Outlook Web Access Security

[twoguysandaserver]

Can someone help me figure if its safe to put Outlook Web Access online?

[rob bergin]

Hi,

its pretty safe, you can ensure further safety by using a firewall to protect the OWA box from the internet and you can use certificates to ensure the data sent back and forth is encrypted.

good luck.

rob

[Jon Finley]

OWA is fine.

As long as everyone uses IE to access it, the Regular NT style encrypted challenge/responce is built in.

The data stream won't be encrypted, but the authentication will be.

If you're worried about that, place the exchange server behind your firewall with an MTA on the other side. Users should then VPN in to use OWA, and the entire stream will be protected.

Jon

[Paul R. Dittrich]

Jon has the right answer, with your OWA server behind the firewall and an agent outside. As an alternative to a VPN, you can use a reverse proxy server to query the agent.

HTH,
Paul

[rob bergin]

The big decision and its more about money is if you want to run real SSL with a certificate from someone like Verisign or if you want to run a homebrew cert from Microsoft Certificate server and if you need 40 or 128 bit security.

Good Luck

Rob

[twoguysandaserver]

Jon

What do you mean when you say:

If you're worried about that, place the exchange server behind your firewall with an MTA on the other side. Users should then VPN in to use OWA, and the entire stream will be protected

I am unfamiliar with how an MTA is going to permit HTTP access to email? Aren't MTA's more for message transfer?

Rob - we plan to use a 128 bit SSL certificate. Can you recommend a vendor? Also what happens when a 40-bit version of the browser tries to access SSL done with a 128 bit certificate? Does the browser software have to 128 bit? We have 128 bit as our desktop standard but expect users to use Web Access from a variety of machines which may not be 128-bit.

[rob bergin]

Hey,

We use Verisign and paid $900 for the Cert with 1 year support. We started with a homebrew certificate and migrated off to a real SSL cert. I am not sure what an MTA for OWA is maybe its an appliance server that does the SSL and proxies the HTTP to the OWA box?

Hope that helps.

Rob

[Jon Finley]

The MTA simply re-directs incoming mail (x.400 documents) to an IP address and port (your exchange server) to where ever it is behind your firewall. It's a secure relay point.

Your Employees/Users then connect to your network through VPN to access the OWA interface as it they were within your network. Your Users will be the only ones accessing the HTML content from OWA.

Using an MTA is simply a means of protecting the Exchange Server rather than having it stradle or sit outside of your firewall.

An MTA can be a linux box using sendmail, or a FrontEnd Exchange Server that simply routes traffic to the internal exchange server (FE/BE servers).


Jon