Re: SP2 and OWA

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

"Lanwench [MVP - Exchange]"
<lanwench@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

In news:CE8F0A9B-B573-4D71-84B2-0EE8410753F7@xxxxxxxxxxxxx,
yba02 <yba02@xxxxxxxxxxxxxxxxxxxxxxxxx> typed:
Hi,
I have Exchange 2k3 SP2.
Does SP2 necessitate SSL enforcement on FBA for OWA? In other words,
can I configure OWA without using SSL in presence of SP2?
Thanks
Yba

Sure, I think so - but why would you want to do that? SSL is a must in my
book. Allowing HTTP traffic into your network is a really bad idea.

Okay . . . I'll bite. Why is allowing HTTP into your network less
secure than allowing HTTPS (ignoring the "sniffing passwords" bit)?

I can use an IPS to examine HTTP. I can't look at the contents of the
data if it's encrypted.

Traffic between a F-E and B-E server is HTTP, not HTTPS.

In a switched network, those data aren't broadcast to everyone.

If security is a concern, why not use IPSec and limit the IP addresses
from which you'll accept HTTP/HTTPS? Or another firewall?

I'm sincerely interested in hearing the reasons. Really.

--
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.pott@xxxxxxxxxxxxx
Or to these, either: mailto:h.pott@xxxxxxxxxxxxxxx mailto:melvin.mcphucknuckle@xxxxxxxxxxxxx mailto:melvin.mcphucknuckle@xxxxxxxxxxxxxxx
.

Relevant Pages

  • RE: OWA fails to close
    ... As OWA works fine with HTTP, this issue is mostly related to the SSL ... configuration. ...
    (microsoft.public.exchange.misc)
  • Re: IIS6. Windows 2003
    ... unless it's through a HTTP (SSL) port. ... If you are hosting a company website and also OWA, ... >> We run IIS on all our exchange servers to provide OWA through SSL. ...
    (microsoft.public.inetserver.iis.security)
  • Re: OWA Security Question
    ... Celebrating a decade of Exchange peer support ... I enable the SSL for change password by OWA. ... Are you connecting via http or https? ...
    (microsoft.public.exchange.admin)
  • Re: SP2 and OWA
    ... Does SP2 necessitate SSL enforcement on FBA for OWA? ... Allowing HTTP traffic into your network is a really bad ...
    (microsoft.public.exchange.admin)
  • Error 80072f17
    ... Exchange 2003 SP2 ... OWA is secured with an SSL Cert. ... OWA works fine from all computers. ...
    (microsoft.public.pocketpc.activesync)