topic Re: Outlook Web Access Security in BackOffice Products

Outlook Web Access Security

twoguysandaserver — Thu, 20 Mar 2003 21:23:49 GMT

Can someone help me figure if its safe to put Outlook Web Access online?

Re: Outlook Web Access Security

rob bergin — Thu, 20 Mar 2003 21:25:12 GMT

Hi,

its pretty safe, you can ensure further safety by using a firewall to protect the OWA box from the internet and you can use certificates to ensure the data sent back and forth is encrypted.

good luck.

rob

Re: Outlook Web Access Security

Jon Finley — Fri, 21 Mar 2003 04:52:39 GMT

OWA is fine.

As long as everyone uses IE to access it, the Regular NT style encrypted challenge/responce is built in.

The data stream won't be encrypted, but the authentication will be.

If you're worried about that, place the exchange server behind your firewall with an MTA on the other side. Users should then VPN in to use OWA, and the entire stream will be protected.

Jon

Re: Outlook Web Access Security

Paul R. Dittrich — Fri, 21 Mar 2003 12:53:31 GMT

Jon has the right answer, with your OWA server behind the firewall and an agent outside. As an alternative to a VPN, you can use a reverse proxy server to query the agent.

HTH,
Paul

Re: Outlook Web Access Security

rob bergin — Fri, 21 Mar 2003 15:10:09 GMT

The big decision and its more about money is if you want to run real SSL with a certificate from someone like Verisign or if you want to run a homebrew cert from Microsoft Certificate server and if you need 40 or 128 bit security.

Good Luck

Rob

Re: Outlook Web Access Security

twoguysandaserver — Fri, 21 Mar 2003 15:13:59 GMT

Jon

What do you mean when you say:

If you're worried about that, place the exchange server behind your firewall with an MTA on the other side. Users should then VPN in to use OWA, and the entire stream will be protected

I am unfamiliar with how an MTA is going to permit HTTP access to email? Aren't MTA's more for message transfer?

Rob - we plan to use a 128 bit SSL certificate. Can you recommend a vendor? Also what happens when a 40-bit version of the browser tries to access SSL done with a 128 bit certificate? Does the browser software have to 128 bit? We have 128 bit as our desktop standard but expect users to use Web Access from a variety of machines which may not be 128-bit.

Re: Outlook Web Access Security

rob bergin — Fri, 21 Mar 2003 15:18:45 GMT

Hey,

We use Verisign and paid $900 for the Cert with 1 year support. We started with a homebrew certificate and migrated off to a real SSL cert. I am not sure what an MTA for OWA is maybe its an appliance server that does the SSL and proxies the HTTP to the OWA box?

Hope that helps.

Rob

Re: Outlook Web Access Security

Jon Finley — Fri, 21 Mar 2003 19:53:46 GMT

The MTA simply re-directs incoming mail (x.400 documents) to an IP address and port (your exchange server) to where ever it is behind your firewall. It's a secure relay point.

Your Employees/Users then connect to your network through VPN to access the OWA interface as it they were within your network. Your Users will be the only ones accessing the HTML content from OWA.

Using an MTA is simply a means of protecting the Exchange Server rather than having it stradle or sit outside of your firewall.

An MTA can be a linux box using sendmail, or a FrontEnd Exchange Server that simply routes traffic to the internal exchange server (FE/BE servers).

Jon