Installing VPN access on Windows Server 2016
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
I need an example that's not from 2004!
Why? If you know what the vector is, you know that the age of the example can't matter.
-
Or do you believe that the entire concept of hacking has been solved and doesn't exist today?
-
@scottalanmiller said in Installing VPN access on Windows Server 2016:
Or do you believe that the entire concept of hacking has been solved and doesn't exist today?
Oh, just forget it.
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
Or do you believe that the entire concept of hacking has been solved and doesn't exist today?
Oh, just forget it.
Okay, so we've established, it's important to have proxies in front of services for good security and SMTP is a common, well known attack vector that is easily mitigated and even MS recommends this for exactly that reason. Moving on...
-
Same reason we always have something like Nginx sitting in front of less battle tested servers like Node.js system calls. Nearly zero effort for a massive increase in stability and security. Things work without doing it, but it's considered the standard implementation pattern and approach.
-
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
Or do you believe that the entire concept of hacking has been solved and doesn't exist today?
Oh, just forget it.
There's nothing to forget.
If you want security in depth, you need not only the security provided in Exchange, you also put a SMTP proxy in front to get another layer.
The same goes for normal port 80/443 stuff. The default settings of Exchange's implementation on IIS is by some considered lax. Install a much more locked down HTML proxy in front of it that prevents specific commands not needed by Exchange, plus a web server that has different flaws than Exchange IIS has, and you've again created a defense in depth.
-
@Dashrender said in Installing VPN access on Windows Server 2016:
I also have a reverse proxy in front of Exchange for ActiveSync and OWA.
What do you use for a reverse proxy?
-
@Dashrender said in Installing VPN access on Windows Server 2016:
The same goes for normal port 80/443 stuff. The default settings of Exchange's implementation on IIS is by some considered lax. Install a much more locked down HTML proxy in front of it that prevents specific commands not needed by Exchange, plus a web server that has different flaws than Exchange IIS has, and you've again created a defense in depth.
Exactly, put Nginx in front of OWA, as an example, and the degree to which it is harder to try to brute force an attack on OWA is extreme. Plus it can make HTTP Header handling more flexible.
-
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
I also have a reverse proxy in front of Exchange for ActiveSync and OWA.
What do you use for a reverse proxy?
His is ancient. ISA
-
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
The same goes for normal port 80/443 stuff. The default settings of Exchange's implementation on IIS is by some considered lax. Install a much more locked down HTML proxy in front of it that prevents specific commands not needed by Exchange, plus a web server that has different flaws than Exchange IIS has, and you've again created a defense in depth.
Exactly, put Nginx in front of OWA, as an example, and the degree to which it is harder to try to brute force an attack on OWA is extreme. Plus it can make HTTP Header handling more flexible.
You cannot put Nginx in front of Exchange for free.
-
@JaredBusch said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
I also have a reverse proxy in front of Exchange for ActiveSync and OWA.
What do you use for a reverse proxy?
His is ancient. ISA
Wow, when did they end that? 2006? I can't remember the last version number, but it was some time ago.
I used it a lot back when it was Proxy Server 2.0!!
-
@JaredBusch said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
The same goes for normal port 80/443 stuff. The default settings of Exchange's implementation on IIS is by some considered lax. Install a much more locked down HTML proxy in front of it that prevents specific commands not needed by Exchange, plus a web server that has different flaws than Exchange IIS has, and you've again created a defense in depth.
Exactly, put Nginx in front of OWA, as an example, and the degree to which it is harder to try to brute force an attack on OWA is extreme. Plus it can make HTTP Header handling more flexible.
You cannot put Nginx in front of Exchange for free.
What feature from the paid version is needed?
-
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@JaredBusch said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
The same goes for normal port 80/443 stuff. The default settings of Exchange's implementation on IIS is by some considered lax. Install a much more locked down HTML proxy in front of it that prevents specific commands not needed by Exchange, plus a web server that has different flaws than Exchange IIS has, and you've again created a defense in depth.
Exactly, put Nginx in front of OWA, as an example, and the degree to which it is harder to try to brute force an attack on OWA is extreme. Plus it can make HTTP Header handling more flexible.
You cannot put Nginx in front of Exchange for free.
What feature from the paid version is needed?
I do not recall the name of the feature, but i had a thread on the subject on here 2 years ago.
Because I tried to put Nginx in front.
