Visual Studio 2005 SP1 - ADS "Zone.Identifer" stroke again

Today, in order to get a new virtual machine up and running with Windows 2003 ready for .NET development I installed the free trial version of Visual Studio 2005. Usually I have got a CD with me and this time they were away (I left them back in Paris). So, I have downloaded a version from the web (Visual Studio 2005 SP1).

First issue: Error 1305 (MSI)

I tried to installed and got the 1305 error preventing the MSI to run properly ("Verify that the file exists and that you can access it").

I was again a victim of "the blocked file" (see my other blog entry IIS WEB issue ). Because, I downloaded the file from the web directly into my virtual machine (instead of using my CD/DVD) the file had an extra information "Zone.Identifier" attached top it (new use of ADS as part of the security improvement on Windows 2003 SP1). I checked the properties using Windows Explorer and I "unblocked" the file.
I shut downed the machine and rebooted it 3 times before I understood what was going on.

Before the installation kicks-off, some files need to be extracted from the MSI. When the files were extracted from the MSI into a temporary folder, they were added some extra information such as "Zone.Identifier" (I am assuming this was due to the fact that the main file setup/cab/msi files had that extra ADS information to them).
This was preventing the extraction to go further. I had to delete the temporary folder.

Second Issue: "SAFER" checks

That permitted the process to go a bit further, but it raised another issue (Error 1718):


Before the installation kicks-off, some files need to be extracted from the MSI and some "SAFER" checks are applied to them. This is documented on Heath Stewart's Blog and Microsoft web site. This was preventing the checking steps to go further. I had to install the hotfix "KB925336":


The installation was then able to finish without any further issue.

In Summary

So, here are the tips when downloading files from Internet (or other network resource) in order to install software on Windows 2003 SP1 (or above, or Windows XP SP2. I do not know about Vista, but usually Security improves and 'usability' has to give up ;)):

• Do not forget to unblock the file (e.g. using Windows Explorer). Obviously, you have to trust the source of the file, that is your responsability.
  
• If you have already run the setup file, make sure to remove all temporarily files created (they should be deleted when an installation is aborted or finished, but it is not always the case).
• Where are the temporarily files?
• Well look at your environment variables (using a command line window and the "set" command). Look for the variables "TEMP" and "TMP". Be careful, those settings are set at the user level, so check them for the user account you are using to do the installation.

I have installed VS 2005 SP1, so I think I will soon develop a quick tool that scan for ADS information on the files.

Security Measures to take into account when designing web sites

• Always create at least two network boundaries:
1. A DMZ (i.e. Front-end machine area)
• Web servers mainly, but it could have other machines used for communication, as long as:
• No customer data should be hold in this network boundary
• Machines in this boundary can only talk to machine on the next level down if that machine does not hold any confidential data (e.g. Customer Data, Partners data, Employees data, etc..)
2. A Back-end machine area
• Application servers
• Database servers containing confidential data migh be here (or a third boundary network could host them)
• Intranet web servers
• dqw
• A firewall must exits:
• In front of the DMZ
• Between the DMZ and the back-end area
• Machines in the F-E can trust machines in the B-E
• Machines in the B-E cannot trust machines/identities from the F-E
• If an Employee or Partner Web site must be available from the Internet area, it must be in a different DMZ (if possible).
• It is always a good thing to have two URLs for a web site:
1. http://www.mysite.com/ for normal browsing (port 80)
2. https://secure.mysite.com/ for secure browsing (port 443)
• This enables HTTPS to be handled by hardware
• The Encryption traffic will happen between the client’s browser and the public firewall in front of the DMZ
• In the DMZ, the HTTP request can be handled by the normal HTTP port (80). The application can still check whether this is a secure HTTP request by looking at the domain (http://www.mysite.com/ or secure.mysite.com).