Microsoft Server Appliance Kit 3.0

The Microsoft® Server Appliance Kit 3.0 includes a variety of tools for creating remotely administered, fixed-function server appliance products using the frameworks provided by the Microsoft Windows® Server 2003 family of operating systems. Using the Server Appliance Kit, you can:

  • Design hardware platforms that provide enhanced reliability and manageability for the server appliance. The Server Appliance Kit provides a hardware reference specification and a reliability framework that allows software on the server to monitor critical system resources and maintain the server state.
  • Develop software applications that provide additional functionality that builds on the Windows Server 2003 family of operating systems and the Server Appliance Kit platforms. Depending on the nature of these applications, end users can access these applications through a local user interface (UI) consisting of a small liquid crystal display (LCD) and keypad or a Web-based UI.
  • Create server-appliance master disk images that can be manufactured in quantity.

Server Appliance Kit 3.0 documentation

The Server Appliance Kit includes comprehensive documentation that guides you through the process of creating, customizing, and manufacturing a server appliance.

For more information about the Server Appliance Kit 3.0, see Server Appliance Kit 3.0 overview.

For information about enhancements made to the Server Appliance Kit since the previous version, see Changes in this version.

If you plan to use the Server Appliance Kit to:

  • Design hardware platforms that can utilize the reliability features in the Server Appliance Kit, see Documentation for hardware designers.
  • Develop software applications that utilize the Web-based or local UI that is supported by the Server Appliance Kit, see Documentation for software developers.
  • Manufacture a server appliance built on the features provided by the Server Appliance Kit, see Documentation for equipment manufacturers and resellers

Copyright© 2000-2003 Microsoft Corporation. All rights reserved.


Server Appliance Kit 3.0 overview

With the Microsoft® Server Appliance Kit 3.0, original equipment manufacturers (OEMs) can develop fixed-function, remotely-administered server appliances. Using the software development kit (SDK), OEMs can quickly customize devices using the software frameworks provided by the Server Appliance Kit to meet the specific requirements of their server appliance.

While you can extend a general-purpose server after purchase by adding both hardware and software applications, server appliances are fixed-function devices. Such devices require a much simpler installation procedure and eliminate post-purchase upgrade problems. As a result, the device is much easier for the average user to install, and support costs are significantly reduced.

The Microsoft Server Appliance Kit platform provides of the following frameworks that an OEM can use to develop a server appliance:

  • Web User Interface framework
  • Local User Interface framework
  • Localization framework


Chagnes in this version

Server Appliance Kit

Changes in this version

New paths to Web UI framework files

To avoid conflicts with certain Windows Server 2003 files, the Server Appliance Kit 3.0 installs localized files in a different location than in previous versions:

  • Localized Web UI framework and local UI framework resources are now located in %systemroot%\system32\ServerAppliance\mui3.
  • Localized Help files for Web UI add-ins are now located in %systemroot%\system32\ServerAppliance\web\Admin\help3.

Security enhancements

The Web User Interface (UI) framework of the Server Appliance Kit 3.0 contains two new features that help prevent the server from being attacked through the Web UI. The two methods of attack addressed by these new features utilize access to parent directories of active server pages and cross-site scripting.

Parent paths

An important change in the Server Appliance Kit 3.0 that may affect your current Active Server Pages (ASP) applications is that parent paths are not enabled for ASP applications by default. When parent paths are not enabled, an ASP page cannot use paths that are relative to the current directory (using the ../ notation). Enabling parent paths is a potential security risk because an "include" path can access critical or confidential files outside the root directory of the application.

For example, ASP pages developed for earlier versions of the Server Appliance Kit could contain the following instructions:

<!-- #include file="../inc_framework.asp" -->
<!-- #include file="./myincludefile.asp" -->

To run correctly on a server appliance created using the Server Appliance Kit 3.0, these directives must use the following syntax:

<!-- #include virtual="/admin/inc_framework.asp" -->
<!-- #include file="myincludefile.asp" -->

The first line in this example specifies an absolute path to the "include" file, avoiding the relative path that can be used to gain access to files outside of the root directory.

The use of the virtual keyword applies to the framework files in the Admin folder.

To provide maximum security, Microsoft recommends that any subfolders of the Web/Admin folder that you create inherit their permissions from the parent folder.

Cross-site scripting

A cross-site scripting attack can occur when a user unknowingly runs a malicious script that takes advantage of a user's authenticated connection to a computer or a Web site. In many cases, the malicious code sends a script to a form on another Web site causing that code to be executed with the user's privileges on that site. In other cases, it is not necessary for code to be sent to a form. Instead, the malicious code is directly executed by the user's computer, taking advantage of the user's privileges on that computer.

