Teach Yourself E-Commerce Programming with ASP in 21 Days phần 7 pps

• How to upload files to your site using FTP• How to perform advanced, Web-based catalog maintenance The IIS Administration Pages In previous chapters, you have learned to use the Intern

Now that you have installed Remote Machine Debugging and enabled debugging on yourdevelopment site, you must give yourself permission to debug on the development server.You can do this as follows:

1 From the Start button, click Run

2 In the small box that appears, type Dcomcnfg.exeand click OK

3 On the Applications tab, find the Catalog class (see Figure 16.11) and click theProperties button This will bring up a dialog called Catalog Class Properties

F IGURE 16.10

The App Debugging tab of Application Configuration.

F IGURE 16.11

The Applications tab.

4 Click the Security tab (see Figure 16.12) In each of the three permissions sections,use the Edit button to bring up a dialog that will allow you to give yourself accesspermission for the resource Click OK

To try debugging out, double-click default.aspto open it The file will open in the ter area of the Visual InterDev IDE, and you will notice a gray strip running down theleft side of the window You can set a breakpoint by clicking the gray strip next to theline you’d like to stop on To try out debugging, click to the left of the first executableline of the file,cat = TRIM ( Request( “cat” ) ).You will see a red circle appearnext to the line as shown in Figure 16.13 (In the figure, the red circle is black.) Press theF5 button to start debugging, and you will be prompted for your Windows NT usernameand password Enter it to continue.

cen-Internet Explorer will now launch, and the Visual InterDev IDE will change from editingview to debugging view The line broken on will appear highlighted in yellow, and therewill be a yellow arrow pointing to the highlighted line (see Figure 16.14)

F IGURE 16.12

The Security tab.

You can now watch the asp script execute line-by-line and, as the script executes, youcan monitor the contents of VBScript variables in the watch window in the lower rightside of the IDE Try it now by clicking on the blank cell in the Name column of thewatch window, entering catand pressing return You will observe Variable is

break-default.asp.

undefined: ‘cat’in the Value column, and Errorin the Type column (see Figure 16.15) Press the F10 key once, and you will see several things happen:

• The yellow arrow moves to the next line of VBScript

IF cat = “” THEN cat = “Home”.

• The yellow highlight moves to the next line of VBScript

• The Value column in the watch window changes to “”

• The Type column in the watch window changes to String

F IGURE 16.15

The watch window.

According to the current line, because the value of the variable cat is “”, it should be set

to “Home” Try it by pressing F10 again You will observe that the Value column in thewatch window changes to “Home” The color of the string is red to signify that the valuechanged as a result of executing the previous statement (see Figure 16.16)

The watch window can also look inside COM objects that your ASP script instantiates

The line of ASP script currently highlighted creates an ADO Connection Try lookinginto it by clicking the watch window on the empty cell in the Name column (underneathcat) and typing Con Press F10 again, and you will see a plus sign inside a box next tothe variable name Con Click the plus sign to expand the object, and you will see themembers of the new Connection object (see Figure 16.17)

The Visual InterDev IDE can also show you all the variables and objects defined for thecurrent script Go to the View menu and select Debug Windows, Locals The Locals win-dow will appear on the lower left side of the IDE, and will include all the objects thatASP defines for your page (like Request,Response,Session,Application) as well asthe variables defined in adovbs.incand the variables defined in default.aspas of the

F IGURE 16.16

The watch window changes as a result of the single statement executed.

F IGURE 16.17

Examining an ADO Connection object in the watch window.

current line (see Figure 16.18) You can exit the debugger by going to the Debug menuand selecting End, or by pressing Shift+F5

F IGURE 16.18

The Locals window.

