New Exchange install questions

[Yoshimoto]

Alright after months of trials, errors, and reinstalls i finally have exchange server up talking and sending and receiving when the DNS gets changed over when i test it.

My question is
I can get it working when i toss the server directly on the DMZ, but i don't trust the security aspect of it.
How secure is an exchange server right there out on the internet?
What is the simplest quickest way to add more security to it?



Side note:
I also get this error when trying to log into a user's account.
"The local Security authority cannot be contacted"
Admin account logs in fine.

Any Ideas?
thanks for everything.

 

[Zelandakh]

Don't trust? Why not?
Secure? Very.
Simplest way? Configure it correctly.

LSA errors?

http://support.microsoft.com/kb/813550

I'd suggest you fix that first...

 

[Yoshimoto]

short and sweet thanks a lot.

 

[58sniper]

Don't put Exchange in the DMZ. That's a security concern. Put it in the internal network and secure it with ISA.

Pat Richard
Microsoft Exchange MVP
Contributing author Microsoft Exchange Server 2007: The Complete Reference

 

[Yoshimoto]

That's what i thought, kinda like throwing your AD on the public internet.

http://support.microsoft.com/default.aspx?kbid=837354&product=isas2004

So the issue being now to get them to purchase ISA server.
can you provide anymore information on setting this up?



Correction:
The exchange server is on the lan and we have firewall rules in place allowing http, https, smtp, allowing incoming and out going traffic to the exchange server only.
I'm not sure how secure this is.

Also we can only access OWA through the administrator login.
which i'm working on reading the post that Zel posted above.

 

[58sniper]

While that is more secure than not having a firewall, you still have Internet traffic hitting the box. ISA would be better.

There are both the ISA server method, and ISA appliances, such as those from Network Engines.

Pat Richard
Microsoft Exchange MVP
Contributing author Microsoft Exchange Server 2007: The Complete Reference

 

[timmoat]

We use a third party layer to filter our email traffic. Essentially this means we lock the firewall down to only allow SMTP traffic from their IP address range.

So whilst Internet traffic is hitting our email server its only from one IP address, and its a fraction of the number of emails that would be hitting the box due to spam/virus filtering being done before it hits our bandwidth.

We use email systems (webroot) although a product called MimeCast looked as good if not better. You can link it with your active directory too to further reduce incoming spam etc. 70 users your looking at around £2,000 per year. Makes my email troubleshooting an absolute doddle!

 

[wahnula]

Makes my email troubleshooting an absolute doddle!

I thought I knew most of the everyday Briticisms, but I had to look up doddle...

Noun 1. doddle - an easy task
child's play, cinch, duck soup, piece of cake, pushover, breeze, walkover, picnic, snap - any undertaking that is easy to do; "marketing this product will be no picnic"

Britain, Great Britain, U.K., UK, United Kingdom, United Kingdom of Great Britain and Northern Ireland - a monarchy in northwestern Europe occupying most of the British Isles; divided into England and Scotland and Wales and Northern Ireland;

Tony

Users helping Users...