Installing VPN access on Windows Server 2016
-
@Dashrender said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Exchange is (now) designed to be exposed. So it's hardened and is secure. Or if it isn't, I'd like someone to explain why it isn't and how I should protect it.
Is that true? MS has made a point of making a lot of layers of Exchange and good design is normally assumed to have a SPAM filter in front of it so that Exchange itself is never really exposed. Exchange being "designed" to be exposed would imply a flaw in thinking from MS, but I don't think that they've made that mistake. Exchange is still designed or intended to be used in a good email architecture.
And what is good Email architecture?
Having a spam filter in front, and often a smart host for outgoing, and an edge device to handle the MTA tasks in front of the mailbox unit. All stuff that MS preaches.
I'm curious, does MS have non Exchange hosts acting as a spam filter for O365?
I would assume so. Exchange isn't very practical for that.
-
@Dashrender said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
Exchange is (now) designed to be exposed. So it's hardened and is secure. Or if it isn't, I'd like someone to explain why it isn't and how I should protect it.
Is that true? MS has made a point of making a lot of layers of Exchange and good design is normally assumed to have a SPAM filter in front of it so that Exchange itself is never really exposed. Exchange being "designed" to be exposed would imply a flaw in thinking from MS, but I don't think that they've made that mistake. Exchange is still designed or intended to be used in a good email architecture.
And what is good Email architecture?
Having a spam filter in front, and often a smart host for outgoing, and an edge device to handle the MTA tasks in front of the mailbox unit. All stuff that MS preaches.
Personally I do use a Spam filter in front of my Exchange Server for email, but skipped the smart host for outgoing.
I also have a reverse proxy in front of Exchange for ActiveSync and OWA.Smart Host isn't nearly as important.
-
A spam filter is to protect email clients, not Exchange. All email is benign as far as Exchange is concerned.
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
A spam filter is to protect email clients, not Exchange. All email is benign as far as Exchange is concerned.
The spam portion of it is to protect the mail. But the spam filter is also the SMTP proxy that protects the Exchange server. It's not the email traffic that it is protecting it from, it's SMTP attacks.
-
Things like direct buffer overflow attacks against Exchange can't be done when you have a proxy in front of it.
-
How does that work?
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
How does that work?
Two ways, one as a full on proxy which is basically an application layer firewall. By having an SMTP Proxy that isn't the same as your main SMTP server, you have a totally different attack surface to worry about. Just use Postfix or Sendmail as examples. An attack against them is totally different than an attack against Exchange. That doesn't suggest that they are better or worse, only different.
So attacking the proxy to get to Exchange means you have two layers to get through instead of one. But that's just the beginning. Since your proxy sits out in front, chances are that it failing will not grant any attack mechanism to use against the Exchange server behind it. Due to it being a different machine, it is almost certainly going to "fail closed" even if it fails (and things like Postfix are pretty bullet proof.)
Any attack that gets to Exchange has to survive the proxy and since the proxy relays sanitized emails and does not pass through the SMTP protocol attacks, it effectively filters nearly any type of attack.
Think of it like a Jump box for SSH, but for SMTP.
-
How does an SMTP protocol attack work?
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
How does an SMTP protocol attack work?
Same as any other protocol based attack, you use the protocol to attack the server. Are you familiar with buffer overflows? That entire attack category is done over the protocol in use (SMTP, HTTP, SIP, whatever.)
All external hacking is done this way.
-
Here is an old one that Exchange used to have, just as an example...
https://tools.cisco.com/security/center/viewAlert.x?alertId=8254
-
Here is one for some crappy third party SMTP server, again, just examples of historical, well known SMTP attack vectors that have been found, and closed.
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=24780
-
I need an example that's not from 2004!
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
I need an example that's not from 2004!
Why? If you know what the vector is, you know that the age of the example can't matter.
-
Or do you believe that the entire concept of hacking has been solved and doesn't exist today?
-
@scottalanmiller said in Installing VPN access on Windows Server 2016:
Or do you believe that the entire concept of hacking has been solved and doesn't exist today?
Oh, just forget it.
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
Or do you believe that the entire concept of hacking has been solved and doesn't exist today?
Oh, just forget it.
Okay, so we've established, it's important to have proxies in front of services for good security and SMTP is a common, well known attack vector that is easily mitigated and even MS recommends this for exactly that reason. Moving on...
-
Same reason we always have something like Nginx sitting in front of less battle tested servers like Node.js system calls. Nearly zero effort for a massive increase in stability and security. Things work without doing it, but it's considered the standard implementation pattern and approach.
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
Or do you believe that the entire concept of hacking has been solved and doesn't exist today?
Oh, just forget it.
There's nothing to forget.
If you want security in depth, you need not only the security provided in Exchange, you also put a SMTP proxy in front to get another layer.
The same goes for normal port 80/443 stuff. The default settings of Exchange's implementation on IIS is by some considered lax. Install a much more locked down HTML proxy in front of it that prevents specific commands not needed by Exchange, plus a web server that has different flaws than Exchange IIS has, and you've again created a defense in depth.
-
@Dashrender said in Installing VPN access on Windows Server 2016:
I also have a reverse proxy in front of Exchange for ActiveSync and OWA.
What do you use for a reverse proxy?
-
@Dashrender said in Installing VPN access on Windows Server 2016:
The same goes for normal port 80/443 stuff. The default settings of Exchange's implementation on IIS is by some considered lax. Install a much more locked down HTML proxy in front of it that prevents specific commands not needed by Exchange, plus a web server that has different flaws than Exchange IIS has, and you've again created a defense in depth.
Exactly, put Nginx in front of OWA, as an example, and the degree to which it is harder to try to brute force an attack on OWA is extreme. Plus it can make HTTP Header handling more flexible.