As you can imagine, this is an extremely powerful way to examine potential errors inyour ASP code Many bugs result from unanticipated data or typing errors; these kinds ofbugs are easy to diagnose and fix with the Visual InterDev IDE Single-step debuggingisn’t appropriate for diagnosing every problem; for example, bugs that relate to multipleusers accessing your Web site simultaneously This is because when the debugger isstopped at a breakpoint, the Web server isn’t able to respond to requests from other Webclients To debug problems related to multiple requests, you will need to use techniqueslike those described in the next two sections

Debugging Your Application on a Production

Server

Although you might test your application thoroughly on your development site, a fewbugs will almost always slip into your production system The best way to diagnose theseproblems is to try to reproduce the bug on your development system while watching ASPexecution in the Visual Studio debugger; however, as discussed in the previous section,this isn’t always possible In those cases, you will need a way to have the productionWeb site output additional information to you while your customers continue to use the

Web site normally The ASP Session object offers a straightforward way to do this byallowing you to set a per-session debugging level and adding a hidden administrativepage to allow you to set the debugging level You can then use that debugging variable inyour code to decide how much debugging information to add to the output of your ASP.

This technique takes advantage of ASP Sessions Although Sessions have many advantages, keeping per-session information in an ASP-driven Web site will degrade performance when your site is under high levels of load You will need to explore the specific performance characteristics of your own Web site to decide whether using this technique is worth the potential performance impact.

L ISTING 16.1 Setting iDebugLevel to 0 for Each Session

1 <SCRIPT LANGUAGE=”VBScript” RUNAT=”Server”>

on your Web pages

INPUT

A NALYSIS

You will need to add a hidden, administrative page that allows you to reset the value ofiDebugLevel For additional flexibility, we will do this by adding a subfolder calledAdmin, and a page in the Admin folder called adminPage.asp You can do this in theVisual InterDev IDE by going to the Project Explorer and right-clicking your Web pro-ject In the context menu that appears, select New Folder In the dialog that appears,enter Admin A new Admin folder will appear in the Project Explorer Right-click thatfolder and select Add, Active Server Page Change the name of the file in the Add Itempage from ASPPage1.aspto adminPage.asp A template for the new page will appear inthe center of the IDE If you aren’t using the Visual InterDev IDE, you can create thefolder and adminPage.aspfile using Notepad or another text editor In either case, theultimate contents of adminPage.aspare in Listing 16.2 Although there is not a link toadminPage.aspon your Web site, you can access it directly by going to http://

www.yoursite.com/Admin/adminPage.asp, changing the debug level, and clickingSubmit

L ISTING 16.2 Resetting iDebugLevel in adminPage.asp

12 <META NAME=”GENERATOR” Content=”Microsoft Visual Studio 6.0”>

13 <title>Johnson’s Candies and Gifts Administration Page</title>

32 <FORM method=”POST” action=”adminPage.asp”>

33 <input type=”hidden” name=”ProcForm” value=”Process”>

so the script between lines 4 and 7 sets the value of the session variable iDebugLeveltowhatever the user entered The form is now regenerated with the new value of

iDebugLevelplaced into the input textbox (line 37)

Using the Session-level Debugging Variable

A second axiom of programming is that errors most frequently occur when two differentpieces of software interact As you’ve seen, in building an E-Commerce site, the externalsoftware interacted with the most is the database, which is accessed via SQL and ADO.Using the iDebugLevelvariable defined previously, you can now add code that displaysextra debugging information in your Web pages—an especially useful technique for pro-duction debugging when your ASP is interacting with the database For example, youmight want to display SQL statements before they are executed if iDebugLevelis 1, andthen display both SQL statements and their results if iDebugLevelis 2, and so on Inthese examples, we will only take advantage of setting iDebugLevelto 1

To show the power of this technique, we will take, as an example, a page we created

on Day 5, “Building Your Product Catalog,” called updateProducts.asp, and add

L ISTING 16.2 continued

A NALYSIS

session-level debugging output to that script to allow us to diagnose our SQL queries

(This file is included with the CD-ROM that accompanies this book with the namedebugUpdateProducts.asp.)

