One of the requirements for SQL Server Reporting Services (SSRS) in the 2000 and 2005 releases was that Microsoft’s Internet Information Services (IIS) was required as the Web Services product for running the Report Manager and Report Server applications. The good news was that, at least, we could run these applications on a separate Web Server machine allowing top security for the SQL Server. But Microsoft would charge us extra to do this. Running IIS on your database server was never a good idea for security – locked down or not. I have been testing SQL Server 2008 and can report that SSRS no longer requires the use of IIS at all. This is good news. Let’s take a look why…
When you installed Windows 2000 Advanced Server, IIS was automatically installed and automatically started making your machine a web server by default. When you installed SQL Server 2000 it installed the DBMS with a blank password on the sa account by default. Many DBAs installed SQL Server at that time and did not realize that their data was wide open to the world. Worse still, this could allow a remote attacker to gain elevated privileges and use stored procedures like xp_cmdshell to access the OS directly. Those were the days! Not surprisingly, the SQL Slammer appeared in 2003 and gave us all a wakeup call with a severe lesson in denial of service. It could have been much worse. To its credit, Microsoft embarked on the Trustworthy Computing initiative and started locking down its products at that time.
Starting with Windows Server 2003, we had to explicitly install IIS only if and when we needed it. This was good for security. Secure by default. So when SSRS was released it was a disappointment that we had to install IIS to support it. OK, as mentioned, we could install IIS on a separate web server machine, but then Microsoft would come looking for an extra SQL Server license because this is the scale-out solution that “adds value” via better performance. No thought of purely trying to control security. In order to save money, we were forced to compromise security.
Now in SQL Server Reporting Services 2008, we do not need IIS at all. The Report Manager and Report Server applications can be supported using the HTTP listener (http.sys) that is already part of Windows 2003 Server and above. This is a much more secure architecture. I tested this out on my upgraded test server. I was able to stop my existing IIS service and still run my existing reports successfully.
This is a huge step in the right direction and allows us to implement a secure solution on a single server if we choose. Microsoft calls this being “IIS Agnostic”. This will enhance security and save us money.
Believe it or not.
Cheers
Brian
Recent posts:
SQL Server 2008 Performance Benchmarks – a political position
