markwilson.it

Allowing ISA Server 2000 web proxy clients to use non-standard ports for HTTPS

Posted on Friday 15 July 2005Monday 16 July 2007 By Mark Wilson

This content is 20 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

I spent most of today trying to get some ISA Server 2000 web proxy clients to access a web application using HTTPS on a non-standard port (4443). The issue was further complicated by the fact that the application server needed to be accessed using an upstream proxy server. Once the network manager had verified that the upstream proxy could access HTTPS requests on 4443 (and I had tested using my browser and the upstream proxy settings), it took me a while to work out why ISA Server wasn’t forwarding the requests. Instead, my proxy logs were showing some strange results:

sourceip anonymous Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) 2005-07-15 15:13:13 isaservername – targetserver – 4443 – 212 2855 SSL-tunnel CONNECT – – 407
sourceip anonymous Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) 2005-07-15 15:13:13 isaservername – targetserver – 4443 – 316 537 SSL-tunnel CONNECT – – 407
sourceip domainname\username Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) 2005-07-15 15:13:13 isaservername – targetserver – 4443 – – – SSL-tunnel – targetserver:4443 Inet 12204

Because the logs suggested that the ISA server was forwarding requests to the Internet, I thought that I needed to set up another destination set for the application server and a separate routing rule for access to this server using the non-standard port number. That turned out to be completely wrong (and I’ve since removed both the new destination set and the routing rule). I still don’t know why the 407 errors occur (HTTP client error 407 means proxy authentication required) but the 12204 error led me to the answer, which is contained in Microsoft knowledge base article 283284.

“With secure socket layer (SSL) tunneling, a client can establish a tunnel through ISA Server directly to the web server by using the requested HTTPS object. Whenever a client browser requests an HTTPS object through ISA Server, it uses SSL tunneling. SSL tunneling works by default for outgoing client requests to ports 443 and 563.”

The article also includes the VBScript code to add a port to the ISA Server’s tunnel port range. Depending on the version of ISA Server in use, this information is stored in a different location:

For ISA Server 2000 Standard Edition, ISA Server 2000 Enterprise Edition (standalone mode), and ISA Server 2004 Standard Edition: ISA storage is maintained in the registry.
For ISA Server 2000 Enterprise Edition (array mode): ISA Storage is maintained in Active Directory.
For ISA Server 2004 Enterprise Edition: ISA Storage is maintained in the Active Directory application mode (ADAM) configuration storage server).

Although the code to do this is contained within the Microsoft article, Jim Harrison has made the script available for download from his ISA Server tools repository. Once I had edited the script to change the port number to 4443, I ran it on one of the array members and force refreshed the settings by selecting the array in the ISA Management console and pressing F5. What none of the newsgroup information I found on this topic told me (although to be fair the Microsoft article says that a restart of the Microsoft ISA Server Control service is required) is that it also didn’t take effect until I restarted the web proxy service on my ISA Servers. Another item to note from the Microsoft article is that the script does not produce any output if it succeeds and if it is run again, it will produce an error because the range being set already exists.

Once I had restarted the web proxy service, my clients could access the web application using port 4443 and the ISA Server logs showed a successful connection via the upstream proxy server:

sourceip domainname\username Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) 2005-07-15 16:56:01 isaservername – upstreamproxyname upstreamproxyip upstreamproxyport – 726 2258 SSL-tunnel – targetserver:4443 Upstream 995

Virtual PC and Virtual Server performance issues

Posted on Friday 15 July 2005Monday 16 July 2007 By Mark Wilson

I used to use Microsoft Virtual PC 2004 on my work PC (e.g. running my work environment inside a VM so that I can easily resurrect it after a rebuild) but I found that performance was abysmal after I resumed from hibernation. Well, it seems it wasn’t just me having issues and Thomas Lee reports that Microsoft knowledge base article 889677 describes a hotfix for the issue. Nowadays I’m using Microsoft Virtual Server 2005 on a Windows Server 2003 SP1 machine and having performance issues when I run more than one VM (each guest is slow to respond to keyboard/mouse actions). In fairness, the host is a notebook PC, and it is running Windows SharePoint Services too, but there are no performance issues on the host – just the guests. It would seem logical to suspect a slow laptop hard disk as the cause, but there are no obvious signs of large amounts of disk activity. John Howard blogged about performance when running Windows Server 2003 SP1 as a guest, but I can’t find anything about poor host performance. I guess I’ll have to wait for Virtual Server 2005 service pack 1.

