Installing VPN access on Windows Server 2016
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
That's the way it's always been done?
Years ago, it was generally accepted that Microsoft products weren't very secure and that you wouldn't want to expose them. But it's 2017 now, and I'm not sure that assumption still applies.
The assumption isn't one that Windows is less secure than any linux distribution, its' that there is far more threats for Windows in existence that makes leaving a Windows server open (or any ports) to great of a risk.
-
Can you give me some examples?
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Why?
E.g. How does a reverse proxy make Exchange more secure? Or to put it another way, what are the Exchange security flaws that you're trying to fix?
Reverse proxy does very little, but it does make direct brute force attacks go against the proxy rather than the email server. The hope is that it will "fail closed" rather than "fail open" .
-
@DustinB3403 said in Installing VPN access on Windows Server 2016:
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
That's the way it's always been done?
Years ago, it was generally accepted that Microsoft products weren't very secure and that you wouldn't want to expose them. But it's 2017 now, and I'm not sure that assumption still applies.
The assumption isn't one that Windows is less secure than any linux distribution, its' that there is far more threats for Windows in existence that makes leaving a Windows server open (or any ports) to great of a risk.
I think it is often product by product. Exchange is designed to have layers of security like this, that's the intended use. RDP they assume you will layer some other security in front of, etc.
-
@Dashrender said in Installing VPN access on Windows Server 2016:
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Why?
E.g. How does a reverse proxy make Exchange more secure? Or to put it another way, what are the Exchange security flaws that you're trying to fix?
Why - the only answer I can give is - because. that's way it's pretty much always been done. As Scott inferred, it's likely not needed. Besides - why do you still have onsite Exchange?
That's the biggest answer. Just because "it's what people do."
-
Exchange is (now) designed to be exposed. So it's hardened and is secure. Or if it isn't, I'd like someone to explain why it isn't and how I should protect it.
So to return to the OP, Windows VPN is designed to be exposed, right? It's designed to be secure, right? So why not use it? What are it's flaws? Unlike years ago, Microsoft develop products with security at the fore.
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Exchange is (now) designed to be exposed. So it's hardened and is secure. Or if it isn't, I'd like someone to explain why it isn't and how I should protect it.
Is that true? MS has made a point of making a lot of layers of Exchange and good design is normally assumed to have a SPAM filter in front of it so that Exchange itself is never really exposed. Exchange being "designed" to be exposed would imply a flaw in thinking from MS, but I don't think that they've made that mistake. Exchange is still designed or intended to be used in a good email architecture.
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Exchange is (now) designed to be exposed. So it's hardened and is secure. Or if it isn't, I'd like someone to explain why it isn't and how I should protect it.
So to return to the OP, Windows VPN is designed to be exposed, right? It's designed to be secure, right? So why not use it? What are it's flaws? Unlike years ago, Microsoft develop products with security at the fore.
There are products that don't require you to pay a small fortune to be able to VPN in. Maybe that's why people don't use Windows VPN.
That and it's still a Windows Server (so even if it is hardened) it's still vulnerable to everything bad out there.
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
So to return to the OP, Windows VPN is designed to be exposed, right?
I'm not sure that I like these terms "designed to be". I understand where you are coming from, but let's ask about something totally different...
Is a Node.js server "designed to be" exposed without a proxy in front of it?
Or, is Windows Software RAID "designed to be" used for your storage?
-
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Exchange is (now) designed to be exposed. So it's hardened and is secure. Or if it isn't, I'd like someone to explain why it isn't and how I should protect it.
Is that true? MS has made a point of making a lot of layers of Exchange and good design is normally assumed to have a SPAM filter in front of it so that Exchange itself is never really exposed. Exchange being "designed" to be exposed would imply a flaw in thinking from MS, but I don't think that they've made that mistake. Exchange is still designed or intended to be used in a good email architecture.
And what is good Email architecture?
-
@Dashrender said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Exchange is (now) designed to be exposed. So it's hardened and is secure. Or if it isn't, I'd like someone to explain why it isn't and how I should protect it.
Is that true? MS has made a point of making a lot of layers of Exchange and good design is normally assumed to have a SPAM filter in front of it so that Exchange itself is never really exposed. Exchange being "designed" to be exposed would imply a flaw in thinking from MS, but I don't think that they've made that mistake. Exchange is still designed or intended to be used in a good email architecture.
And what is good Email architecture?
Having a spam filter in front, and often a smart host for outgoing, and an edge device to handle the MTA tasks in front of the mailbox unit. All stuff that MS preaches.
