Re: [gentoo-server] using apache2 as a reverse proxy for exchange server

[Casper Gasper]

On Monday 06 December 2004 22:46, Andrew Cowie wrote:
> You can't secure Exchange's "Outlook Web Access" by sticking it behind
> an Apache reverse proxy for a few reasons:
>
> 1) OWA will still be running in Internet Information Server, which is
> buggy and ridden with security holes.
>
> 2) OWA, like every other web application, is liable to attacks that
> target some weakness in its design at the application level, as opposed
> to targetting vulnerabilities in the host web server. SQL injection type
> attacks are the poster-children here, but there are many others. A proxy
> (or firewall, for that matter) will not help you because such things are
> conveyed as legitimate web requests.
>

  I'm not aware of any unpatched exploits in either IIS or OWA, but I do take 
on board that new vulnerabilities will be found in both products sooner or 
later.

 Remote access is always a weak spot in network security, but I still maintain 
you can use OWA in this kind of setup that will be secure enough for most 
people.  Here are things you can do:

 1. Use client certificates
 2. Run the service on a non-default port  
 3. Use account lockouts for multiple password attempts
 4. Filter URL requests for obvious application attacks

 In addition, you're only giving potential attackers a fairly small window to 
aim at -- http requests on OWA.  Compare this with other remote access 
technologies like VPN which will typically give you a much wider range of 
targets, even if you are restricting their access internally.  


Casper.