IIS Lockdown & .NET

I recently ran into quite a few problems when the IIS Lockdown tool was applied on one of our production servers. I'm listing it here so that I don't trip over it again and also end up helping anyone who comes across the same problem.

My scenario is that we have a classic asp application relying on .NET components which use MSMQ. After applying the lock down tool the asp application worked fine until it called one of the .NET components that sent a message through MSMQ which threw this exeception:

<P align=left>Cannot execute a program. The command being executed was "c:\winnt\microsoft.net\framework\v1.1.4322\csc.exe". </P>

What I found out was that the XmlSerializer which was used by System.Messaging to send the message created a dynamic class and compiles it on the fly. The problem is that the lockdown tool denies access to all the .exe files in the Windows system folder (and subfolders). This prevents the csc.exe or vbc.exe which is in C:\WINNT\Microsoft.NET\Framework\v1.1.4322 from being able to dynamically compile. To fix this I gave the Web Applications group Execute permissions for this file but this threw another exception.

<P align=left>File or assembly name sk-fuua9.dll, or one of its dependencies, was not found.</MESSAGE> at System.Reflection.Assembly.nLoad(AssemblyName fileName...</FONT></P>

After spending a couple of hours trying to figure this out, I finally got around to using the excellent FileMon tool which highlighted that the cvtres.exe too was used by csc.exe when attempting to compile. So I ended up giving Execute permissions for the cvtres.exe file for the Web Applications group and wallah problem solved!

The Microsoft KB recommends creating an seperate user and impersonating it in the application. But I feel that going this route makes it more secure since the default groups created by the lock down tool revokes most of the rights, which is not the case when you create your own user.

Spymac Launches The Internet’s First Free 1 Gigabyte Email Service

<IMG src=”http://www.spymac.com/upload/news/Apr_2004/1gb_spymac_mail.gif” align=left>One gigabyte of storage is available to all Spymac Mail accounts, effective today, Monday April 5, 2004.

Spymac agrees with the staff at Google that a 1 GB e-mail account makes sense. Millions of people rely on easy access to mail and depend on their email service to not indiscriminately delete important mail. Spymac Mail offers several advantages over other free Internet-based email. In addition to the one-gigabyte storage increase, Spymac Mail also offers both POP3 and Webmail access to the email accounts. For those wondering why on earth they would need <FONT color=#ff0000>one gigabyte</FONT> for <FONT color=#ff0000>POP3 mail</FONT>, don’t despair; because <FONT color=#ff0000>IMAP</FONT> mail capabilities are under development and will be available very soon. Spymac Mail does not include keyword scanning for search and has no advertising.

Spymac welcomes email accounts from users 13 years old and up on any operating system. Sign up for your free account today by clicking here.

Fiddler, et al

Scott Watermasysk (and Dave Wanta) point out a tool that should be in everyone's party chest -- Fiddler. While at first glance it looks similar to Simon Fell's most excellent TCPTrace utility, it seems to add even more every time I click on something. Here it is showing the stats for round-trip times to various countries.

Fiddler

You can also hand-build GET and POST requests, test out the effects of GZIP compression on requests, view all the headers and/or content of requests and responses, and much more. Extensible with your own plug-ins as well (and the price is right -- USD0). Thank you Eric Lawrence (author and 'softie).

TTFN - Kent
PS: While you're at it, look at the rest of the utilites on the site. There are some neat ones. I'm starting to really fall in love with SlickRun. It may finally cure me of my 4NT addiction. Maybe.


[Microsoft WebBlogs]

He’s Still Having Fun

Bill Gates, for one, thinks that the digital era is far from fading. In fact, he thinks it’s only now getting interesting. [Read More

Google launches free email service

Google has announced a free email service that is fully searchable and offers 500-times the storage capacity of Hotmail's free service.

A trial of the Gmail service kicks off today with testers hand-picked by Google. The web-based service will display text adverts alongside emails that are relevant to keywords in the user's emails.

Google announced the service in a cheekily written press release, dated 1 April, with its too-good-be-true tone suggesting April foolery, but with no obvious indication that the announcement was anything other than genuine (apart from claiming the service can search in Klingon!).

A Google spokeswoman said the announcement was not an April fool.

Key features of Gmail are the ability to search all emails sent and received; 1GB of storage, equivalent to 500,000 pages of email; and automatic grouping of email into "conversations", so related received and replied-to email would appear together, eliminating the need for folders.

Google said the inspiration for the service came from a Google user complaining about the poor quality of existing webmail services. "She kvetched [Yiddish for complained] about spending all her time filing messages or trying to find them. So she asked 'Can't you people fix this?'" said Google co-founder Larry Page. 

http://gmail.google.com/

Good News and Bad

I got both good news and bad today. The good news is that I got my MSc results at last, but the bad news I can’t tell right now.

Microsoft to remove the Calculator from Windows

News from Repeou:

The country Repeou threatens Microsoft to pay a fine as much as 10 percent of its global annual sales for monopoly defenses. The software giant is abusing its monopoly power by bundling several applications such as the Calculator and Paint with Windows.

The process against Microsoft was started by the company named Nisbum. Nisbum developed a great calculator but doesn't see a chance to sell this great product to the masses as long as Microsoft bundles the Calculator with Windows.

According to Repeou, Microsoft must offer at least two separate versions of Windows, one version without the Calculator.

Repeou is giving Microsoft a last opportunity to comment before the case is concluded.

Christian

What are the boundaries of an operating system? The boundaries of operating systems shouldn't be defined by governments, and they shouldn't be defined by competitors.

Israel unveils tiny drones

The Israeli military is equipping its forces with a new range of spy drones small enough to fit in a soldier's backpack, the army said on Thursday. These are equipped with a large variety of tools - nothing like the best cheap drone you can find on eBay for your kid's birthday.

The small unmanned aerial vehicles (UAVs) and micro UAVs were unveiled at a conference on low intensity conflict.

The Israeli air force has often used larger unmanned spy planes to target Palestinian militants in air strikes.  The new baby drones would give army forces in the field near instant access to aerial intelligence.  The planes have already been supplied to some ground units. "We use them to take aerial photographs of the (Palestinian) territories," a military official told Associated Press news agency.

ASP.NET is on a Tear!!

Wow!  Thomas Lewis who works on the ASP.NET evangelism team (and who recently gave me some good feedback on starter kits) sends this gem from Netcraft.

In this month's Web Server Survey thenumber of IP addresses with sites using ASP.NET has overtaken those using JSP and Java Servlets.The number of IP addresses found with ASP.NET has shown very strong growth in the past year with a 224% increase from 17.2K to 55.8K. JSP & Java Servlets despite being overtaken is the next fastest growing in percentage terms with a 56% increase.

If you're keeping score at home, Java started in 1996. ASP.NET started in 2002.  Within two years we're ahead, that's huge momentum!

[Dan Fernandez's Blog]