First, we’ll add a subroutine to the top of the page that will capture the logic of decidingwhether to display extra information We’ll insert the code in Listing 16.3 between lines

1 and 2 of updateProducts.aspso that the routine is available to the entire script

L ISTING 16.3 Adding a Debug Routine to updateProducts.asp 1.1 Sub DebugWrite(sDebugText, iDebugLevel)

1.2 If CInt(Session(“iDebugLevel”)) >= CInt(iDebugLevel) Then 1.3 Response.Write(vbNewLine & “<COMMENT>” & vbNewLine &

➥”Debugging output level “ & iDebugLevel & vbNewLine) 1.4 Response.Write(sDebugText)

1.5 Response.Write(vbNewLine & “</COMMENT>” & vbNewLine) 1.6 End If

1.7 End Sub

When the DebugWritesubroutine is called, if the current value of the sessiondebugging level is greater than or equal to the value passed in as iDebugLevel(line 1.1), the information passed in as sDebugTextis emitted in an HTML comment(lines 1.3–1.5)

Now that the DebugWritesubroutine is available, we can place it in strategic places inupdateProducts.asp As we’re concerned about our SQL statements, we will insert codethat emits the SQL statements when iDebugLevelis 1 The code we add is in Listing 16.4

L ISTING 16.4 Adding Strategic DebugWrite Calls to updateProducts.asp

6 Set Con = Server.CreateObject( “ADODB.Connection” ) 6.1 DebugWrite “Opening accessDSN”, 1

7 Con.Open “accessDSN”

13 RS.CursorType = 3 13.1 selectStr = “SELECT * FROM Products WHERE product_id=” & productID 13.2 DebugWrite selectStr, 1

14 RS.Open selectStr

Now, go to admin/adminPage.aspand change the Debug Level to 1 Next, go tomanageProducts.asp, and click one of the product links to bring you to anupdateProduct.aspgenerated page Although the output of the page looks the same in the browser, if you select View, Source, you will observe that the first four lines

of HTML

INPUT

A NALYSIS

INPUT

are comments generated by our DebugWriteroutine.

Creating a Debug Library

Before writing any more debugging functions and subroutines, now is a good time to create an asp page that can serve as a debugging library (This file is included on theCD-ROM that accompanies this book with the name debug.asp.) Keeping all the debug-ging routines in a single file (in this site, we will call it debug.asp) makes the routinesmuch easier to use and maintain Rather than having to copy and paste the same func-tions into multiple files, it will be much easier to INCLUDE=”/debug.asp”at the top ofeach page This technique also gives each of your pages access to new functions (or fixes

to existing functions) without having to make the same changes to many pages The firstroutine to add to debug.aspis DebugWrite, which we will move from the top ofupdateProduct.aspto the top of debug.asp

Recovering from and Capturing Errors

When your ASP calls ADO and encounters an error in the database, the VBScript preter stops processing your Web page and emits text like this:

inter-Microsoft OLE DB Provider for ODBC Drivers error 80004005 [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified

/updateProduct.asp, line 7and the currently executing script stops This can make it difficult to diagnose problemsbecause the error messages are often cryptic and, although there is sometimes moreinformation available in various error state objects, because execution stops immediately,there is no opportunity to examine that information Also, some errors are recoverablebut, again, because execution stops immediately, there is no opportunity to examine theerror and decide whether to continue or to present a friendlier error Adding the On Error Resume Nextstatement to the top of a script gives the programmer the opportuni-

ty to do both

When a script contains On Error Resume Next, it becomes the programmer’s bility to handle runtime errors To help handle these errors, we will add the CheckError

subroutine to our debugging library, which will be called after each ADO operation (seeListing 16.5) The CheckErrorsubroutine checks for errors and, if encountered, emitsextended error information

The ADO diagnostics in CheckError assume that all ADO connections are named Con If you decide to add pages that use ADO to the sample site, make sure to name your ADO connections Con

