security configuration

security configuration

• 1.
  By-Teach4u.in
• 2.
  Content 1. Web.config 2. WhyApplications? 3. IIS 1. Role in handing a request 4. .NET 1. Applications 2. Application Object 3. Global.asax 5. Configuration files 1. Machine.config 2. Web.Config
• 3.
  What is Web.ConfigFile? Configuration file is used to manage various settings that define a website. The settings are stored in XML files that are separate from your application code. In this way you can configure settings independently from your code. Generally a website contains aingle Web.config file stored inside the application root directory. However there can be many configuration files that manage settings at various levels within an application.
• 4.
  Why Applications? Dark ages(pre-2003) Server crashes not unusual  Single failure bring down whole system Worse yet:  Memory leaks  Cause IIS hang  Stop serving pages  Required manual intervention (reboot)
• 5.
  Why Applications Today (WindowsServer 2003 & later) Applications still crash  Applications are compartmentalized  OS handles gracefully System rarely affected OS monitors application health  Recycles unhealthy processes Result: system stable & reliable
• 6.
  IIS Overview
• 7.
  IIS Applications Folders maybe configured as “Applications” IIS configuration interface Each application is assigned to an Application Pool  Each application pool has a unique Windows process Specify error handling, timeouts, etc. for each application Benefit: Compartmentalize applications Reduces dependencies  Improves reliability Allows application specific settings  Error handling, log files, filters, headers, timeouts…  100’s of settings
• 8.
  Applications Settings Configuration settings: Web.config Application level settings  Located in root folder Machine.config  Settings common to all applications Application event handlers Global.asax file  Located in root folder
• 9.
  ASP.NET Configuration .config files Hierarchicalconfiguration Similar to CSS  Inheritance  Child has precedence over parent Machine.config Rarely need to modify
• 10.
  Web.Config XML file Case sensitive Camelcasing Configure: Application settings Error handling Timeouts Sessions…etc. etc. Authentication documentation Security .config files not served
• 11.
  Global.asax Handles application &session events 15+ events Application_start Application_error Session_start Located in root folder of application Triggered each page request Optional
• 12.
  Global.asax Example: Create new applicationon server web.config: source global.asax: source TestPage.aspx: source, output
• 13.
  Summary Configuration Objectives:  Flexibility Security  Reliability  Convenience IIS  Handles requests Application  Application object  Events: global.asax Configuration  Machine.config  Web.config