Not too long ago Microsoft introduced a security fix which addresses a possible attack vector in which malicious software tries to impersonate a local request, thereby bypassing certain constraints. The problem with this fix is that it introduces some issues for SharePoint servers, effectively resulting in 401.1 Access Denied errors. Spence Harbar does a great write-up of the fix and the options available to get your SharePoint environment working again so I won't re-hash all that here: http://www.harbar.net/archive/2009/07/02/disableloopbackcheck-amp-sharepoint-what-every-admin-and-developer-should-know.aspx.
As Spence points out, the preferred way to fix this is to add the host names to the BackConnectionHostNames registry key and to not set the DisableLoopbackCheck registry key. You can of course do this using Group Policy but for those not managing their servers using GPO I decided to implement a custom STSADM command that would make setting the BackConnectionHostNames registry key really simple. I called this new command, oddly enough, gl-setbackconnectionhostnames.
The command has two ways to run it, you can run it without any parameters which will cause it to update only the server in which the command is executed on, or you can pass in an -updatefarm parameter along with a username and password which will cause it to update every server in the farm. There's no need to pass in the host header names as the code will dynamically determine them by inspecting each web application and their alternate access mappings (alternate URLs) and perform some logic to determine whether the host header is pointing to a local IP address or to a specific SharePoint server (I do this to exclude Central Admin which is usually accessed using a server name and non-standard port).
I accomplish the farm update by using a custom Timer Job which executes on each server. Unfortunately the timer service account does not have access to write to the registry (unless you've given it rights, which you shouldn't) so it was necessary to pass in a username and password and then use impersonation to update the registry. The custom timer job code is shown below, notice that all the core work is being done via the SetBackConnectionHostNames class which is shown below the timer job code:
The following is the code for the SetBackConnectionHostNames class:
There's two core methods, GetUrls and SetBackConnectionRegKey. The SetBackConnectionRegKey method started out from a bit of sample code that my friend Ben Robb sent me - there's no much of his original code but it saved me some time in trying to remember how to manipulate the registry using C#. Essentially all this method does is get the current list of host names, add any missing items to the passed in list, and then reset the list (thus avoiding duplicate entries). The GetUrls method is the more interesting piece - I'm looping through all the Farm's Web Applications and their corresponding Alternate URLs and then building a list of URLs that meet some basic inclusion criteria:
- Don't add duplicates - you can get duplicates when both HTTP and HTTPS are used so we make sure that we exclude them
- Don't add loopback URLs - this shouldn't come up but if the URL is localhost or 127.0.0.1 it will be flagged as a loopback URL so we exclude them
- Don't add URLs that match the server name - if the host name matches the server name then exclude it (this is essentially just a short circuit for the next check which is a bit more thorough)
- Exclude host names that map to the local IP address - this is the most crucial bit (the previous steps were just short circuits for this step to avoid the additional querying necessary); I use the System.Net.Dns class's static GetHostAddresses method to check the local addresses against those associated with the provided host name
- Exclude host names that map to SharePoint servers - this step is necessary to address host names such as those belonging to Central Administration
The help for the command is shown below:
C:\>stsadm -help gl-setbackconnectionhostnames stsadm -o gl-setbackconnectionhostnames Sets the BackConnectionHostNames registry key with the URLs associated with each web application. Parameters: [-updatefarm (update all servers in the farm)] [-username <DOMAIN\user (must have rights to update the registry on each server)>] [-password <password>]
The following table summarizes the command and its various parameters:
|Command Name||Availability||Build Date|
|gl-setbackconnectionhostnames||WSS v3, MOSS 2007||Released: 9/20/2009
|Parameter Name||Short Form||Required||Description||Example Usage|
|updatefarm||uf||No||If provided then update the BackConnectionHostNames registry key on all servers in the farm.||-updatefarm
|username||user||Yes if updatefarm is provided||The username with sufficient rights to update the registry. If no domain part is specified then the current users domain is used.||-username domain\spadmin
|password||pwd||No||If the users password is blank then this parameter is not required (please change your password if this is the case!); otherwise, this parameter is required if the updatefarm parameter is provided.||-password pa$$w0rd
The following is an example of how to update the BackConnectionHostNames registry key on the current server only:
stsadm -o gl-setbackconnectionhostnames
The following is an example of how to update the BackConnectionHostNames registry key on all servers in the farm:
stsadm -o gl-setbackconnectionhostnames -updatefarm -username domain\spadmin -password pa$$w0rd