Making my DC exposed to the internet ....??

[bran2235]

Hello all,

We are about to implement a hosted email solution for my end-users. I have been asked (by the Co. hosting) to allow their trffic (by opening one port) into our netowrk (to my DC!!) so that they can perform querrys (LDAP) in order to get our GAL and Distribution Lists...

This will be basically sitting my DC on the interet!!
It is not using SSL, so I'm only protected by IP / Port Restrictions / and user credentials...

My Question:
Does this seem risky to anyone else?
Is there a better way to send my GAL and Distribution Lists ...?

Any advice or comments all welcome!!


Many thanks-
Brandon

 

[58sniper]

If you limit access to the DC through the firewall to only the provider's IP address, you'll limit the vulnerability.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[bran2235]

True...

Does anyone know if there is another way to allow them to query our AD for the GAL and DLs? (anytime someone uses the TO: field in the hosted mail app, it does a real-time querry of our AD for Email Addresses (GAL, etc.)...