IIS module install

Requirements

• Windows Server 2016 (Windows 10) or higher (64-bit)
• IIS 10 or higher
• Verify you have installed the Next-Gen WAF agent for Windows. This will ensure the appropriate folder structure is in place on your file system.

Before you begin

• We only support 64-bit OSes (including 64-bit application pools). For older or 32-bit versions of Windows, it is possible to deploy the Next-Gen WAF agent as a reverse proxy. If you have questions or require assistance with older or 32-bit versions of Windows, reach out to our support team.
• IIS Module v2.0 and higher includes the utility sigscictl.exe which outputs diagnostic information. The information provided by this utility is useful for troubleshooting issues and checks, among other things, whether or not 32-bit app pools are enabled on your server.

Download

The latest version of the IIS module can be downloaded as an MSI installer or a legacy ZIP archive from https://dl.signalsciences.net/?prefix=sigsci-module-iis/.

Alternatively, the IIS module is also downloadable via Nuget.

Installation

The IIS Module is available as an MSI installer or as a legacy ZIP archive. The install packages contain a DLL that must be configured as an IIS native module and a configuration schema that must be registered with IIS. This configuration and registration with IIS is done automatically by the MSI package, or must be done manually if using the legacy ZIP archive.

Install using the MSI

Double-click (or right-click and select install) the MSI file to install it.

Alternatively, for unattended installation, use the following command. This command will not display any output, but will install into %PROGRAMFILES%\Signal Sciences\IIS Module by default. It will also register the Next-Gen WAF module and configuration with IIS:

$ msiexec /qn /i sigsci-module-iis_latest.msi

If you require an alternative install location, specify it with the INSTALLDIR=path option to the msiexec.exe command above. For example:

$ msiexec /qn /i sigsci-module-iis_latest.msi INSTALLDIR=D:\Program Files\Signal Sciences\IIS Module

Legacy install using the ZIP archive

1. Extract the ZIP archive contents to the IIS Module install directory (C:\Program Files\Signal Sciences\IIS Module).

2. Open a terminal running as Administrator.

3. Configure IIS to load the Next-Gen WAF module and register the configuration schema.

   $ cd "%PROGRAMFILES%\Signal Sciences\IIS Module"
   $ .\SigsciCtl.exe Install

If you need to install into an alternative location, then you will need to run the Register-Module -file DLL-path, Register-Config -file XML-path and optional Configure-Module commands with the SigsciCtl.exe utility (see SigsciCtl.exe Help for more information). Ensure the SigSciIISModule.dll is not located under the C:\Users\ directory or its sub-directories. For security, Windows prevents DLL files from being loaded from any location under C:\Users\.

Verify installation

To confirm the module DLL has been registered with IIS, run the following from a terminal running as Administrator to verify the SignalSciences module is listed:

$ "%PROGRAMFILES%\Signal Sciences\IIS Module\SigsciCtl.exe" Get-Modules

The output should look similar to the following:

IIS Global Modules:

                            Name Image                                                                    Precondition
-------------------------------- ------------------------------------------------------------------------ ------------------------
               HttpLoggingModule %windir%\System32\inetsrv\loghttp.dll
                  UriCacheModule %windir%\System32\inetsrv\cachuri.dll
                 FileCacheModule %windir%\System32\inetsrv\cachfile.dll
                TokenCacheModule %windir%\System32\inetsrv\cachtokn.dll
                 HttpCacheModule %windir%\System32\inetsrv\cachhttp.dll
         StaticCompressionModule %windir%\System32\inetsrv\compstat.dll
           DefaultDocumentModule %windir%\System32\inetsrv\defdoc.dll
          DirectoryListingModule %windir%\System32\inetsrv\dirlist.dll
           ProtocolSupportModule %windir%\System32\inetsrv\protsup.dll
                StaticFileModule %windir%\System32\inetsrv\static.dll
   AnonymousAuthenticationModule %windir%\System32\inetsrv\authanon.dll
          RequestFilteringModule %windir%\System32\inetsrv\modrqflt.dll
               CustomErrorModule %windir%\System32\inetsrv\custerr.dll
 ApplicationInitializationModule %windir%\System32\inetsrv\warmup.dll
                  SignalSciences C:\Program Files\Signal Sciences\IIS Module\SigsciIISModule.dll          bitness64

