Re: URLSCAN makes pages with integrated authentication very slow

From: Vassilis Galinos (vgalinos_at_hotmail.com)
Date: 07/11/03

  • Next message: jordan: "Re: Hacked" 
    Date: Fri, 11 Jul 2003 23:47:02 +0200

    Yes!!!
    That seems to be the solution! :-)
    I changed the RemoveServerHeader=1 to RemoveServerHeader=0 and it works
    great (as it should).

    Thanks a lot!

    But isn't there a way to remove the Server header so that
    win-integrated-auth still works right?
    Because since I have done this with the server header remove, I have
    much less "hacker-tries" in the IIS-server logs!

    "David Wang [Msft]" wrote:
    >
    > Do you have RemoveServerHeader=1 or otherwise manipulate the Server: header
    > with URLScan?
    >
    > --
    > //David
    > This posting is provided "AS IS" with no warranties, and confers no rights.
    > //
    > "Vassilis Galinos" <vgalinos@hotmail.com> wrote in message
    > news:3F0B8D01.96D8C1D4@hotmail.com...
    > Hi!
    >
    > "David Wang [Msft]" wrote:
    > >
    > > Do you have KeepAlive enabled on this server?
    > >
    > > The actual HTTP Error is 401. Win32 error code is 5 (Access Denied). It
    > > isn't 401.5 that's being returned.
    > >
    > > Authentication typically involves at least one 401.x response prior to
    > > successful requests. Performance of authenticated requests is the
    > > responsible of the web browser (i.e. for Basic, send authenticate headers
    > on
    > > subsequent requests, for NTLM, keep using the authenticated connection.),
    > > but some server configuration can hinder the client-side optimization.
    > >
    > > A NetMon trace would be useful in investigating this further -- of both
    > with
    > > and without URLScan from your machine.
    >
    > So, here they are...
    > - a http-trace without and with URLscan for the same request
    > /imageapp/utils/imagedb.asp?Index=520&xQual=300&y (I hope you don't need
    > the TCP information from the trace...)
    > - and an IIS-Log file without URLscan
    >
    > The server has HTTP keep alive enabled.
    > The only diference in the config of the IIS is tha on the first case
    > URLscan is removed from the ISAPI filters and on the second it is
    > installed again.
    >
    > As you can see in the IIS log file, there are a few requests that are
    > first unauthenticared but they are only a few in compare of the other
    > log file I have posted, where the client has to reauthenticate near
    > every time!
    >

  • Next message: jordan: "Re: Hacked"

    Relevant Pages

    • Re: URLscan logs missing
      ... It doesn't mean that a log file is ... This means that if URLScan doesn't reject any requests, ... write a log entry, and if it doesn't write a log entry on a date, there's ...
      (microsoft.public.inetserver.iis.security)
    • Re: webexception 404
      ... has the IIS Lockdown tool been run on the server. ... In my case the UrlScan utility was preventing the request from being ... requests though, but when I figure it out I'll post it here. ... > client are passed from the webservice A to another Webservice, ...
      (microsoft.public.dotnet.framework.aspnet.webservices)
    • Re: OWA issue
      ... Note that the times in the log file are in GMT. Look for ... As you said,there is no record in IIS log file about requests for ... TELNET port 443 to my server in home,it is all working,now i was ...
      (microsoft.public.exchange.admin)
    • Re: Cannot access file, being used by another user(process)
      ... have a single instance of the file stream and queue any write requests. ... simultaneously to write to the log file. ... threads and called this library app. ... > Below is some sample code for the library component: ...
      (microsoft.public.dotnet.languages.csharp)
    • Re: Problem disabling all web logging except for 1 Web Publishing
      ... > After you turn off logging for a Web publishing rule, ... >> Version: ISA Server 2004 STD. ... >> dont want anything stored in this log file except requests made to WPR2 ...
      (microsoft.public.isa)