|
| 1 | +IIS organizes web content through a hierarchy of sites, applications, and virtual directories. In this unit, you learn to understand and create new websites, configure web applications within those sites, and set up virtual directories using both the IIS Manager graphical interface and PowerShell. |
| 2 | + |
| 3 | +## The IIS content hierarchy |
| 4 | + |
| 5 | +IIS structures web content in a three-tier hierarchy: |
| 6 | + |
| 7 | +- **Website (Site):** The top-level container. Each site has at least one binding (IP address, port, and optional host name) that identifies incoming requests. A site maps to a physical root directory on disk. |
| 8 | +- **Web Application:** A child container within a site. Applications have their own application pool assignment and can have separate configuration settings from the parent site. Use applications when you need isolated configuration, a different .NET runtime, or a dedicated worker process identity for a portion of a site. |
| 9 | +- **Virtual Directory:** A pointer from a URL path to a physical directory on disk (which may be on a different volume or UNC path). Virtual directories don't have their own application pool and inherit the parent application's settings. |
| 10 | + |
| 11 | +> [!NOTE] |
| 12 | +> This hierarchy is stored in the central IIS configuration file, ApplicationHost.config, located at %windir%\system32\inetsrv\config\. |
| 13 | +
|
| 14 | +The following table lists the differences between IIS Web Applications and IIS Virtual Directories. |
| 15 | + |
| 16 | +| **Feature** | **Web application** | **Virtual directory** | |
| 17 | +|---|---|---| |
| 18 | +| **Has own application pool** | Yes | No (inherits parent app's pool) | |
| 19 | +| **Isolated configuration** | Yes | No | |
| 20 | +| **Separate .NET runtime** | Yes | No | |
| 21 | +| **Physical path** | Local or UNC | Local or UNC | |
| 22 | +| **Typical use** | Separate component with own identity/runtime | Alias for supplementary content directory | |
| 23 | + |
| 24 | +## Creating a new website |
| 25 | + |
| 26 | +To add a new site in IIS manager: |
| 27 | + |
| 28 | +1. Open IIS Manager. |
| 29 | +1. In the Connections pane on the left, expand the server node, then right-click Sites. |
| 30 | +1. Select Add Website. |
| 31 | +1. In the Add Website dialog, fill in the following fields: |
| 32 | + - Site name: Enter a descriptive name, for example Contoso. |
| 33 | + - Application pool: IIS creates a new pool with the same name as the site by default. Accept this or select Select to assign an existing pool. |
| 34 | + - Physical path: Enter `C:\inetpub\contoso` or browse to the directory. |
| 35 | + - Binding type: Select http. |
| 36 | + - IP address: Select All Unassigned unless restricting the site to a specific IP address. |
| 37 | + - Port: Enter 80 (or another port if 80 is already in use and you're hosting multiple sites on the same IP address but differentiating based on port). |
| 38 | + - Host name: Enter the FQDN for this site, for example www.contoso.com. Host names are required when multiple sites share port 80 or 443 on the same IP address. The sites are differentiated by IIS using the HTTP host header value in each incoming request. |
| 39 | + |
| 40 | +  |
| 41 | + |
| 42 | +1. Leave Start Website immediately checked unless you want to configure the site before it begins serving requests. |
| 43 | +1. Select OK. |
| 44 | + |
| 45 | +You can create a site with the `New-Website` cmdlet, which will be installed with the web server role management tools. For example, to create a site named Contoso with the path `D:\contoso` on port 80 that uses the fully qualified domain name www.contoso.com and has a new application pool named Contoso, run the command: |
| 46 | + |
| 47 | +```powershell |
| 48 | +New-Website -Name "Contoso" ` |
| 49 | + -PhysicalPath "D:\contoso" ` |
| 50 | + -Port 80 ` |
| 51 | + -HostHeader "www.contoso.com" ` |
| 52 | + -ApplicationPool "Contoso" |
| 53 | +``` |
| 54 | + |
| 55 | +You can verify website creation with the `Get-Website` command. For example, to verify the contoso website was created, run the following command: |
