Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


Exchange 2010 Security on Small Business Server

Posted on 2013-11-03
Medium Priority
Last Modified: 2013-11-18
Our system includes a 2008 R2 enterprise server (64 bit) that hosts our web server, ftp server, exchange server and file server.  (Our server includes 2 Xeon processors and 32 GB RAM.)

I know that we are not supposed to have all of these services on a single server, but we do.  We are a small business, and everything has worked very well in the past, with minimal load on the server.  System backups to tape are fairly easy to manage with a high level of dependability.

We recently needed to renew our Exchange SSL certificate.  Apparently, the renew function on Exchange Servers encrypts the .req file so the third-party certificate provider could not use that file, and we were required to request a new certificate.  (This may not be critical to the discussion, but this is a major certificate provider who says the renew .req files from an exchange server never works.  You would think Microsoft would fix that.)

We did request a new certificate and installed it successfully.  In the process, our web page security was changed to require a secure connection for access.  We changed that in IIS to no longer require SSL.  Users can now access our website.

This whole process made me question the optimum security and authentication settings for my server.  I need to allow Anonymous Authentication for my website, yet I would like good security for remote access to our Exchange Server that is connected to our website.

It seems to me that should be fairly easy using the correct SSL and authentication settings.  Because we have a range of smart phones that access our Exchange Server from android, to IOS to windows phones, I want to make sure authentication is set up properly.  We also access our site using VPN and Remote Desktop.

I found the default settings on the attachment on the web, but I don't believe they will work for our configuration:

Any help for recommended settings would be appreciated.

Question by:ArchitectChuck
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 63

Accepted Solution

Simon Butler (Sembee) earned 900 total points
ID: 39620227
Simply put, you shouldn't have a private web site (Exchange) on the same web site as a public web site. Simple as that. A public web site is best hosted in a data centre.

As you are using Enterprise edition of Windows, you could have split the functionality out in to separate virtual machines - you can have four VMs on the same server with Enterprise edition.

Then if you insist on having public resources on an internal server it could have its own dedicated virtual machine which can be isolated by the firewall and the VM hypervisor from the rest of the network.

I don't think you can secure the system correctly without some major redesign, simply because you are mixing the traffic and are unable to separate it.

LVL 25

Assisted Solution

by:Mohammed Khawaja
Mohammed Khawaja earned 150 total points
ID: 39620241
I agree with Sembee2 but what is done is done.  What you could do is the following:

1. Assign a second IP to the server
2. Bind internal web site to the second IP and you could create a DNS that would point to the IP
3. Set the internal site to http
4. Set the external site to https
5. On your firewall, ensure you do not allow access to the second IP

Assisted Solution

Smighty earned 150 total points
ID: 39620260
I concur with Sembee2. With a Machine that has 32GB of RAM and Windows Enterprise Edition a Virtual Machine would be best suited to seperate your Websites with anonymous access.
Since I had to do that recently I thought I share some thoughts on how you could do that:

Install Hyper-V and setup a fresh Server OS (the IIS-Versions change with every Release, so best to use the same OS version as the host - Server 2008 R2 in your case).

Be careful seperating the external IPs, Exchange relies heavily on its own IP address (MX record, Reverse Lookup Pointer, SPF-Entry, Blacklisting, etc.), so best to use other Address(es) for the Website(s) and let them Point to the new Address in your external DNS.

Microsoft Best Practice for Hyper-V include that you don't use a NIC for Host and virtual machine at the same time, better to have one additional NIC just for virtual Access (in your case, you'd need 2 - one for internal (Traffic, Domain, Database, Management, etc.) and one with the public IP address.

So yes, it is best to seperate internet facing roles when possible and use other machines for that. :)

Author Closing Comment

ID: 39657531
Thank you all for your comments and suggestions.

I have no doubt that your recommendations are correct.  I have not had time to look further into creating a virtual server and implications for backup and restore.


Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In-place Upgrading Dirsync to Azure AD Connect
This article will help to fix the below error for MS Exchange server 2010 I. Out Of office not working II. Certificate error "name on the security certificate is invalid or does not match the name of the site" III. Make Internal URLs and External…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question