To confirm that the module configuration has been registered, run the following from a terminal running as Administrator to output the current configuration:

$ "%PROGRAMFILES%\Signal Sciences\IIS Module\SigsciCtl.exe" Get-Configs

The output should look similar to the following but may also list sites individually:

C:\WINDOWS\system32\inetsrv\config\schema:

Date                         Size Name
-------------------- ------------ --------------------------------
2020-02-13 03:12:56Z          677 SignalSciences_schema.xml

"SignalSciences" Configuration Section (Global):

                       Attribute Value
-------------------------------- ----------------------------------------------------------------
                       agentHost
                       agentPort 737
                  statusPagePath
                           Debug False
                ReuseConnections False
                     MaxPostSize 100000
                     AnomalySize 524288
           AnomalyDurationMillis 1000
                   TimeoutMillis 200

Full diagnostics information can be displayed with the following command:

$ "%PROGRAMFILES%\Signal Sciences\IIS Module\SigsciCtl.exe" Info

Configure

Configuration changes are typically not necessary. By default, the module will use port 737 to communicate with the agent (or in v2.0.0+, if the agent was configured to use an alternate port, it will use that port). The configuration can be set via the MSI installer, the new SigsciCtl.exe utility in v2.0.0+, IIS Manager UI, via PowerShell, or using the appcmd.exe utility.

Using the MSI

To set a configuration option when installing the MSI, specify the option on the command line in option=value format. For example:

$ msiexec /qn /i sigsci-module-iis_latest.msi agentHost=203.0.113.182 agentPort=737

Using SigsciCtl.exe

To set a configuration option via SigsciCtl.exe utility after install, use the Configure-Module command. For example:

$ "%PROGRAMFILES%\Signal Sciences\IIS Module\SigsciCtl.exe" Configure-Module agentHost=203.0.113.182 agentPort=737

To view the active configuration via the SigsciCtl.exe utility the Get-Configs command:

$ "%PROGRAMFILES%\Signal Sciences\IIS Module\SigsciCtl.exe" Get-Configs

This should output something similar to the following:

C:\WINDOWS\system32\inetsrv\config\schema:

Date                         Size Name
-------------------- ------------ --------------------------------
2020-02-13 03:12:56Z          677 SignalSciences_schema.xml

"SignalSciences" Configuration Section (Global):

                        Attribute Value
-------------------------------- ----------------------------------------------------------------
                        agentHost
                        agentPort 737
                  statusPagePath
                           Debug False
                  ReuseConnections False
                     MaxPostSize 100000
                     AnomalySize 524288
            AnomalyDurationMillis 1000
                     TimeoutMillis 200

Using PowerShell

To set a configuration option via PowerShell (modern Windows only) use the -SectionPath "SignalSciences" option such as follows:

$ Set-IISConfigAttributeValue -ConfigElement (Get-IISConfigSection -SectionPath "SignalSciences") -AttributeName "agentPort" -AttributeValue 737

To list the configuration using PowerShell, run the following:

$ (Get-IISConfigSection -SectionPath "SignalSciences").RawAttributes

To reset the configuration to defaults using PowerShell, run the following:

$ Clear-WebConfiguration -Filter SignalSciences -PSPath 'IIS:\'

Using the appcmd.exe

To set a configuration option via the appcmd.exe command line tool use the -section:SignalSciences option. For example:

$ "%SYSTEMROOT%\system32\inetsrv\appcmd.exe" set config -section:SignalSciences -agentPort:737

To list the configuration using appcmd.exe, run the following. Default values will not be shown:

$ "%SYSTEMROOT%\system32\inetsrv\appcmd.exe" list config -section:SignalSciences

To reset the configuration to defaults using appcmd.exe, run the following:

$ "%SYSTEMROOT%\system32\inetsrv\appcmd.exe" clear config -section:SignalSciences

Uninstall

1. Open a terminal running as Administrator.

2. Run the following in the terminal:

   $ cd "\%PROGRAMFILES%\Signal Sciences\IIS Module"
   $ .\SigsciCtl.exe Uninstall

Upgrade

To upgrade the IIS module, download and install the latest version of the IIS module and then verify that the module configuration is still valid.