Security Basics mailing list archives
RE: FW: Exchange Server and External Access
From: "Cherian M. Palayoor" <cpalayoor () cwalkergroup com>
Date: Wed, 27 Aug 2003 08:32:17 -0700
Why not vpn to your network through the linux firewall. I would think that that makes more sense than opening TS to everyone on your firewall. If your network resides immediately behind the firewall, performance over a dialup shouldnt be too bad. Regards CP -----Original Message----- From: some guy [mailto:someguy_555 () hotmail com] Sent: Wednesday, August 27, 2003 7:36 AM To: Cherian M. Palayoor; security-basics () securityfocus com Subject: Re: FW: Exchange Server and External Access Hello Everybody, I have been watching this thread with interest because i am facing a similar situation at the moment. Currently what i have set up is a Linux server which is running Horde and Imp (php-based webmail software) which makes imap connections to the exchange server. The linux box also runs the firewall and internet connection. I know it could be more secure but this is the best i can do with limited hardware. Anyway the users now want to be able to access documents from home. They usually use Word, except it is embedded in various macros and templates etc. etc. I am currently thinking of setting up another computer to run Terminal Services and allow them to remotely connect to that. There would only probably be max 2 users at a time. Does anyone see any major problems with this? I like this idea in theory because no software is needed to be installed (just use activeX through a webpage which i can put password protection on and embed in Horde) and it presents a screen they are familiar with. Also on a secondary point how well does TS work over dialup? Thanks for any advice you can give. I suspect i will get a number of howling cries of terrible security practice...:-) -Scott
From: "Cherian M. Palayoor" <cpalayoor () cwalkergroup com> To: <security-basics () securityfocus com> Subject: FW: Exchange Server and External Access Date: Fri, 22 Aug 2003 16:53:25 -0700 Thanks for the suggestions. Based on the feedback so far, there appears to 2 school of thought.... Solution 1) Have Exchange setup in a FE/BE configuration with the FE in the DMZ and the BE in the internal LAN. Have the FE poll the BE through a secure link using SSL. Problem : Too expensive, requires Exchange Enterprise and not to mention Windows Advanced Server. Also it may not resolve the problem as what I am primarily hoping to achieve here is faster access time. We presently have to traverse through a WAN cloud and 2 firewalls to get to the Internet and the DMZ. Solution 2) Move the Exchange Server to the DMZ and set it up either as an OWA or POP3 Server. Problem : This would affect internal user access speed and also the OWA option would negatively impact users fed on a diet of Outlook's convenience. Is it possible to run a third part Server like possibly Sendmail to front end Exchange ? Regards CP -----Original Message----- From: Jeff Huston [mailto:JeffH () gatesfoundation org] Sent: Friday, August 22, 2003 1:24 PM To: Cherian M. Palayoor Subject: RE: Exchange Server and External Access Use Exchange's front-end / back-end technology. Set up the front-end server in the DMZ (remember to only allow SSL access!), then use IPSec to connect it to the back-end server (presumably in your production network). Users can then access their mailbox data through Outlook Web Access. You can also do this for POP3 / IMAP4 access, but these can be somewhat less secure (unless you activate SSL for each of these as well). -- Jeff -----Original Message----- From: Cherian M. Palayoor [mailto:cpalayoor () cwalkergroup com] Sent: Friday, August 22, 2003 10:26 AM To: security-basics () securityfocus com Subject: Exchange Server and External Access Hi, We presently use the Std edition of Exchange 2000 as a mail server for our internal users, behind the Firewall. However we would like to grant mailbox access to external users outside the Firewall. What would be the most secure and efficient method of accomplishing this. One stream of thought that I have been entertaining is having a separate Exchange/Mail Server on the DMZ. Now this solution would result in having to maintain 2 separate mailboxes for internal and external users. This creates problems for users who would access their emails from both inside and outside the office. How can I workaround this problem. Thanks in advance for any suggestions. Regards CP Scanned by Webshield E250 ------------------------------------------------------------------------ --- ------------------------------------------------------------------------ ---- Scanned by Webshield E250 Scanned by Webshield E250 --------------------------------------------------------------------------- Attend Black Hat Briefings & Training Federal, September 29-30 (Training), October 1-2 (Briefings) in Tysons Corner, VA; the world's premier technical IT security event. Modeled after the famous Black Hat event in Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors. Symantec is the Diamond sponsor. Early-bird registration ends September 6.Visit us: www.blackhat.com ----------------------------------------------------------------------------
_________________________________________________________________ ninemsn Extra Storage comes with McAfee Virus Scanning - to keep your Hotmail account and PC safe. Click here http://join.msn.com/ Scanned by Webshield E250 Scanned by Webshield E250 --------------------------------------------------------------------------- Attend Black Hat Briefings & Training Federal, September 29-30 (Training), October 1-2 (Briefings) in Tysons Corner, VA; the world's premier technical IT security event. Modeled after the famous Black Hat event in Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors. Symantec is the Diamond sponsor. Early-bird registration ends September 6.Visit us: www.blackhat.com ----------------------------------------------------------------------------
Current thread:
- RE: Exchange Server and External Access, (continued)
- RE: Exchange Server and External Access Nick Duda (Aug 26)
- Re: Exchange Server and External Access salgak (Aug 26)
- RE: FW: Exchange Server and External Access Cherian M. Palayoor (Aug 26)
- Re: FW: Exchange Server and External Access Gabriel Orozco (Aug 26)
- RE: Exchange Server and External Access Hay, Duane (Aug 26)
- RE: Exchange Server and External Access Aditya [Aditya Lalit Desgmukh] (Aug 27)
- Re: Exchange Server and External Access Valery Baranov (Aug 26)
- RE: Exchange Server and External Access Nero, Nick (Aug 26)
- RE: FW: Exchange Server and External Access Cherian M. Palayoor (Aug 26)
- Re: FW: Exchange Server and External Access Gabriel Orozco (Aug 27)
- RE: FW: Exchange Server and External Access Cherian M. Palayoor (Aug 27)
- Re: FW: Exchange Server and External Access some guy (Aug 27)