-
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Exchange is (now) designed to be exposed. So it's hardened and is secure. Or if it isn't, I'd like someone to explain why it isn't and how I should protect it.
Is that true? MS has made a point of making a lot of layers of Exchange and good design is normally assumed to have a SPAM filter in front of it so that Exchange itself is never really exposed. Exchange being "designed" to be exposed would imply a flaw in thinking from MS, but I don't think that they've made that mistake. Exchange is still designed or intended to be used in a good email architecture.
And what is good Email architecture?
Having a spam filter in front, and often a smart host for outgoing, and an edge device to handle the MTA tasks in front of the mailbox unit. All stuff that MS preaches.
I'm curious, does MS have non Exchange hosts acting as a spam filter for O365?
-
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Exchange is (now) designed to be exposed. So it's hardened and is secure. Or if it isn't, I'd like someone to explain why it isn't and how I should protect it.
Is that true? MS has made a point of making a lot of layers of Exchange and good design is normally assumed to have a SPAM filter in front of it so that Exchange itself is never really exposed. Exchange being "designed" to be exposed would imply a flaw in thinking from MS, but I don't think that they've made that mistake. Exchange is still designed or intended to be used in a good email architecture.
And what is good Email architecture?
Having a spam filter in front, and often a smart host for outgoing, and an edge device to handle the MTA tasks in front of the mailbox unit. All stuff that MS preaches.
Personally I do use a Spam filter in front of my Exchange Server for email, but skipped the smart host for outgoing.
I also have a reverse proxy in front of Exchange for ActiveSync and OWA. -
@Dashrender said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Exchange is (now) designed to be exposed. So it's hardened and is secure. Or if it isn't, I'd like someone to explain why it isn't and how I should protect it.
Is that true? MS has made a point of making a lot of layers of Exchange and good design is normally assumed to have a SPAM filter in front of it so that Exchange itself is never really exposed. Exchange being "designed" to be exposed would imply a flaw in thinking from MS, but I don't think that they've made that mistake. Exchange is still designed or intended to be used in a good email architecture.
And what is good Email architecture?
Having a spam filter in front, and often a smart host for outgoing, and an edge device to handle the MTA tasks in front of the mailbox unit. All stuff that MS preaches.
I'm curious, does MS have non Exchange hosts acting as a spam filter for O365?
I would assume so. Exchange isn't very practical for that.
-
@Dashrender said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Exchange is (now) designed to be exposed. So it's hardened and is secure. Or if it isn't, I'd like someone to explain why it isn't and how I should protect it.
Is that true? MS has made a point of making a lot of layers of Exchange and good design is normally assumed to have a SPAM filter in front of it so that Exchange itself is never really exposed. Exchange being "designed" to be exposed would imply a flaw in thinking from MS, but I don't think that they've made that mistake. Exchange is still designed or intended to be used in a good email architecture.
And what is good Email architecture?
Having a spam filter in front, and often a smart host for outgoing, and an edge device to handle the MTA tasks in front of the mailbox unit. All stuff that MS preaches.
Personally I do use a Spam filter in front of my Exchange Server for email, but skipped the smart host for outgoing.
I also have a reverse proxy in front of Exchange for ActiveSync and OWA.Smart Host isn't nearly as important.
-
A spam filter is to protect email clients, not Exchange. All email is benign as far as Exchange is concerned.
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
A spam filter is to protect email clients, not Exchange. All email is benign as far as Exchange is concerned.
The spam portion of it is to protect the mail. But the spam filter is also the SMTP proxy that protects the Exchange server. It's not the email traffic that it is protecting it from, it's SMTP attacks.
-
Things like direct buffer overflow attacks against Exchange can't be done when you have a proxy in front of it.
-
How does that work?
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
How does that work?
Two ways, one as a full on proxy which is basically an application layer firewall. By having an SMTP Proxy that isn't the same as your main SMTP server, you have a totally different attack surface to worry about. Just use Postfix or Sendmail as examples. An attack against them is totally different than an attack against Exchange. That doesn't suggest that they are better or worse, only different.
So attacking the proxy to get to Exchange means you have two layers to get through instead of one. But that's just the beginning. Since your proxy sits out in front, chances are that it failing will not grant any attack mechanism to use against the Exchange server behind it. Due to it being a different machine, it is almost certainly going to "fail closed" even if it fails (and things like Postfix are pretty bullet proof.)
Any attack that gets to Exchange has to survive the proxy and since the proxy relays sanitized emails and does not pass through the SMTP protocol attacks, it effectively filters nearly any type of attack.
Think of it like a Jump box for SSH, but for SMTP.