Note

L ISTING 16.5 CheckError

1 Sub CheckError 2

3 If Err.Number > 0 Then

4 Response.Write vbNewLine & “<COMMENT>” & vbNewLine & “ASP Error! “ &

➥vbNewLine

5 Response.Write “ Number: “ & err.number & vbNewLine

6 Response.Write “ Description: “ & err.description & vbNewLine

7 Response.Write “ Source: “ & err.source & vbNewLine

8 Response.Write “</COMMENT> “ & vbNewLine

9 End If 10

11 If Not IsEmpty(Con) Then

31 Response.Write “ ADO Error “ & j & vbNewLine

32 Response.Write “ Number: “ & Con.Errors(i-1).number &

➥vbNewLine

INPUT

continues

33 Response.Write “ Description: “ & Con.Errors(i-1).description

➥ & vbNewLine

34 Response.Write “ Source: “ & Con.Errors(i-1).source &

➥vbNewLine

35 If Con.Errors(i-1).nativeerror <> “” Then

36 Response.Write “ Native Error: “ &

➥Con.Errors(i-1).nativeerror & vbNewLine

48 End Sub

The CheckErrorsubroutine has two parts The first part (lines 2–10) checks for aVBScript error Line 2 checks the VBScript intrinsic object Errto see if anunhandled error occurred If one did, lines 4–8 emit an HTML comment with informa-tion about the error

The second part (lines 11–47) checks the ADO connection object, if any, for errors Thiscode is more complicated than the code that checks the Errintrinsic object because asingle ADO call can cause more than one error, and because some ADO errors are sim-ply informational Line 12 checks to see if there are any errors or informational mes-sages Lines 18–22 loop through each of the ADO errors Line 19 checks to see if eacherror is an actual error (informational messages have Error.Number = 0) and, if it is,line 20 counts them in j Line 26 checks jto see if there were any actual errors If therewere, lines 29–42 loop through the errors again and output detailed information abouteach of them, if available, in an HTML comment

To demonstrate CheckError in action, we will introduce a common error intomanageProducts.asp We’ll change the manageProducts.aspas shown in Listing 16.6

so that debug.aspis included and product names with single quotes are no longerescaped

L ISTING 16.5 continued

A NALYSIS

5 FUNCTION fixQuotes( theString )

6 ‘ fixQuotes = REPLACE( theString, “‘“, “‘’” )

7 fixQuotes = theString

8 END FUNCTION

To check for errors, we will need to call the CheckErrorsubroutine after each SQL ation You should add the CheckErrorsubroutine after every Con.Executestatement inthe manageProducts.aspfile

oper-Now, go to manageProducts.aspin your browser and try to update the entry forHershey’s Chocolate Bar Although the page reports that the update was successful, go toView, Source in the browser You will see the following comment in your HTML:

<COMMENT>

ADO Errors!

ADO Error 1 Number: -2147217900 Description: [Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression ‘’Hershey’s Chocolate Bar’,product_price=9,product_picture=’hersheys.jpg’,product_category=’Chocolate Solids’,product_briefdesc=’A solid bar of delicious chocolate.

‘,product_fulldesc=’Everybody loves this classic candy!

‘,product_status=1 WHERE produ’.

Source: Microsoft OLE DB Provider for ODBC Drivers Native Error: -3100

<%=productName%> was <% if Con.Errors.Count > 0 Then %> <B>not</B>

➥<% end if %> updated in the database

Capturing Errors into a Log File

Writing errors to comments in an HTML page is very powerful; however, you mightencounter errors that only happen to your customers and that you can’t reproduce In

INPUT

these cases, you might find it helpful to capture errors into a log file VBScript provides

a straightforward way to do this with the FileSystemObjectobject (To learn more aboutusing the FileSystemObject, see Day 4, “Working with Files in Your E-CommerceApplication.”) You can write the errors by making the changes in Listing 16.7 todebug.asp

