Using Windows Server 2003 in a Managed Environment
Windows Media Services
It is beyond the scope of this white paper to describe all aspects of maintaining appropriate levels of security in an organization running servers that communicate across the Internet. This section, however, provides overview information as well as suggestions for other sources of information about balancing your organizations requirements for communication across the Internet with your organizations requirements for protection of networked assets.
Note: This section of the white paper describes Windows Media Services (the server component), but it does not describe Windows Media Player (the client component) or Internet Information Services (IIS), both of which are involved in carrying out communication of multimedia content across the Internet. For information about these components, see the respective sections of this white paper.
On This PageBenefits and Purposes of Windows Media ServicesWindows Media Services 9 Series is included in Windows Server 2003, Standard Edition, the 32-bit version of Windows Server 2003, Enterprise Edition, and the 32-bit version of Windows Server 2003, Datacenter Edition. Windows Media Services is not included in Windows Server 2003, Web Edition, or in the 64-bit versions of the Windows Server 2003 family. In the 32-bit versions of Windows Server 2003, Enterprise Edition and Windows Server 2003, Datacenter Edition, Windows Media Services delivers advanced streaming functionality such as multicasting, wireless network support, Internet authentication, server plug-ins, and Cache/Proxy APIs. Windows Media Services is an optional component in products in the Windows Server 2003 family. With Windows Media Services, you can create, manage, and deliver Windows Media content over an intranet or the Internet. The clients receiving the content can render it as it is being received, that is, without downloading the content first. Streaming greatly reduces the wait time and storage requirements on the client. It also permits presentations of unlimited length, as well as live broadcasts. For more information about features in Windows Media Services, see the sources in "Related Documentation and Links," later in this section. Examples of Features that Help You Control Communication to and from a Windows Media ServerThis subsection provides brief descriptions of some features in Windows Media Services 9 Series that help you control communication to and from a Windows Media server. These features are integrated with two aspects of basic functionality built into the Windows Server 2003 operating system:
AuthenticationAuthentication is a fundamental aspect of security for a server running Windows Media Services. It confirms the identity of any unicast client trying to access resources on your Windows Media server. Windows Media Services includes authentication plug-ins that you can enable in order to validate user credentials for unicast clients. Authentication plug-ins work together with authorization plug-ins: after users are authenticated, authorization plug-ins control access to unicast content. Windows Media Services authentication plug-ins fall into the following categories:
When you make decisions about how authentication might affect users, consider the following points:
For more information about authentication and about the specific authentication plug-ins that you can enable for Windows Media Services, see the list in "Related Documentation and Links," later in this section. AuthorizationIn order to control access to unicast content on your Windows Media server, unless you identify users only by IP address, you must enable one or more authentication plug-ins and also one or more authorization plug-ins. Authentication plug-ins verify the credentials of unicast clients attempting to connect to the server. Authorization plug-ins verify that the unicast client is allowed to connect to the server. Authorization occurs after authentication is successful. You can enable authorization plug-ins to control the access to content by authenticated users. If you enable an authorization plug-in, with one exception, you must also enable an authentication plug-in for unicast clients to be able to access your publishing points. The exception is the WMS IP Address Authorization plug-in, which does not require an authentication plug-in to authenticate a unicast client. Note that for multicast streaming with Windows Media Services 9 Series, clients do not establish a connection, and therefore authentication and authorization do not apply for multicasting. (Multicast streaming is only available if you have the 32-bit version of Windows Server 2003, Enterprise Edition or Windows Server 2003, Datacenter Edition.) During the authorization process, the server checks the user against the set of access permissions for the resource to which the user is trying to connect. For more information about authorization, see the list in "Related Documentation and Links," later in this section. Firewall Information for Windows Media ServicesThis subsection provides information about configuring firewalls (or proxy servers or both) for use with Windows Media Services. For more information about firewalls, see the sources in "Related Documentation and Links," later in this section. You can configure each control protocol plug-in (Microsoft Media Server [MMS] protocol, Real Time Streaming Protocol [RTSP], and HTTP) to use a specific port to make firewall configuration easier. If opening ports on your firewall is not possible, Windows Media Services can stream content by using the HTTP protocol over port 80. Note: Using HTTP to stream content is disabled by default. Windows Media Services was formerly known as Microsoft NetShow Services; some firewalls have a preconfigured NetShow setting, which may work for Windows Media Services. Configuring firewalls for Unicast StreamingTo configure a firewall for unicast streaming, you must open the ports on the firewall that are required for the connection protocols enabled on your server. If you are streaming content by using either the Microsoft Media Server (MMS) protocol or the Real Time Streaming Protocol (RTSP), you need to support both the User Datagram Protocol (UDP) and Transmission Control Protocol (TCP). To enable Windows Media Player and other clients to use the HTTP, RTSP, or MMS protocols to connect to a Windows Media server that is behind a firewall, open the ports described in the following table. Ports to open when clients are connecting using HTTP, RTSP, or MMS protocols
