Developing in ASP 2.0?

[Daniel Griscom]

I'm a beginning ASP programmer, doing some fairly basic dynamic server
work for a client. Problem: they are EXTREMELY security-conscious, and
as a part of that are still running ASP 2.0. So, I need to set up a
development system for ASP 2.0 that warns me when I use ASP 3.0/ASP.NET
features.

I'm running Win2K with all updates, with the included IIS installed. It
includes ASP, but I don't know what version. So, my questions:

- How can I determine what version of ASP I have?

- Any suggestions on what tools I should be using to limit features to
ASP 2.0? (My understanding of the ASP.NET tools is that they tend to
hide all the behind-the-scenes implementation details; this would be a
problem here because they'd certainly use post-2.0 features.)


Thanks,
Dan

 

[Tom Kaminski [MVP]]

I'm a beginning ASP programmer, doing some fairly basic dynamic server
work for a client. Problem: they are EXTREMELY security-conscious, and
as a part of that are still running ASP 2.0. So, I need to set up a
development system for ASP 2.0 that warns me when I use ASP 3.0/ASP.NET
features.

I'm running Win2K with all updates, with the included IIS installed. It
includes ASP, but I don't know what version. So, my questions:

- How can I determine what version of ASP I have?

If it's W2K, then it's ASP 3.0.

- Any suggestions on what tools I should be using to limit features to
ASP 2.0? (My understanding of the ASP.NET tools is that they tend to
hide all the behind-the-scenes implementation details; this would be a
problem here because they'd certainly use post-2.0 features.)

ASP.NET has nothing to do with ASP, so you certainly couldn't use ASP.NET
and expect to remain ASP 2.0 compliant. Is you're client still running
Windows NT? They'd have to be if they are "still running" ASP 2.0.

Here's what's new from 2.0 to 3.0 (IIS4 to IIS5):
http://www.microsoft.com/windows2000/en/server/iis/htm/asp/iiwanew.htm

and here's what's changed:
http://www.microsoft.com/windows2000/en/server/iis/htm/asp/iiwachng.htm

 

[Daniel Griscom]

If it's W2K, then it's ASP 3.0.

Well, that's clear.

ASP.NET has nothing to do with ASP, so you certainly couldn't use ASP.NET
and expect to remain ASP 2.0 compliant.

And that's clear, too. Thanks. (Still got some things to learn...)

Is you're client still running
Windows NT? They'd have to be if they are "still running" ASP 2.0.

Yes, they're using NT4. If I wipe my system and install NT4 will
IIS4/APS 2.0 come with it? Must I get NT Server versus NT Workstation?

Here's what's new from 2.0 to 3.0 (IIS4 to IIS5):
http://www.microsoft.com/windows2000/en/server/iis/htm/asp/iiwanew.htm

and here's what's changed:
http://www.microsoft.com/windows2000/en/server/iis/htm/asp/iiwachng.htm

Thanks for the help.
Dan

 

[Tom Kaminski [MVP]]

Yes, they're using NT4. If I wipe my system and install NT4 will
IIS4/APS 2.0 come with it? Must I get NT Server versus NT Workstation?

It can be Server or Workstation. Install IIS as part of the OS install,
then install the NT Option Pack to get it up to IIS4/ASP 2.0 ...

http://www.microsoft.com/ntserver/nts/downloads/recommended/NT4OptPk/default.asp

Make sure you then install SP 6a:
http://www.microsoft.com/ntserver/nts/downloads/recommended/sp6/default.asp

You and your security conscious client ; ) should also be aware that support
for NT4 is waning ...
http://www.microsoft.com/ntserver/ProductInfo/Availability/Retiring.asp

 

[gorf]

You and your security conscious client ; ) should also be aware that support
for NT4 is waning ...
http://www.microsoft.com/ntserver/ProductInfo/Availability/Retiring.asp

Not starting a flame war, but as someone still running IIS4 I always thought
I was taking additional risks by running NT4 rather than upgrading to Win2K
or Win2K3 with IIS5 or IIS6. How can IIS4 be more secure?

 

[Atrax]

Yes, they're using NT4. If I wipe my system and install NT4 will

IIS4/APS 2.0 come with it? Must I get NT Server versus NT Workstation?

I wouldn't bother doing a format and re-install. use
Win2000/IIS5.0/ASP3.0 and just steer clear of the ASP3.0-specific
features (so don't rely on buffering being on by default, don't use
Server.Execute or Server.transfer, kep an eye on the links you've
already been provided on the differences between the two) and you'll be
fine.

I've deployed more than one site from a Win2k development box to an NT4
server (a major client of ours here in Aus was still running NT4 until
very recently) and vice versa with no problems if you keep an eye on
what you're doing.





________________________________________
Atrax. MVP, IIS
http://rtfm.atrax.co.uk/

newsflash : Atrax.Richedit 1.0 now released.
http://rtfm.atrax.co.uk/infinitemonkeys/components/Atrax.RichEdit/

 

[James Monroe]

not always true.. sometimes the older os gets less attention from hackers...
etc etc

I had an nt web serer for many years... and just recently started using 2000
on a new box
the nt server never had any problems... the 2000 box has had a few incidents
already

but it really all depends...

just like how some of the Microsoft updates in the past did more harm than
good though a rare occurrence

might as well run the latest and greatest if you can I suppose...

 

[Phillip Windell]

or Win2K3 with IIS5 or IIS6. How can IIS4 be more secure?

IS4.0 doesn't do WebDav, so it is not vulnerable to the lastest Worms
that use the WebDav vulnerability. In fact, none of the lastest
"blaster-like" worms will work in NT4.0/IIS4.0. So in the last couple
weeks, NT4.0 machines are safer to use the Win2k machines.

--

Phillip Windell [CCNA, MVP, MCP]
(e-mail address removed)
WAND-TV (ABC Affiliate)
www.wandtv.com

 

[Daniel Griscom]

Thanks for all your help. Some responses:

Tom Kaminski: thanks for all the detailed information, it really puts me
on the right path. The links are icing on the cake. Many thanks.

Gorf: my client is a hospital, with highly draconian security procedures
in order to protect patient data. They feel that sticking with NT4
leaves them with a known platform, with known vulnerabilities. Upgrading
to Microsoft's "latest and greatest" often fixes bugs, but sometimes
adds new vulnerabilities that may not be discovered until after an
intrusion. (They'll be upgrading to Win2K in a few months, but not in
time for this project.)

Atrax: yes, rather than wiping my machine and going to WinNT4/ASP2.0 it
would be easier to stick with Win2K/ASP3.0 and just avoid new features.
Unfortunately, I don't know enough ASP to reliably avoid new features.
I'd rather spend the couple of hours (nothing lost, since the machine
was just wiped for Win2K) and then KNOW that anything that works on my
machine will work on my customer's.


Thanks to all for the great info,

Dan

 

[Daniel Griscom]

A final note on this topic. Atrax had said "don't
bother wiping and going to WinNT 4; just use
Win2K", and I said it was worth the bother. I
subsequently spent two days struggling to get NT4
to recognize my network card (3Com, but on a
motherboard with both PCI and ISA slots). I also
discovered that NT didn't understand USB. I guess
I hadn't realized just how primitive NT4 was (even
as Windows OSs go).

I finally gave up and went back to Win2K, and will
have to, as suggested, "steer clear of the ASP
3.0-specific features."


Thanks again,
Dan