Preview of the new features expected in Exchange Server 2003 service pack 2

Posted on Tuesday 12 July 2005Monday 16 July 2007 By Mark Wilson

My colleague Neil Chapman sometimes blogs about Exchange Server’s mobility features, including some of what is coming in Exchange Server 2003 service pack 2 (SP2) later this year. Microsoft have also published a preview of the new features we can expect to see including:

Mobile e-mail improvements (Neil is best placed to comment on these).
Better protection against unsolicited commercial e-mail (commonly known as spam) with an updated intelligent message filter (IMF) and support for sender ID (which has now been approved by the Internet engineering steering group – the approval board of the Internet engineering task force – as an experimental standard, along with the competing sender policy framework technology).
Mailbox advancements (most significantly the raising of the 16Gb information store limit on Exchange Server 2003 standard edition to 75Gb, new features for enforcing cached mode, and a new offline address book format).

Using a mobile phone to help out in a crisis – with ICE

Posted on Tuesday 12 July 2005Monday 16 July 2007 By Mark Wilson

I’ve received this from a couple of sources and it seems to be both genuine and a really good idea. Since last Thursday’s attacks in London, this campaign has gained a lot of momentum and many people will already have received e-mail about this but just in case you haven’t seen it, then I’m sending it to your feed reader!

The East Anglian Ambulance NHS Trust have launched a national “In Case of Emergency” (ICE) campaign. The idea is that you store the word “ICE” in your mobile phone address book, along with the number of the person you would wish to be contacted in case of emergency.

In an emergency situation ambulance and hospital staff will then be able to quickly find out who your next of kin are and be able to contact them. It’s so simple that everyone can do it.

For more than one contact name, multiple ICEs can be defined (ICE1, ICE2, ICE3, etc.).

Quoting from the original ICE press release:

“A Cambridge-based paramedic has launched a national campaign with Vodafone to encourage people to store emergency contact details in their mobile phones.

Bob Brotchie, a clinical team leader for the East Anglian Ambulance NHS Trust, hatched the plan last year after struggling to get contact details from shocked or injured patients.

By entering the acronym ICE â€“ for In Case of Emergency â€“ into the mobileâ€™s phone book, users can log the name and number of someone who should be contacted in an emergency.

The idea follows research carried out by Vodafone that shows more than 75 per cent of people carry no details of who they would like telephoned following a serious accident.

Bob, 41, who has been a paramedic for 13 years, said: ‘I was reflecting on some of the calls Iâ€™ve attended at the roadside where I had to look through the mobile phone contacts struggling for information on a shocked or injured person. Itâ€™s difficult to know who to call. Someone might have ‘mum’ in their phone book but that doesnâ€™t mean theyâ€™d want them contacted in an emergency. Almost everyone carries a mobile phone now, and with ICE weâ€™d know immediately who to contact and what number to ring. The person may even know of their medical history.'”

More information is available at the ICE – In Case of Emergency website.

Internet Explorer displays credentials in status bar when used as an FTP client

Posted on Monday 11 July 2005Monday 16 July 2007 By Mark Wilson

A couple of weeks back, one of my clients pointed out that when he opens files from an FTP site using Internet Explorer (IE) as an FTP client his user name and password is displayed in the status bar at the bottom of his browser window.

FTP credentials visible in IE status bar

I seem to have the same problem with various flavours of Windows (2000, XP and 2003), a variety of IE patch levels, and can repeat it against both Unix and Windows-based FTP servers. I’ve not been able to test with older browser versions but as IE6 is the current version, this is my main concern.

One would think that there would be loads of information out on the ‘net about this but I can’t find much at all (except some reference to the issue in an internetfixes.com tip), which seems to suggest IE6 SP1 fixed this strange behaviour. Indeed, I built a PC with Windows XP SP1 (slipstreamed) and the issue was not there; however it reappeared after I upgraded to Windows XP SP2. I know the password will always be passed over the wire in clear text, and that RFC 2396, which defines the generic syntax for URIs (specifically section 3.2.2) recommends against the use of the format “user:password” in the userinfo field of the URL, but that’s just the way that FTP has been implemented! All I want to do is to prevent IE from displaying it in the status bar. As for ISA Server capturing the details in the proxy server logs… well that’s a whole new can of worms.

The strange thing is that a colleague who is using the same Internet Explorer version as me (6.0.2900.2180.xpsp_sp2_gdr.050301.1519 at update version SP2) can not repeat the issue.