-
@JaredBusch said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@JaredBusch said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
The same goes for normal port 80/443 stuff. The default settings of Exchange's implementation on IIS is by some considered lax. Install a much more locked down HTML proxy in front of it that prevents specific commands not needed by Exchange, plus a web server that has different flaws than Exchange IIS has, and you've again created a defense in depth.
Exactly, put Nginx in front of OWA, as an example, and the degree to which it is harder to try to brute force an attack on OWA is extreme. Plus it can make HTTP Header handling more flexible.
You cannot put Nginx in front of Exchange for free.
What feature from the paid version is needed?
I do not recall the name of the feature, but i had a thread on the subject on here 2 years ago.
Because I tried to put Nginx in front.
Have you tried this recent guide?
http://blog.adamjoshuasmith.com/deploying-exchange-2016-behind-nginx-free/
-
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@JaredBusch said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@JaredBusch said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
The same goes for normal port 80/443 stuff. The default settings of Exchange's implementation on IIS is by some considered lax. Install a much more locked down HTML proxy in front of it that prevents specific commands not needed by Exchange, plus a web server that has different flaws than Exchange IIS has, and you've again created a defense in depth.
Exactly, put Nginx in front of OWA, as an example, and the degree to which it is harder to try to brute force an attack on OWA is extreme. Plus it can make HTTP Header handling more flexible.
You cannot put Nginx in front of Exchange for free.
What feature from the paid version is needed?
I do not recall the name of the feature, but i had a thread on the subject on here 2 years ago.
Because I tried to put Nginx in front.
Have you tried this recent guide?
http://blog.adamjoshuasmith.com/deploying-exchange-2016-behind-nginx-free/
It relies on Nginx Extras and requires a Debian proxy.
I found this back in December in this thread: https://www.mangolassi.it/topic/7184/problems-with-exchange-2010-and-nginx-reverse-proxy/18
-
I never did get time to try it, I guess I should. I just hate relying on Ubuntu.
-
@JaredBusch said in Installing VPN access on Windows Server 2016:
I never did get time to try it, I guess I should. I just hate relying on Ubuntu.
Probably works elsewhere. I don't have any on prem Exchange to test on.
-
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@JaredBusch said in Installing VPN access on Windows Server 2016:
I never did get time to try it, I guess I should. I just hate relying on Ubuntu.
Probably works elsewhere. I don't have any on prem Exchange to test on.
I have two. One Exchange 2010 and one Exchange 2013. So I guess I need to just download 17.03 and spin up a VM at each site.
-
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@JaredBusch said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
@Dashrender said in Installing VPN access on Windows Server 2016:
The same goes for normal port 80/443 stuff. The default settings of Exchange's implementation on IIS is by some considered lax. Install a much more locked down HTML proxy in front of it that prevents specific commands not needed by Exchange, plus a web server that has different flaws than Exchange IIS has, and you've again created a defense in depth.
Exactly, put Nginx in front of OWA, as an example, and the degree to which it is harder to try to brute force an attack on OWA is extreme. Plus it can make HTTP Header handling more flexible.
You cannot put Nginx in front of Exchange for free.
What feature from the paid version is needed?
Found it..
So apparently something in the nginx-extras package on Debian handles this.
-
@Dashrender said in Installing VPN access on Windows Server 2016:
@Carnival-Boy said in Installing VPN access on Windows Server 2016:
@scottalanmiller said in Installing VPN access on Windows Server 2016:
Or do you believe that the entire concept of hacking has been solved and doesn't exist today?
Oh, just forget it.
There's nothing to forget.
If you want security in depth, you need not only the security provided in Exchange, you also put a SMTP proxy in front to get another layer.
The same goes for normal port 80/443 stuff. The default settings of Exchange's implementation on IIS is by some considered lax. Install a much more locked down HTML proxy in front of it that prevents specific commands not needed by Exchange, plus a web server that has different flaws than Exchange IIS has, and you've again created a defense in depth.
You shouldn't just add layers of security just for the sake of it. You're adding complexity. You need to understand the risks, and the probabilities of a compromise, so your additional layers are justified.
And risks change over time. Scott saying because something was risky in 2004 ergo it will be equally risky forever is just nonsense.
I'm not saying you don't understand the risks, btw, I'm just trying to understand what they are. As an SMB we have limited funds so need to prioritise our security investments, and how we prioritised in 2004 won't be the same as in 2017.
Anyway, Exchange was just an example, its Windows VPN that is really what drew me to this thread.