L ISTING 16.7 Changes to debug.asp to Capture Errors into a File

1 Sub WriteToFileAndHtml(fFileStream, sString)

8 Sub CheckError

9 Dim fs

10 Dim f 11

12 If Err.Number > 0 Then

13 Set fs = CreateObject(“Scripting.FileSystemObject”)

14 Set f = fs.CreateTextFile(fs.GetTempName()) 15

16 WriteToFileAndHtml f, vbNewLine & “<COMMENT>” & vbNewLine & “ASP Error!

➥ “ & vbNewLing

17 WriteToFileAndHtml f, “ Number: “ & err.number & vbNewLine

18 WriteToFileAndHtml f, “ Description: “ & err.description & vbNewLine

19 WriteToFileAndHtml f, “ Source: “ & err.source & vbNewLine

20 WriteToFileAndHtml f, “</COMMENT> “ & vbNewLine 21

40 If IsEmpty(fs) Then 42

41 Set fs = CreateObject(“Scripting.FileSystemObject”)

43 Set f = fs.CreateTextFile(fs.GetTempName())

44 End If 45

46 WriteToFileAndHtml f, vbNewLine & “<COMMENT>” & vbNewLine &

➥”ADO Errors!” & vbNewLine

47 For i = 1 to Con.Errors.Count

48 If Con.Errors(i-1).number <> 0 Then

49 WriteToFileAndHtml f, “ ADO Error “ & j & vbNewLine

50 WriteToFileAndHtml f, “ Number: “ & Con.Errors(i-1).number &

➥ vbNewLine

51 WriteToFileAndHtml f, “ Description: “

➥ & Con.Errors(i-1).description & vbNewLine

52 WriteToFileAndHtml f, “ Source: “ & Con.Errors(i-1).source &

➥ vbNewLine

53 If Con.Errors(i-1).nativeerror <> “” Then

54 WriteToFileAndHtml f, “ Native Error: “

➥ & Con.Errors(i-1).nativeerror & vbNewLine

67 If Not IsEmpty(fs) Then

accompa-The temporary file is then closed, if necessary, in lines 67–69 Finally, each of the calls

to Response.Writeis changed to WriteToFileAndHtml(lines 16–20 and 46–61)

A NALYSIS

The new version of CheckErrorwrites a separate log file for each error that your usersmight encounter as they navigate your site As previously mentioned in the section

“Creating a Debug Library,” because CheckErroris in debug.asp,any of the ASPpages that call it to log errors take advantage of this new functionality Of course, youwill need to proactively check the temporary files periodically to look for these sorts oferrors In a later chapter, we will discuss how to have the Web server automatically emailthese logs to you

Testing for Scalability

Before you decide to open your E-Commerce site, imagine how much traffic you wouldneed to have to feel really successful; then multiply that traffic by 10 This algorithm forcalculating traffic is a standard metric that commercial Web sites use The reason for this

is that if you do exceed your own expectations, you want to make sure that you provideall your customers a good experience

If you are expecting a small number of customers (a few hundred per day), testing forscalability isn’t so important On the other hand, if you are expecting thousands of cus-tomers, you owe it to yourself and to them to measure how well the site responds to thatkind of load To do so, you will either need a lot of friends and a lot of computers, or youwill need a tool that can create simulated load, like WebLoad, LoadRunner, or theMicrosoft Web Capacity Analysis Tool

Microsoft’s WCAT is available for free from Microsoft’s Web site at http://

msdn.microsoft.com/workshop/server/toolbox/wcat.asp Using WCAT requires you

to have at least three computers: a server, a controller, and one or more clients The

serv-er is your production Web sserv-ervserv-er; the controllserv-er and clients are Windows NT Workstation

or Windows NT Server machines Run the WCAT setup program on all these machines

On the server machine, run the Extract Server Contentprogram

WCAT also requires you to know the IP addresses of your client and controllermachines If you don’t know these addresses, you can use the command-line utility ping

to find them out Go to the Start menu and select Programs, Command Prompt When theCommand Prompt appears, type ping <machine name> The machine’s IP address will

The temporary files created in this manner are, by default, placed in the

\winnt\system32 directory, and are named with strange looking filenames— three letters, followed by five numbers, with a tmp extension The exercises will give you an opportunity to change the location and filenames, if you want.