| 56 | + |
| 57 | +```powershell |
| 58 | +Get-Website -Name "Contoso" |
| 59 | +``` |
| 60 | + |
| 61 | +## NTFS permissions for web content |
| 62 | + |
| 63 | +When creating a website, configure the directory that hosts the content directory and ensure appropriate NTFS permissions are set. Remember that NTFS permissions are often inherited. Best practice is to use a separate volume for website content rather than storing it on the system volume. Using a separate volume for the website allows you to separate the content from operating system files, it also makes it simpler to back up and restore. You might repartition free space on your existing volume to implement this configuration. |
| 64 | + |
| 65 | +The worker process runs under the application pool identity. For example, a pool named Contoso runs as `IIS AppPool\Contoso`. Application pool identities are: |
| 66 | + |
| 67 | +- Local only |
| 68 | +- Noninteractive |
| 69 | +- Automatically managed |
| 70 | +- Not usable for logon |
| 71 | + |
| 72 | +You should grant the application pool identity `Read and Execute` access to the content folder: |
| 73 | + |
| 74 | +```powershell |
| 75 | +$acl = Get-Acl "D:\contoso" |
| 76 | +$permission = "IIS AppPool\Contoso", "ReadAndExecute", |
| 77 | + "ContainerInherit,ObjectInherit", "None", "Allow" |
| 78 | +$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission |
| 79 | +$acl.SetAccessRule($accessRule) |
| 80 | +Set-Acl "D:\contoso" $acl |
| 81 | +``` |
| 82 | + |
| 83 | +Granting permissions directly to that identity ensures: |
| 84 | + |
| 85 | +- Only that specific app can access the files |
| 86 | +- Other application pools on the same server can't read or execute the content |
| 87 | +- You avoid using broad identities like Everyone, Users, or IIS_IUSRS |
| 88 | + |
| 89 | +Granting `Read and Execute` adheres to the principle of least privilege as IIS only needs read access to serve static content and load assemblies, and execute is required for binaries such as ASP.NET and native modules. You shouldn't assign the Write privilege as this will limit attacks such as: |
| 90 | + |
| 91 | +- Web shell uploads |
| 92 | +- Defacement attacks |
| 93 | +- Runtime modification of binaries or config files |
| 94 | + |
| 95 | +## Creating web applications |
| 96 | + |
| 97 | +To add a Web Application within a Site |
| 98 | + |
| 99 | +1. In the Connections pane, expand Sites, then select the Contoso site. |
| 100 | +1. Right-click the site and select Add Application. |
| 101 | +1. In the Add Application dialog, configure: |
| 102 | + - Alias: The URL path segment, for example demoapp (accessible at www.contoso.com/demoapp). |
| 103 | + - Application pool: Select or create a dedicated pool. |
| 104 | + - Physical path: Enter the path to the application's files, for example d:\demoapp. |
| 105 | +1. Select OK. |
| 106 | + |
| 107 | + |
| 108 | + |
| 109 | +You can accomplish this with the following PowerShell command: |
| 110 | + |
| 111 | +```powershell |
| 112 | +New-WebApplication -Name "api" ` |
| 113 | + -Site "Contoso" ` |
| 114 | + -PhysicalPath "C:\inetpub\contoso-api" ` |
| 115 | + -ApplicationPool "Contoso-API" |
| 116 | +``` |
| 117 | + |
| 118 | +## Adding a virtual directory within a site |
| 119 | + |
| 120 | +To add a virtual directory within a site using IIS Manager, perform the following steps: |
| 121 | + |
| 122 | +1. In the Connections pane, right-click the Contoso site (or an application within it) and select Add Virtual Directory. |
| 123 | +1. In the Add Virtual Directory dialog, configure: |
| 124 | + - Alias: The URL segment, for example downloads. |
| 125 | + - Physical path: Enter the directory path, for example D:\shared\downloads. |
| 126 | +1. Select OK. |
| 127 | + |
| 128 | +You can add a virtual directory using the PowerShell `New-WebVirtualDirectory` cmdlet. For example, to add a new virtual directory named `downloads` to the `Contoso` site, run the command: |
| 129 | + |
| 130 | +```powershell |
| 131 | +New-WebVirtualDirectory -Site "Contoso" ` |
| 132 | + -Name "downloads" ` |
| 133 | + -PhysicalPath "D:\shared\downloads" |
| 134 | +``` |
0 commit comments