OWA and 525 1

[DV37201]

In an earlier post Yizhar wrote the following:
"My suggestion is not to solve that problem, but to avoid future worse advantures by not allowing OWA to your internal Exchange server, or at least only allowing it via VPN."
I am assuming this is due to the security risk? I am curious if putting the Exchange box in the DMZ would be preffered if requiring VPN is not always possible? Or would security still be an issue since the Exchange box would need to have paths to a DC on the inside of the PIX?

Thanks,
Brian

 

[yizhar]

HI.

There are 2 risks that you take if you allow OWA:

1) Since it relies on IIS - an attacker or virus like Code Red might take over and/or damage the system using IIS faults.
Most known problems are blocked using latest security patches and proper configuration, but the risk is still there.

2) An attacker might get access to a user mailbox, and using it might mess things up more easyli.

Placing an Exchange server in the DMZ isn't simple, and as you wrote, if the attacker hacks the Exchange system it can access other servers from there using open ports unless the server in the DMZ is realy isolated.


Using VPN is also not a perfect solution and posses many security risks, but is currently a safer cost-effective compromise if properly configured.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[DV37201]

Thanks for the reply Yizhar.
You are absolutely right. Without being patched up, a IIS server exposed to the web will get hit by code red fast. In our case we monitor external PC's infected with Nimda (which can spread just like code red) trying to hit our IIS servers 1-2 times a day.
I wish we could require our users to VPN to use OWA. But this is not possible since they travel a lot and use several PC's.
It appears my best solution is to put the Exchange box in the DMZ and lock it down as tightly as possible.
Thanks again for the help Yizhar. BYW the tools and utilities you wrote are quite impressive.

Brian

 

[yizhar]

HI.

OK, here are some more tips for your scenario:

* If possible, implement a separate Exchange server for traveling users in the DMZ, that will only communicate with the internal one using SMTP. This can minimize the risks.

* Change the OWA http port to a random higher one, like 22334.
This will reduce visibility of your server since it won't be hit by Code Red and such scans, but ofcourse a specific port scan on your server ip will revile it.

* Make sure that all traveling users have strong passwords and that other users are not enabled for HTTP (in the Exchange Administrator).

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar