Re: [gentoo-server] using apache2 as a reverse proxy for exchange server

[Andrew Cowie]

On Mon, 2004-06-12 at 20:21 +0000, Casper Gasper wrote:
> On Monday 06 December 2004 01:10, Haim Ashkenazi wrote:
> > I'm trying to configure apache2 as a reverse proxy for an exchange
> > server that has internal address. I know it's a bad idea,
>
> Bad idea?  Why?  I think if you set it up properly it's a very good way of
> securing Outlook Web Access.

You can't secure Exchange's "Outlook Web Access" by sticking it behind
an Apache reverse proxy for a few reasons:

1) OWA will still be running in Internet Information Server, which is
buggy and ridden with security holes.

2) OWA, like every other web application, is liable to attacks that
target some weakness in its design at the application level, as opposed
to targetting vulnerabilities in the host web server. SQL injection type
attacks are the poster-children here, but there are many others. A proxy
(or firewall, for that matter) will not help you because such things are
conveyed as legitimate web requests.

What you will get, however, is protection against:

3) any attack that would crash IIS that doesn't crash Apache which isn't
proxied through *by* Apache will then be averted.

Not much of a gain given (1) and (2), but probably still worth the
effort.

We did do the proxy thing (and, stuck Qmail as MX in front of Exchange)
at a previous site on the grounds that something is better than nothing,
but have no illusion that you are now "secure" as a result.

AfC
Sydney
  
-- 
Andrew Frederick Cowie

OPERATIONAL DYNAMICS
Operations Consultants and Infrastructure Engineers
http://www.operationaldynamics.com/

Sydney:   [phone]
New York: [phone]
Toronto:  [phone]
London:   [phone]