Moving IIS7+ configuration to another IIS7+ server

We have had to move config from one server to another, and we have discovered a general procedure for achieving this. We were just trying to copy over the applicationhost.config, but found sometimes the application pools would fall over.

Now as you might be aware, the majority of IIS7 website config is held in the applicationhost.config file, usually located in the

<windows folder>\system32\inetsrv\config

folder. There are instances where the config will be configured in web.config files, in the root of the website\virtual directory physical folders. But I won’t go into that here.

You can just copy over the applicationhost.config file to the new server, but you will have problems with passwords as the encrypted machine keys will not match. We need to export from the original sever and import into the new server. You can do this.

aspnet_regiis.exe found here

c:\windows\Microsoft.NET\Framework64\v2.0.50727\

Exporting

aspnet_regiis.exe -px "iisConfigurationKey" C:\temp\iisConfKey.xml -pri
aspnet_regiis.exe -px "iisWasKey" C:\temp\iisWasKey.xml -pri

Copy files to new server.

Importing (use -exp so the keys can be exported again)

aspnet_regiis.exe -pi "iisConfigurationKey" c:\temp\iisconfkey.xml -exp
aspnet_regiis.exe -pi "iisWasKey" c:\temp\iisWasKey.xml -exp

This should allow the application pools to properly function.

Moving IIS7+ configuration to another IIS7+ server

IIS7–Self Signed Server Certificate

I had to create a self signed certificate to run on an exchange web access site.

After looking around I have found the following Microsoft tool

selfSSL7.exe (it  is for IIS7, there is an selfSSL for IIS 6).

Ref: http://blogs.iis.net/thomad/archive/2010/04/16/setting-up-ssl-made-easy.aspx

This tool allows you create a certificate for a specified common name, something the GUI in IIS7 does not allow you to do (as it adds the server name).

I had issue running it on the server where IIS was installed, it kept moaning about .net framework issue. I was nervous about messing about on the server with .net so I put selfSSL7.exe on to another IIS7 server.

The command I ran was this, it was for blinkdinkyowa.blinkydinky.net (an example name), with a Key of length 2048, valid for 365 days. It is also exported the file to a pfx file, which would allow me to import to the correct server.

selfssl7 /N cn=blinkdinkowa.blinkydinky.net /K 2048 /V 365 /X /F .\blinkdinkowa.blinkydinky.net .pfx /W <password>

So on the correct server I opened IIS, clicked on the server, and open server certificates. Right clicked and imported the pfx file.

In addition I opened an mmc, with the certificates snap in and imported the certificate into the Trusted Root Certification Authorities. This just allows the server to trust the certificate.

I then jumped into the website bindings in IIS7, and set the https binding to use the new certificate.

IIS7–Self Signed Server Certificate

IIS 7–resetting site to root inheritance

I wanted to reset some sites, on a multiple site IIS server, to pick up their logging settings from the root.

After some digging around I have found that you have to edit the “applicationhost.config” to achieve this.

The file can be found here

%windir%\System32\inetsrv\config

Site information is held within this XML file, find the site section with the corresponding site name you are looking for. In this example “Default Web Site”.

<site name="Default Web Site" id="1" serverAutoStart="true">
                <application path="/">
                    <virtualDirectory path="/" physicalPath="C:\inetpub\wwwroot\defaultwebsite" />
                </application>
                <bindings>
                    <binding protocol="http" bindingInformation="*:80:testy.test.commy" />
                </bindings>
                <logFile logFormat="W3C" directory="E:\weblogs" />
            </site>

Now just delete the <logfile ….> entry completely and save.

You should now find in the IIS gui that the logging settings are now picking up the root settings. Hoorah!

IIS 7–resetting site to root inheritance

IIS7 and tomcat– basic setup

Every now and again I have to setup IIS and tomcat, this usually involves a gap of a year or so, so for my own sanity I have made some notes on how it sits together. Most of the issues involve jumping IIS versions.

I am assuming that the tomcat service is configured correctly, and I will only detail the tomcat to IIS setup.

We must download the ISAPI_rediect.dll ISAPI filter for IIS. ensure you have the correct version for your architecture (x86/x64).

http://apache.mirror.aussiehq.net.au//tomcat/tomcat-connectors/jk/binaries/

Extract the files into a location on the webserver, you will pointing a virtual directory at this location further on.

I love diagrams as it helps me visualise what is going on. So I have drawn a diagram to aid this

IIS

To get tomcat and IIS communicating we have to load an isapi filter into IIS that will handle the communications.

In my example I will be applying the isapi filter to a specific website in IIS, however you could if you wish add it at the server level and it will handle all sites within IIS.

First we have to tell IIS to allow the ISAPI filter. This is down at the server level within the ISAPI and CGI Restrictions.

Ok so now we go the site we want to allow the ISAPI filter to run on. And go to the ISAPI filters.

While still in the website in IIS, we need to add a virtual directory called Jakarta and point it to the path of isapi_redirect.dll.

Now click on the virtual directory and go to Handler Mappings,  click “Edit Feature Permissions” and check “execute”

Ok so we have configured IIS. We now have to configure the properties files that are used by the dll.

Now the redirector can utilise the registry or configuration files. I will cover the config files as this allows you to run multiple redirectors with various configs.

Now in the same folder there should be a file called isapi_redirect.properties. This file provides the filter with its initial config.

isapi_redirect.properties
It gives the virtual directory location of the DLL withiin the website.
extension_uri

logfile location and log level
# Full path to the log file for the ISAPI Redirector
log_file=<physical path>\logs\isapi_redirect.log

# Log level (debug, info, warn, error or trace)
log_level=info

And the path to a couple of other properties files

# Full path to the workers.properties file
worker_file=<physical path>\conf\workers.properties.minimal

# Full path to the uriworkermap.properties file
worker_mount_file=<physical path>\conf\uriworkermap.properties
rewrite_rule_file=<physical path>\conf\rewrites.properties

As you can see I have placed the config files into a subfolder conf and the logs in logs folder, but they can exist anyway really.

So the dll uses this initial config file to provide further setup details.

rewrites.properties
I will ignore the rewrites.properties file as I don’t use it, but it basically allows you to rewrite the url.

uriworkermap.properties
This file tells the extension (isapi_redirect.dll) what constitues a valid request to pass to tomcat. In my case I want everything sent to the website

/*=worker1

So the wildcard means send everything to worker1. No whats worker1?

workers.properties.minimal

The worker is the process that actually communicates to the tomcat process. The workers.properties.minimal file contains the setup for the worker processes. I have only one called worker1 and it set up to call tomcat using ajp13 on port 8009 (usual port).

worker.worker1.type=ajp13
worker.worker1.host=localhost
worker.worker1.port=8009

The worker will send the request to tomcat and then handle the response back to IIS.

Once these have all been configured, ensure the tomcat process is running. Restart the website in IIS and everything should work.

I reference these blogs/pages which provide further excellent info.

http://jspors.blogspot.com/2009/01/setting-up-64-bit-tomcat-6-on-iis7.html

http://tomcat.apache.org/connectors-doc/reference/iis.html

http://apache.mirror.aussiehq.net.au//tomcat/tomcat-connectors/jk/binaries/

IIS7 and tomcat– basic setup