Note

appear within square brackets In the example in Figure 16.19, the IP address of themachine named MIKAis 192.168.201.1 Repeat this process for the server and the con-troller

F IGURE 16.19

Pinging MIKA

To configure the controller and each client, you will need to bring up a CommandPrompt On the controller, change to the directory that contains the controller (by defaultc:\webctrl, so type cd \webctrl); then type config <Server-IP-Address> For exam-ple, if MIKAis the controller, you would type config 192.168.201.1 On each client,change to the directory for the WCAT client and type config <controller-name>

<controller-IP> You can now start your clients by typing clientat a commandprompt on each client; then start the controller by typing run <testname>

A simple way to test your customers’ experience is to run the asp75 test that comes withthe WCAT utility; then, from an unused machine, try using your Web site This will giveyou the user experience of using a loaded server As you get more adventurous, theWCAT documentation explains how to script your own tests and capture a wide variety

of statistics Should you want to, you might also explore using commercial tools to scriptyour testing, or using commercial firms to monitor your E-Commerce site’s performancefrom various parts of the country

Summary

This chapter introduces deployment, debugging, and testing You learned how and why tokeep your development system separate from your production system You also learnedhow to install and use Visual InterDev’s integrated debugger on a development system,and how to debug your application on a production system using HTML comments andtemporary files Finally, you learned about Microsoft’s WCAT tool

Q My debugger is no longer breaking at breakpoints Instead of a red circle, I see a red circle with a question mark in it What do I do?

A This is a very common problem First, make sure that you have installed the latest

NT Service Pack If this doesn’t fix the problem, try the following:

1 Go to Control Panel, Services and stop the World Wide Web PublishingService

2 Open a command prompt Type cd \winnt\system32\inetsrv

3 Type regsvr32 asp.dll

4 Restart the World Wide Web Publishing Service

For more information, see the article “Microsoft Visual InterDev 6.0 Debugging” atthe Microsoft MSDN Web site at the following URL:

http://msdn.microsoft.com/library/techart/msdn_videbugging.htm

Q I’ve done scalability testing and am disappointed with the results—or—my customers are complaining about the speed of my site What do I do?

A Congratulations! This is a great problem to have.

Performance on Web servers can be influenced by a variety of factors—amount ofmemory in the machine, processor speed, network speed, or disk drive (or diskcontroller) speed

The first thing to do is isolate which of these factors is causing your problem NTcomes with a tool called Performance Monitor that allows you to measure howmuch of each resource your system is using If your processor utilization is maxi-mized, try running with a faster machine If your hard drive keeps spinning, tryincreasing memory If neither of these is the problem, you might need faster diskdrives, or you might need to talk with your ISP about getting more bandwidth

Q I have a bug that I can’t figure out What do I do?

A Even the best programmers run into problems that at first look unsolvable Relax,

get a cup of coffee, and think about something else for awhile If the answer stilldoesn’t come to you, visit Microsoft’s Web site or some of the sites listed in theinside back cover of this book for helpful troubleshooting tips So many people arewriting ASP these days that chances are someone else has run into your problem

3 Can I install the debugger on my production server?

4 Why should I keep all my debugging routines in a single script?

5 How much load should I plan to handle?

Exercise

Update the CheckErrorfunction so that it writes log files into a directory on yourWeb site

be structural changes These changes are simple when you make them fromyour system’s console; however, they are also easy to perform remotely.IIS comes with a built-in Web site that allows you to administrate your Web sitethrough an HTML based interface In addition, you can use a combination ofyour own Web pages and the FTP server, or Microsoft Posting Acceptor tomodify your store’s catalog.

