OWA and SSL

[people3]

Hi

I'm trying to find out how secure OWA is using SSL. At present we use OWA and SSL but only internaly or through a cisco PIX.

We unfortunatly need to open our exchange to the outside world and so are about to open port 443 and forward it to exchange.

How secure is this. Is there anyway to monitor connection attempts?

Thanks for any info

 

[brand1068]

Hi.

We have several people using OWA this way.

Not had any major problems with it, as with any external facing site i'd make sure the usual precausions are taken. ( no user called aministrator, complex passwords etc )

Best,

Chris

 

[58sniper]

Assuming that your cert if from a trusted authority, and you forward only 443, you're going to be safer than if you also forward 80.

As mentioned above, you should do the normal security tasks, as well as making sure you're up to date with all security patches, hotfixes, etc.

Pat Richard, MCSE MCSA:Messaging CNA
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[NickFerrar]

Yeah lots of people do it this way, the main security concern being you're allowing unauthenticated traffic onto the Exchange server as it's the Exchange server doing the logon verification. If there are any attacks though that exploit this I'm not sure.

Personally we use an ISA2004 box on a DMZ behind a Checkpoint firewall and this publises OWA and does the authentication so it's a little bit more secure.