RE: Protecting an Exchange server?

["Micro Kluge" <microkluge () hotmail com>]

Don't believe the POP method is going to work.

What your describing is the traditional mail-relay setup.  There are a ton 
of options in setting this type of thing up.  Since your going with Exchange 
you could do a Front-end /back-end server configuration.  This requires 
"Enterprise" licensing and means another Windows server to get jacked.  You 
could also use other e-mail systems to relay the smtp traffic which might 
utilize a more secure os/app
You might even consider, depending on the security classification of your 
e-mail, to hire a company such as "Postini" to pre-filter your mail traffic. 
 Upside = your only accepting smtp from a certain range of IP's and your 
mail is being filtered through another layer of virus defense before it hits 
your servers.  Downside = cost, possible (however remote) data theft.

Lots of research.  Good luck.



> From: "Mark G. Spencer" <mspencer () evidentdata com>
> To: <security-basics () securityfocus com>
> Subject: Protecting an Exchange server?
> Date: Thu, 13 May 2004 10:51:56 -0700
>
> Hello,
>
> I'm wondering if there is any way to locate an Exchange server on my
> internal network and place some kind of email appliance on our DMZ to
> actually send and receive email to the world and to the Exchange server on
> my internal network?
>
> Basically, I don't want my Exchange server to be accessible to the world in
> any way.
>
> So ..
>
> Internet -> My Email Appliance -> Firewall -> Exchange Server
>
> I envision setting up a dedicated route in the firewall between the email
> appliance out on the Internet and my Exchange server behind the firewall on
> my local network?
>
> Are there any email appliances that can work with Exchange in this way?
> It's my (limited) understanding that Exchange server can't "pop" to another
> email server to pull each Exchange users email, so I'm not sure exactly how
> or if my plan could be put into action.
>
> Thanks,
>
> Mark
>
>
>
>
>
> ---------------------------------------------------------------------------
> Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
> any course! All of our class sizes are guaranteed to be 10 students or less
> to facilitate one-on-one interaction with one of our expert instructors.
> Attend a course taught by an expert instructor with years of in-the-field
> pen testing experience in our state of the art hacking lab. Master the 
> skills
> of an Ethical Hacker to better assess the security of your organization.
> Visit us at:
> http://www.infosecinstitute.com/courses/ethical_hacking_training.html
> ----------------------------------------------------------------------------

_________________________________________________________________
Watch LIVE baseball games on your computer with MLB.TV, included with MSN 
Premium! http://join.msn.click-url.com/go/onm00200439ave/direct/01/


---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off 
any course! All of our class sizes are guaranteed to be 10 students or less 
to facilitate one-on-one interaction with one of our expert instructors. 
Attend a course taught by an expert instructor with years of in-the-field 
pen testing experience in our state of the art hacking lab. Master the skills 
of an Ethical Hacker to better assess the security of your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------