SEC 304 Enhancing Exchange OWA and IIS Security

SEC 304 Enhancing Exchange, OWA and IIS Security with ISA Server Feature Pack 1 Steve Riley Microsoft Corporation steriley@microsoft. com

Agenda The problem Enhancing Outlook-to-Exchange communication Enhancing Exchange OWA and IIS deployments More ISA Server Feature Pack 1

The Problem Traditional firewalls focus on packet filtering & stateful inspection Today’s attacks bypass this protection Ports & protocols cannot be trusted to indicate user intent Port 80 yesterday—Web browsing only Port 80 today—Web browsing, OWA, MSN Messenger, XML Web Services… Packet filtering & stateful inspection are not enough to protect against today’s attacks!

Application-layer Firewalls Are Necessary Required to protect against today’s attacks Enables deep content inspection Understanding what’s in the payload is a requirement Internet to internal network Traditional firewall Application-layer firewall

ISA Server = Application-Layer Security Packet filtering & stateful inspection Application-layer filtering Deep content inspection Advanced proxy architecture Extensible/pluggable architecture 30+ partners Best firewall for Microsoft environments

Enhancing Outlook-To. Exchange Security

Enhanced SMTP Filter Uses ISA Server application-layer filtering ability Filter e-mail with increased reliability and security on several attributes Sender Domain Keyword Attachment extension, name, size Any SMTP command its length

RPC 101 Client accesses Client connects application over to portmapper Client knows UUID ofporton server learned (port 135/tcp) service it wants Portmapper responds with Client asks, the “What port and closes the is associated with my connection UUID? ” 4402/tcp 135/tcp 4402/tcp {1234 -1111…} RPC client (Outlook) Server matches UUID to the current port… RPC services grab random high ports when they start, server maintains table RPC server (Exchange) Service UUID Port Exchange {1234 -1111… 4402 AD replication {01020304 -4444… 3544 MMC {19283746 -7777… 9233

Exchange RPC Filter Internet Outlook ISA Server Exchange Server ISA Server Exchange RPC filter Only port 135 (portmapper) is open High ports are opened and closed for Outlook clients as necessary Inspects portmapper traffic at applicationlayer Only Exchange UUIDs allowed

Exchange RPC Filter Enforce RPC encryption Outlook RPC encryption enforced centrally Enable outbound RPC communication Outlook clients behind ISA Server can now access external Exchange Servers RPC External network Exchange Server Internal network ISA Server with Feature Pack 1 Outlook

Enhancing Exchange OWA And IIS Security

URLScan 2. 5 For ISA Server Filters incoming requests based on rules set Helps protect from attacks which Request unusual actions Have a large number of characters Are encoded using an alternate character set Can be used in conjunction with SSL inspection to detect attacks over SSL

RSA Secur. ID Authentication ISA Server prompts user for Secur. ID username and PASSCODE RSA ACE/Agent on ISA Server passes credentials to the RSA ACE/Server for validation When credentials are validated User is granted access to the protected content Cookie is delivered to the user's browser for subsequent activity during the session

Authentication Delegation For basic and Secur. ID authentication Authentication happens at ISA Server Eliminates multiple authentication dialogs Only valid traffic allowed past ISA Server Enabled per Web publishing rule ISA Server pre-authenticates Client requests protected ISAlogs Server forwards users and their activity the credentials content from Web server to the protected Web or OWA server Internet client ISA Server Web server

Protecting OWA Basic authentication delegation URLScan for ISA Server can OWAinspect server forstop ISA Server pre-authenticates URLScan for ISA prompts Server can decrypt and authentication — any edge, users, eliminating multiple …which allowsatviruses Web the network SSL attacks traffic URLScan Internet user canfor access dialog boxes and only allowing andeven worms to pass over encrypted SSL this prompt valid traffic through ISA undetected… Server SSL SSL or HTTP Internet client Traditional ISA Server with firewall Feature Pack 1 OWA SSL tunnels through traditional firewalls inspected …and traffic infect can beinternal sent toservers! the internal because it is encrypted… server re-encrypted or in the clear.

demo ISA Server Feature Pack 1

OWA Wizard Used in combination with the additional OWA deployment docs 1. 2. Documentation = correct cert deployment Wizard = easily configures ISA Server settings Generates destination set and Web publishing rule with correct elements Adds the correct listeners to external interface Selects correct certificate

More ISA Server Feature Pack 1

New Documentation ISA Server Feature Pack 1 walkthroughs OWA, link translation, RSA Secur. ID Web Publishing Many scenarios & troubleshooting information Exchange Server Publishing Includes Exchange RPC filter, POP and IMAP & troubleshooting information Additional Documentation Including client types and digital certificates

RPC Filter Wizard Create RPC service definitions used in server publishing rules Enumerates services on a given server UUID’s can also be entered manually ISA Server: ISA Server with Feature Pack 1:

Link Translator Translates hyperlinks within responses Intranet computer names to those of externally available computers Including HTTPS; SPS mktg. example. com / http: // int-mktg http: //mktg. example. com/ sales. html http: //int-mktg/ sales. html http: // Client requests LINK TRANSLATOR www. example. com/index. html http: // Web server (int-mktg) Internet client ISA Server Feature Pack 1 Web server (www. example. com)

Partial URL Path Translation Allows removal of path prefix Details in 331069 http: //www. example. com/site 1 translated to http: //internal http: //www. example. com/site 1/site 2/ translated to http: //internal/site 2 site 1. ex. com Internet client ISA Server site 2. ex. com

What Can You Do Today? New firewall security designed to help protect Exchange Server and IIS Great fit into existing deployments Evaluate Security of your current Exchange Server or IIS deployment ISA Server Download ISA Server Feature Pack 1 No Exchange Server or IIS deployment is complete without ISA Server protection!

Community Resources http: //www. microsoft. com/communities/default. mspx Most Valuable Professional (MVP) http: //www. mvp. support. microsoft. com/ Newsgroups Converse online with Microsoft Newsgroups, including Worldwide http: //www. microsoft. com/communities/newsgroups/default. mspx User Groups Meet and learn with your peers http: //www. microsoft. com/communities/usergroups/default. mspx

Suggested Reading And Resources The tools you need to put technology to work! TITLE Microsoft® Internet Security and Acceleration (ISA) Server 2000 Administrator's Pocket Consultant: 0 -7356 -1442 -3 Internet Information Services (IIS) 6. 0 Resource Kit: 0 -7356 -1420 -2 Available Today 8/27/03 Microsoft Press books are 20% off at the Tech. Ed Bookstore Also buy any TWO Microsoft Press books and get a FREE T-Shirt

evaluations

Steve Riley steriley@microsoft. com © 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.