Today, you will learn

• How to install and secure the IIS administration pages

• How to administer your Web server with the IIS administration pages

• How to install and administer the IIS FTP service

• How to upload files to your site using FTP

• How to perform advanced, Web-based catalog maintenance

The IIS Administration Pages

In previous chapters, you have learned to use the Internet Service Manager to administeryour E-Commerce site’s Web server The Internet Service Manager for the MicrosoftManagement Console is a powerful and useful tool, but it can only be used from a com-puter that is part of the same Windows domain as your Web server You might find your-self in a situation in which you don’t have access to such a machine but need to adminis-ter your site The IIS Internet Service Manager Web pages give you the ability to performmany site administration tasks from any machine with Internet access and a Web browser

Installing the Administration Pages

If you are using Windows 2000, the Internet Service Manager Web pages should already

be installed on your machine If you are using Windows NT, you can install the InternetService Manager Web pages by doing the following:

1 Go to the Start menu and select Programs, Windows NT 4.0 Option Pack,Windows NT 4.0 Option Pack Setup

2 When the Setup program appears, press the Next button, and then press theAdd/Remove button

3 Select Internet Information Server (IIS) and press the Show Subcomponents button

4 Check the box beside Internet Service Manager (HTML) (see Figure 17.1) andpress OK Press the Next button The setup program will then install the additionalcomponents and might prompt you to reboot your computer Do so

F IGURE 17.1

Installing IIS components.

5 Re-install the latest Windows NT Service Pack

The Internet Service Manager (HTML) is now installed into a virtual directory calledIISADMIN It is ready to use, but only from a browser running on the server on which itwas installed Navigate to http://localhost/IISADMINto explore its features (seeFigure 17.2)

F IGURE 17.2

The home page of the

Internet Service

Manager (HTML).

Securing the Administration Pages

At this point, if you try to access the Internet Service Manager (HTML) with a browserrunning on a machine other than the Web server that runs your E-Commerce site, youwill observe the following messages:

HTTP Error 403 - Access to Internet Service Manager (HTML) is restricted to Localhost

403.6 Forbidden: IP address rejected

Every machine that runs TCP/IP can refer to itself by using either its assigned

IP address (or, in the case of a multi-homed machine, assigned IP addresses)

or the special IP address 127.0.0.1 Similarly, all machines that run TCP/IP can refer to themselves with the special name localhost, which always refers to

127.0.0.1.

Note

You’ll receive this error message because, as a security precaution, the setup programuses the IP address restriction feature of IIS to limit access to the Internet ServiceManager (HTML) to browsers running on the server on which it was installed To enableaccess to the Internet Service Manager (HTML) for browsers running on other machines,you will need to use the Internet Service Manager to broaden these restrictions.

To update the IP address restrictions for the Internet Service Manager (HTML), you can use either the Internet Service Manager for MMC or the Internet Service Manager(HTML) from the Web server machine To use the Internet Service Manager (HTML),

go to the Web server machine and follow these steps:

1 Open a browser and navigate to http://localhost/IISADMIN

2 If it isn’t already expanded, expand the default Web site by clicking the plus bol next to the text Default Web Site (see Figure 17.3)

sym-F IGURE 17.3

Expanding the Default Web Site.

3 Click on the virtual directory IISADMIN

4 Select Properties, Security link in the left hand navigation bar (see Figure 17.4)

5 Click the Edit button in the IP Address and Domain Name Restrictions section ofthe security page (see Figure 17.5)

6 Change the IP Address Access Restrictions to Grant Access to All Computers bydefault (see Figure 17.6) and click the OK link

At this point, anyone with access to the Internet can administer your Web site by visiting http://www.yoursite.com/iisadmin So don’t stop here Continue through steps 7–10.

Caution

7 Click the Edit button in the Anonymous Access and Authentication Control section

of the security page (see Figure 17.5)

8 In the Access methods page that appears (see Figure 17.7), verify that the Allow

Anonymous check box is not checked and the Windows NT Challenge/Response

check box is checked (This is called Integrated Windows Authentication in thecase of Windows 2000.)

If you plan to administer your Web site from machines running browsers other thanInternet Explorer such as Netscape Navigator, you can check the Basic Authenti-cation box Click the Edit button in the Basic Authentication section of the dialogbox, and enter the domain in which your Web server is a member Otherwise, veri-

fy that the Basic Authentication check box is not checked Finally, click the OK

link

F IGURE 17.6

Granting access to the admin pages to all computers.

