RE: FW: Exchange Server and External Access

["Cherian M. Palayoor" <cpalayoor () cwalkergroup com>]

Why not vpn to your network through the linux firewall. I would think that
that makes more sense than opening TS to everyone on your firewall.

If your network resides immediately behind the firewall, performance over a
dialup shouldnt be too bad.

Regards

CP

-----Original Message-----
From: some guy [mailto:someguy_555 () hotmail com]
Sent: Wednesday, August 27, 2003 7:36 AM
To: Cherian M. Palayoor; security-basics () securityfocus com
Subject: Re: FW: Exchange Server and External Access


Hello Everybody,
I have been watching this thread with interest because i am facing a similar 
situation at the moment. Currently what i have set up is a Linux server 
which is running Horde and Imp (php-based webmail software) which makes imap 
connections to the exchange server. The linux box also runs the firewall and 
internet connection. I know it could be more secure but this is the best i 
can do with limited hardware. Anyway the users now want to be able to access 
documents from home. They usually use Word, except it is embedded in various 
macros and templates etc. etc. I am currently thinking of setting up another 
computer to run Terminal Services and allow them to remotely connect to 
that. There would only probably be max 2 users at a time. Does anyone see 
any major problems with this? I like this idea in theory because no software 
is needed to be installed (just use activeX through a webpage which i can 
put password protection on and embed in Horde) and it presents a screen they 
are familiar with. Also on a secondary point how well does TS work over 
dialup?
Thanks for any advice you can give. I suspect i will get a number of howling 
cries of terrible security practice...:-)
-Scott


> From: "Cherian M. Palayoor" <cpalayoor () cwalkergroup com>
> To: <security-basics () securityfocus com>
> Subject: FW: Exchange Server and External Access
> Date: Fri, 22 Aug 2003 16:53:25 -0700
>
>
>
> Thanks for the suggestions.
>
> Based on the feedback so far, there appears to 2 school of thought....
>
> Solution 1) Have Exchange setup in a FE/BE configuration with the FE in the
> DMZ and the BE in the internal LAN. Have the FE                poll the BE
> through a secure link using SSL.
>
> Problem : Too expensive, requires Exchange Enterprise and not to mention
> Windows Advanced Server.
>           Also it may not resolve the problem as what I am primarily 
> hoping
> to achieve here is faster access time. We                  presently  have
> to traverse through  a WAN cloud and 2 firewalls to get to the Internet and
> the DMZ.
>
> Solution 2) Move the Exchange Server to the DMZ and set it up either as an
> OWA or POP3 Server.
>
> Problem : This would affect internal user access speed and also the OWA
> option would negatively impact users fed on a diet of Outlook's 
> convenience.
>
> Is it possible to run a third part Server like possibly Sendmail  to front
> end Exchange ?
>
> Regards
>
> CP
>
> -----Original Message-----
> From: Jeff Huston [mailto:JeffH () gatesfoundation org]
> Sent: Friday, August 22, 2003 1:24 PM
> To: Cherian M. Palayoor
> Subject: RE: Exchange Server and External Access
>
>
> Use Exchange's front-end / back-end technology.  Set up the front-end
> server in the DMZ (remember to only allow SSL access!), then use IPSec
> to connect it to the back-end server (presumably in your production
> network).  Users can then access their mailbox data through Outlook Web
> Access.  You can also do this for POP3 / IMAP4 access, but these can be
> somewhat less secure (unless you activate SSL for each of these as
> well).
>
> -- Jeff
>
> -----Original Message-----
> From: Cherian M. Palayoor [mailto:cpalayoor () cwalkergroup com]
> Sent: Friday, August 22, 2003 10:26 AM
> To: security-basics () securityfocus com
> Subject: Exchange Server and External Access
>
> Hi,
>
> We presently use the Std edition of Exchange 2000 as a mail server for
> our
> internal users, behind the Firewall.
>
> However we would like to grant mailbox access to external users outside
> the
> Firewall.
>
> What would be the most secure and efficient method of accomplishing
> this.
>
> One stream of thought that I have been entertaining is having a separate
> Exchange/Mail  Server on the DMZ.
>
> Now this solution would result in having to maintain 2 separate
> mailboxes for
> internal and external users. This creates problems for users who would
> access
> their emails from both inside and outside the office.
>
> How can I workaround this problem.
>
> Thanks in advance for any suggestions.
>
> Regards
>
> CP
>
>
>  Scanned by Webshield E250
>
>
>
> ------------------------------------------------------------------------
> ---
> ------------------------------------------------------------------------
> ----
>
>
>
>  Scanned by Webshield E250
>
>
>
>
>  Scanned by Webshield E250
>
>
>
> ---------------------------------------------------------------------------
> Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
> October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
> technical IT security event.  Modeled after the famous Black Hat event in
> Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
> Symantec is the Diamond sponsor.  Early-bird registration ends September 
> 6.Visit us: www.blackhat.com
> ----------------------------------------------------------------------------

_________________________________________________________________
ninemsn Extra Storage comes with McAfee Virus Scanning - to keep your 
Hotmail account and PC safe. Click here  http://join.msn.com/



 Scanned by Webshield E250




 Scanned by Webshield E250



---------------------------------------------------------------------------
Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
technical IT security event.  Modeled after the famous Black Hat event in
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
Symantec is the Diamond sponsor.  Early-bird registration ends September 6.Visit us: www.blackhat.com
----------------------------------------------------------------------------