It doesn’t help that IE version numbers don’t seem to increment as patches are applied. There is an interesting discussion of the merits of the Microsoft IE version number approach vs. the Mozilla Firefox approach in the comments to the April IE Security Update is available post on the IEBlog, and for anyone searching for information on the various versions of IE, the version numbers and associated Windows operating system version are all listed in Microsoft knowledge base article 164539. What I can’t find is any information on the fixes which update the last portion of the version number (i.e. from 6.0.2900.2180.xpsp_sp2_rtm.040803-2158 to 6.0.2900.2180.xpsp_sp2_gdr.050301.1519), although Microsoft knowledge base article 824994 does describe the significance of release to manufacturing (RTM), general distribution release (GDR), service pack (SPX) and quick fix engineering (QFE) software update packages and there is an article about the package installer (formerly called update.exe) for Microsoft Windows operating systems and Windows components in the Microsoft Windows Server 2003 TechCenter, which describes the multiple-branch-aware structure used for Microsoft patches.

I’ve spent hours loading patches one by one onto a client to see if the issue is resolved as a side-effect of a posted hotfix but can’t seem to get anywhere on this. The only answers I hear are “use the insert product name here FTP client” (incidentally, my preference is FileZilla) or “use SFTP”. What I’d like to hear is “apply Microsoft update xxxxxx“.

Towards operational excellence on the Microsoft platform

Posted on Monday 11 July 2005Monday 16 July 2007 By Mark Wilson

I was sorting out my den/office this weekend and came across a Microsoft operational excellence resource CD. The concept seems quite good (although the content seemed a little out of date, even bearing in mind that it had sat in a pile of “stuff to look at when I have time” for 10 months); however, the operational excellence section of the Microsoft website is worth a look.

The mobile networks didn’t collapse

Posted on Friday 8 July 2005Tuesday 27 January 2009 By Mark Wilson

Following yesterday’s atrocities in London, it was widely reported that the mobile phone networks collapsed under the strain of those caught up in the chaos trying to contact their friends, family, work colleagues and vice versa.

In a statement from Vodafone yesterday lunchtime:

“The news networks have been reporting that Vodafone have shut down the network to ordinary users in the London area because of the incidents reported this morning. This is NOT the case, although customers will be experiencing severe congestion in the London area. However, [The Metropolitan Police] have asked us to invoke [ACcess Over Load Control (ACOLC), which restricts the network to emergency services only] in one base station in the Kings cross area, and this should be switched on imminently.”

Anyone worried about relatives or friends they have not heard from is advised to contact a special police hotline on +44 (0)870 156 6344.

The wonderful thing about web standards

Posted on Wednesday 6 July 2005Tuesday 17 July 2007 By Mark Wilson

Alex and I were having a ~~rant~~ discussion a few days back about web standards after I pointed out to him that Firefox and Safari not being able to supply login credentials within a URL meant they were not RFC-compliant in this respect (and he accused me of being sponsored by Microsoft)!

I know that there are many pieces of Microsoft software where the standards have been “extended” or “enhanced” and this week I heard that they are going to extend RSS when it is integrated into the next version of Windows (codenamed Longhorn); but we had both hoped that the Mozilla browsers would be better in this respect (in general, they are).

I like Firefox. In fact the only reason that I’ve gone back to Internet Explorer (IE) is that a huge number of websites (about 10% according to IT Week) only work properly with IE and some mis-identified Firefox as a very old Netscape browser. Now that IE’s market share has slipped to about 85% and Firefox is gaining momentum, all we need to do is to persuade web designers to code sites to work with all common browsers.

It would be so much easier for web designers, IT administrators, and IT architects alike if all browsers complied with standards. In another IT Week article, Bill Pechey highlights a UK government department of trade and industry (DTI) report that suggests standards promote healthy growth.

I’m hoping that Microsoft’s forthcoming IE 7 browser will be fully web standards compliant (and if it has to support Microsoft-proprietary extensions as well then that is fine as long as it can properly render standard pages). That remains to be seen but meanwhile it’s good news that Microsoft is collaborating with the Web Standards Project to promote open standards.

(and just to show that I’m not biased…).

Readvertising failed packages with Microsoft SMS

Posted on Wednesday 6 July 2005Tuesday 18 September 2012 By Mark Wilson

A few weeks back, my colleague Barry Feist gave me a useful tip for when deploying software using Microsoft Systems Management Server (SMS). Barry doesn’t have his own blog, so here are the details.

Details of commands executed on the local machine by SMS are held at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\Mobile Client\Software Distribution\Execution History\packageid. It is not uncommon for there to be a failure within a distribution, so to rerun a failed installation, delete the key and re-advertise the package. According to the how to re-advertise a package post on MyITForum, Microsoft knowledge base article 257271 gives an alternative solution but Barry’s solution seems simpler to me.