F IGURE 17.7

The Access Methods page.

10 Check the box labeled Require Secure Channel when accessing this resource (seeFigure 17.8) Click the OK link.

Basic Authentication is less secure than other forms of authentication Only enable Basic Authentication if you are sure that you will need to administer your site from a machine that doesn’t have Internet Explorer installed.

Caution

F IGURE 17.8

The Secure

Communications page.

If you know that you will always be accessing the administration pages with

a browser that has 128-bit security (Netscape Navigator or Internet Explorer 128-bit, US/Canada versions), you should check the box labeled Require 128-bit Encryption for additional security.

Note

After completing step 10, the access methods page will refresh, and you will observe thefollowing messages:

HTTP Error 403 403.4 Forbidden: SSL Required.

Don’t worry—this is to be expected, as you just reconfigured your Web server to requireSSL to access the administration pages Close the page with the error, go back to theWeb browser you are using to configure your Web server and change the beginning ofthe URL from httpto https You can now administer your E-Commerce site from any-where by pointing a browser to https://www.yoursite.com/iisadmin

Using the Administration Pages

You can use the Internet Service Manager (HTML) to remotely perform many of theadministrative functions for which you would normally use the Internet Service Managerfor MMC The most obvious differences are

• You cannot use the Internet Service Manager (HTML) to start or stop a Web service

The Internet Service Manager (HTML) is Web-based, which means that it requires a Web server As such, it doesn’t make sense to be able to stop the Web server that the Internet Service Manager (HTML) is running on from the HTML-based service manager.

Other than these exceptions, you will find the Internet Service Manager (HTML) a usefultool for performing emergency maintenance on your E-Commerce site

images Using the File Transport Protocol (FTP) Service is one way to do just that.

The FTP service implements one of the oldest Internet technologies, the File Transport Protocol, which dates back to 1971.

Note

By default, the FTP service is installed on Windows 2000 If you are using Windows NT,the FTP service might not be installed To check whether it is, go to the Start Menu andselect Windows NT 4.0 Option Pack, Microsoft Internet Information Server, InternetService Manager Go to the left panel, open the Internet Information Server node, andselect your server In the right panel, you should observe an icon for an FTP Site (often

called Default FTP Site—see Figure 17.9).

F IGURE 17.9

The Default FTP Site.

If the FTP server is not installed, you can install it by doing the following:

1 Go to the Start menu and select Programs, Windows NT 4.0 Option Pack,Windows NT 4.0 Option Pack Setup

2 When the Setup program appears, press the Next button, and then press theAdd/Remove button

3 Select Internet Information Server (IIS) and press the Show Subcomponents button

4 Check the box beside File Transport Protocol(FTP) (see Figure 17.1) and press

OK Press the Next button The setup program will then install the additional ponents and might prompt you to reboot your computer Do so

com-5 Re-install the latest Windows NT Service Pack

After the FTP service is installed on your Web server, you can examine its configuration

by right-clicking the FTP site in Internet Service Manager and choosing Properties Youwill want to make several changes to the default configuration to improve security First,

you will want to restrict anonymous access to your FTP server; then you will want to add

a virtual FTP directory for your Web site.

Anonymous access to an FTP server dates back to the early days of the Internet, when FTP servers were used to share data Enabling anonymous access is useful for Web sites that, like Download.com, are primarily intend-

ed to distribute files It is generally not appropriate for E-Commerce sites.

Caution

To configure your FTP server, follow these steps:

1 To turn off anonymous access to your FTP server, select the Security Accounts tab

of the FTP Site Properties dialog box (see Figure 17.10) and uncheck the AllowAnonymous Connections box Press the OK button

F IGURE 17.10

The Security Accounts tab of the FTP Site Properties dialog box.

2 To add a virtual FTP directory for your Web site, select Actions, New, VirtualDirectory from the Internet Service Manager The New Virtual Directory wizardwill appear and prompt you to enter a directory name Enter a name (for example,

Site) and press the Next button