Setup Secure OWA

[lanceja]

Have a question for you gurus.

I have an 2003 Domain setup with one Exchange 2003 server. I want to setup Outlook Web Access, but want to stay secure. I talked to one contractor and he told me that all I had to do was open Port 80 to the server and as long as I kept the server patched, then there were no security worries. I am sorry but I do not trust Microsoft that much. I am definetely going with SSL, so my questions are the following:

1. Can I do without a Front End server and just send Port 403 to my exchange server and not have to worry about hackers? Or do I still have to forward Port 80?

2. Would it be better to have a Front end server? Of course then I have to convince my supervisor to pay $$ for an Exchange 2003 standard edition but can do that.

3. If I do setup a Front end server, do you know of a good how to manual that can help me set it up? I have my own firewall with a DMZ so I do not need/want a Microsoft ISA (which I have seen in a couple of articles). I just want to be able to setup te FE server to give people access to their EMail.

Thanks to all.

 

[clancyfan]

I would highly recommend NOT simply opening port 80 and hoping for the best. You are right not to trust Microsoft that much )

I am using Small Business Server 2003 with Outlook Web Access over an SSL connection. I have an external firewall device forwarding port 443 to the server. You do not need to forward port 80. This should be enough security to stop most attacks.

If you know the IP addresses of the people accessing through OWA you could also restrict access by IP address.

 

[Xanaxo]

Read my post here for answers.

http://www.tek-tips.com/viewthread.cfm?qid=912282&page=1

Steven Parent [MSFT]