracle.
What? The TCO for IIS is rising so just....spend alot of time and money to switch to another web server????? Does this make sense? Who pays for the migration to another platform? Who pays to rewrite all the ASP stuff in Perl? I love these "business consultants". Lower your TCO by spending a crap load of money. What happens if/when apache becomes insecure? Big corporations can't just deploy different web-servers every other weekend!
-ted
- Download and install PHP for IIS on Windows.
- Convert your ASP pages to PHP (using ASP2PHP).
- Get it running on IIS.
- Replace IIS with Apache (still on Windows).
- Replace Windows with some secure Unix lookalike or other.
I haven't used ASP2PHP myself so I can't say whether it works or not. It's GPL though, so try it out if you're interested.Cheers //Johan
Installed the Bubblemon yet?
Finnaly this makes an argument that can be used to show it to managment. I already forwarded that article tou my boss. Maybe it helps. At least it is good to know that Linux now gets support from groups like Gartner, that are considered more than a "hackers" view.
Anybody else realize that "hfnetchk" is just a bad-ass program name? It looks like it could be Russian, but it's just some bastardized English abbreviation.
Damn I love MS sometimes.
Though I really wonder about their dedication to user-friendliness. I don't even know what the "hf" stands for, but even "HF Network Check Tool" would be much simpler for the end-user.
And don't you dare say it's because of the 8.3 limitation. This is NT/2000 software here. Any filename restrictions that OS has is strictly ornamental. (Well, for backwards-compatibility, but for my purposes it might as well be vestigial organ #37)
± 29 dB
"But if enough corporate sites go to Apache on Linux you'll likely see a lot more worms/viruses/trojans writen for Linux and Apache."
/. is a link to a site where the survey indicates that Apache is in use by roughly 60% of sites and IIS is less than 30%.
I'm confused. Elsewhere on the front page of
With Apache having a larger market share (by 2 to 1), wouldn't Apache be more likely to be attacked? Or is there some other reason why we don't see as many exploits on Apache? Perhaps because it's designed to be secure instead of to be everything to everybody and be incetuous with the Windows OS?
I guess you're differentiating between servers running corporate sites and private/non-profit/etc. sites, but since Apache has the larger share, why should a difference in the ratio of the *type* of site matter?
I do agree that Apache servers are more often administered by clueful admins that the average MCSE, but your logic that the product with the largest market share is most likely to be attacked is not borne out by the numbers.
If I'm missing something here, please let me know.
War is Peace. Freedom is Slavery. Ignorance is Strength. - George Orwell or George Bush?
Says Gartner.
Cheers //Johan
Installed the Bubblemon yet?
Netscape on Solaris. According to Netcraft.
(and this is to get past the lameness filter)
http://www.microsoft.com/technet/. Go there, subscribe to the mailinglists on security and other useful things. Read the how-to's, walkthroughs and useful documents about administring a Win2k/NT4 server.
Now when you go to http://www.microsoft.com/downloads/search.asp?, you will see a form. Select the product, win2k server, select Date to sort on, and hit 'find it'. All patches you need to have are there, plus other useful downloads.
Other USEFUL information about how to secure your box: http://www.securityfocus.com/cgi-bin/microsoft_top ics.pl
Windows NT kernel based systems have excellent memory management. You should start/stop services (net start/stop w3svc) once in a while. Or use 'kill'. Reboot not needed. Honestly.
Never underestimate the relief of true separation of Religion and State.
Oops, forgot the link!
Halcyon Software
"don't fall into the fallacy of believing that Perl can solve social problems. Maybe Perl 6 can, but that's a ways off"
...being that because of constantly having to patch IIS, the TCO is starting to get too high.
To all the bosses out there who won't change
to a more efficient and secure operating system, kiss my ass.
To all the people who have ridiculed me for using an operating system other than Microsoft Windows, kiss my ass.
To all people who send me microsoft office documents, and expect that I'll be able to view them, kiss my ass.
To the IIS mail serve administrator who gets mad at me when I ask why I can't get my email (business), kiss my big hairy ass!
Now don't get me wrong. I wish Microsoft well. If they release an inferior and insecure product that's tough.
It is clear the main reason most people use Microsoft products is because they think that's what most people use. It becomes a vicious cycle.
So I say to you, all who give in to peer pressure, you too can kiss my ass!
Female Prison Rape in NY
I don't think it's necessary to do anything as extreme as getting out more. Just give Slashdot a break and change to a different site like www.adequacy.org.
"If Stupidity got us into this mess, then why can't it get us out?" - Will Rogers
Funny, seeing this article. We just did this. We switched all of our NT IIS servers to NT Apache for Web and CesarFTP for FTP services. No IIS, no IIS problem.
- "That's just the kind of fuzzy-headed liberal thinking that leads to being eaten."
I've been going through my logs every morning and e-mailing companies that are trying to spread the NIMDA worm to our Linux boxes, imagine my suprise when I did a lookup on 199.203.73.133. It resolved to pilsner.checkpoint.com.
In bold type on their web page it says Check Point Controls Nimda
Just a thought. It'd be pretty cool if there was an installation for Apache that could stop IIS services and configure itself similar (but securely) to IIS (i.e. virtual directories, ports, modules, ...).
Ordinarily, the posters (and sometimes even the editors) at Slashdot are prone to overstatement, making this understatement somewhat refreshing. Of the companies in its industry, Gartner is perhaps one of the most extreme shills for Microsoft.
A lawyer & digital forensics examiner. Also an expert on open source software (OSS).
The damb has split wide open?
Friends don't help friends install M$ junk.
I'd suggest running it on Debian. As you say, Go there, subscribe to the mailinglists on security and other useful things. Read the how-to's, walkthroughs and useful documents about administring. Well, the mailinglist is optional as setting up a cron job (type man at) to apt-get updgrade and apt-get update will do better.
Debian boxes can be remote administered through a secure shell (ssh), without loosing the connection. Try running dselect through one some time, it's really cool. Did that to install and then uninstall proftp.
Friends don't help friends install M$ junk.
http://www.iplanet.com/products/iplanet_web_enterp rise/home_2_1_1m.html. Quite secure and easier to setup and admin than IIS.
...because I made a serious mistake and uninstalled some commercial software. Not naming names - I think the problem is common.
A certain package's uninstaller careless nuked HKLM ...\ODBC - all of it. To fix this up, I had to repair Win2K, reapply SP2, and reinstall my commerical ODBC software. And I blew it, I didn't repatch afterward! :-(
Therefore, Nimda ate my machine. Had to entirely format and reinstall. Puts me in the Dilbertian position "dealing with the loss of beloved data".
My experience is that the uninstallers of software are rarely well-tested.
Wash, rinse, repeat as needed. This doesn't make the hits go away, at least immediately, and it's probably only marginally more efficient than the 404 result that you'd ordinarily get, but at least it sends the traffic back where it came from. Since applying these rules the load on the servers I look over has fallen off nicely.
I would think that a properly patched & maintained copy of IIS should be able to do the same thing, or similar, but I don't know what the syntax would be.
DO NOT LEAVE IT IS NOT REAL
Gartner may or may not be right on with this one. But the G-Group lost all credibility when they fear-mongered the Y2K issue to line their own pockets. Their predictions were waaaaay off.