To enable a distribution server that is behind a firewall to use the HTTP or RTSP protocols to stream content that originates from a server outside the firewall, open the ports described in the following table. Ports to open when a distribution server is behind a firewall and uses HTTP or RTSP to stream content that originates from a server outside the firewall
Note: If it is not possible to open all the UDP Out ports on a firewall, UDP packets sent by a Windows Media server may be blocked by the firewall and may not be able to reach the clients on the other side of the firewall. If this is the case, clients may still be able to receive a stream by automatically rolling over to a TCP-based protocol, such as HTTP or RTSPT (RTSP used with TCP). However, the rollover will cause a delay for the client receiving the stream. If you know you will not be able to support UDP streaming through a firewall, you can decrease the rollover delay by clearing the UDP check box in the Unicast Data Writer plug-in Properties dialog box. For more information, see the Help for Windows Media Services. A procedure for viewing Help is included in "Procedures for Installing, Removing, or Excluding Windows Media Services and Its Subcomponents," later in this section. Configuring Firewalls for Multicast StreamingIf you distribute content using multicast streaming, network traffic is directed through the standard Class D IP addresses (224.0.0.0 through 239.255.255.255). For multicast streaming, you must enable multicast-forwarding on your network. The Internet Group Management Protocol (IGMP), supported by Windows Media Services, ensures that multicast traffic passes through your network only when a player requests a multicast connection, so that enabling multicasting on your routers does not flood your network. The following firewall configuration enables multicast packets to traverse your firewall: IP multicast address range: 224.0.0.1 through 239.255.255.255 To enable IP multicasting, you must allow packets sent to the standard IP multicast address range to come through your firewall. This IP multicast address range must be enabled on both the player and server sides, as well as on every router in between. Enabling Access to an Encoder Outside a FirewallEncoders use HTTP to connect to a server running Windows Media Services. By default, Windows Media Encoder uses port 8080 for HTTP connections; however, the encoder administrator can specify a different port. If a different port is used, you must specify the same port when you identify the encoder connection URL for the Windows Media server and when opening the port on your firewall. The following example of a firewall configuration allows a computer running Windows Media Encoder outside a firewall to access a Windows Media server behind a firewall by using HTTP: In/Out: Transmission Control Protocol (TCP) on port 8080. (The In port is the port through which the server accepts connections. The Out port is the port through which the server sends data to clients.) Answer File Entries and Registry Keys for Windows Media Services SubcomponentsFor reference purposes, the following table shows the syntax for answer file entries associated with Windows Media Services in the Windows Server 2003 family. The table also shows the corresponding registry keys. Do not change the registry keys. They are shown for use in a script that could check whether a particular subcomponent is installed on a particular server. A registry key value of 0x00000000 means the subcomponent is not installed, and a value of 0x00000001 means the subcomponent is installed. Note: For more details about answer-file entries related to Windows Media Services subcomponents, including information about dependencies between the entries, see the references listed in Appendix A, "Resources for Learning About Automated Installation and Deployment." Be sure to review the information in the Deploy.chm file (whose location is provided in that appendix). Answer file entries and registry keys for Windows Media Services subcomponents for the Windows Server 2003 family
Procedures for Installing, Removing, or Excluding Windows Media Services and Its SubcomponentsThe following procedures explain how to:
Note: Windows Media Services is included in Windows Server 2003, Standard Edition, the 32-bit version of Windows Server 2003, Enterprise Edition, and the 32-bit version of Windows Server 2003, Datacenter Edition. Windows Media Services is not included in Windows Server 2003, Web Edition or in the 64-bit versions of the Windows Server 2003 family. In the 32-bit versions of Windows Server 2003, Enterprise Edition and Windows Server 2003, Datacenter Edition, Windows Media Services delivers advanced streaming functionality, such as multicasting, wireless network support, Internet authentication, server plug-ins, and Cache/Proxy APIs. To Add or Remove Windows Media Services on an Individual Computer After Setup is Complete
To View the Help that Comes with Windows Media Services
To Specify Answer File Entries that Control Whether Windows Media Services Subcomponents are Included During Unattended Installation
To Prevent the Installation of Windows Media Services During Unattended Installation by Using an Answer File
Related Documentation and LinksThe following list of resources can help you as you plan or modify your implementation of Windows Media Services and Windows Media Player in your organization:
Printed Reference
|
In This Article
|