The Web UI framework has been enhanced to prevent this type of attack. The Web UI framework of the Server Appliance Kit 3.0 requires an ASP application using the Web UI framework to obtain and supply a session-specific secret key before the Web UI framework follows a hyperlink or accepts input through a form. You obtain the key by calling the SAI_GetPageKey function defined in inc_pagekey.asp. This function assigns the key the value of the SAI_FLD_PAGEKEY variable. You can then use this variable to pass the key as part of the hyperlink request or form-input validation.

The following code example illustrates how to use this function to obtain and pass the key to a form.

<FORM>

   <INPUT TYPE=”hidden” NAME=”<%=SAI_FLD_PAGEKEY%>” VALUE=”<%=SAI_GetPageKey()%>”>

</FORM>

In the following example, the SAI_GetPageKey function is used in an anchor tag to confirm that the requesting page is part of the administration site and is included in the current user’s session.

<A HREF=”/admin/samplepage.asp?<%=SAI_FLD_PAGEKEY%>=<%=SAI_GetPageKey()%>&otherarg=1">click here</A>

Finally, this example shows how to pass the value of SAI_FLD_PAGEKEY to the SA_MungeURL function.

<SCRIPT LANGUAGE=”Javascript”>
    function GoSomewhere()

    {

        var strURL = g_strDestinationURL;

        strURL = SA_MungeURL(strURL, SAI_FLD_PAGEKEY, g_strSAIPageKey);
        // These last two arguments are client-side variables declared by inc_pagekey.asp.

        top.location.href = strURL;

    }

</SCRIPT>

It is not necessary to call SAI_GetPageKey when constructing a URL to pass to a Web UI framework function, such as setting the URL for an Object/Task Selector task or calling SA_ServeOnClickButton. SAI_GetPageKey is required only when linking directly from one add-in page to another within the Web UI framework. Do not call SAI_GetPageKey when linking to a page outside the Administration web site (for example, to a page on the World Wide Web) because the page will not be able to use the page key, and the key will be sent on the network in plain text, creating a security risk.


Documentation for hardware designers

The Server Appliance Kit 3.0 provides Hardware Development Kit (HDK) documentation that describes how to design computer systems that can make use of the local UI and reliability frameworks included with the Server Appliance Kit. For information about developing server appliance computer systems, see Hardware Development Kit on the Server Appliance Kit 3.0 CD-ROM.

If you want to use the HDK documentation on a computer without the Server Appliance Kit CD-ROM, you can copy the HDK documentation files to a hard disk drive on that computer. If you choose to do so, you must copy the following files to the same directory on the hard drive:

File Name | Description
sakhdk.chm | Contains the HDK documentation.
saksc.chm | Contains shared style sheets and scripts.
sakart.chm | Contains shared art used in the HDK documentation.

After copying the files, open sakhdk.chm to view the HDK documentation.


Documentation for software developers

The Server Appliance Kit 3.0 provides Software Development Kit (SDK) documentation that describes how to develop software applications that can make use of the Web User Interface (UI) and the local UI frameworks included with the Server Appliance Kit, along with the Localization framework that simplifies the task of supporting multiple languages on the server. For information about developing these applications, see Software Development Kit on the Server Appliance Kit 3.0 CD-ROM.

If you want to use the SDK documentation on a computer without the Server Appliance Kit CD-ROM, you can copy the documentation files to a hard disk drive on that computer. If you choose to do so, you must copy the following files to the same directory on the hard drive:

File Name | Description
saksdk.chm | Contains the SDK documentation.
saksc.chm | Contains shared style sheets and scripts.
sakart.chm | Contains shared art used in the Web UI framework documentation.

After copying the files, open saksdk.chm to view the SDK documentation.


Documentation for equipment manufacturers and resellers

The Server Appliance Kit 3.0 provides OEM Preinstalltion Kit (OPK) documentation that describes how to manufacture computer systems that take advantage of the features provided by the Software Appliance Kit. For information about manufacturing these systems, see OEM Preinstallation Kit on the Server Appliance Kit 3.0 CD-ROM.

To use the OPK documentation on a computer without the Server Appliance Kit CD-ROM, copy the documentation files to a hard drive on that computer. If you choose to do so, you must copy the following files to the same directory on the hard drive:

File Name | Description
sakopk.chm | Contains the OPK documentation.
saksc.chm | Contains shared style sheets and scripts.
sakart.chm | Contains shared art used in the OPK documentation.

After copying the files, open sakopk.chm to view the OPK documentation.


Copyright

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, people, and events depicted herein are fictitious and no association with any real company, organization, product, person, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means–electronic, mechanical, photocopying, recording, or otherwise–or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

Copyright © 2000-2003 Microsoft Corporation. All rights reserved.

Microsoft, MS-DOS, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

Sample Code Rights and Restrictions

See the End User License Agreement for specific information regarding the rights and restrictions that apply to your use of the code samples provided.