Exchange 2010 Security on Small Business Server

Posted on 2013-11-03
Last Modified: 2013-11-18
Our system includes a 2008 R2 enterprise server (64 bit) that hosts our web server, ftp server, exchange server and file server.  (Our server includes 2 Xeon processors and 32 GB RAM.)

I know that we are not supposed to have all of these services on a single server, but we do.  We are a small business, and everything has worked very well in the past, with minimal load on the server.  System backups to tape are fairly easy to manage with a high level of dependability.

We recently needed to renew our Exchange SSL certificate.  Apparently, the renew function on Exchange Servers encrypts the .req file so the third-party certificate provider could not use that file, and we were required to request a new certificate.  (This may not be critical to the discussion, but this is a major certificate provider who says the renew .req files from an exchange server never works.  You would think Microsoft would fix that.)

We did request a new certificate and installed it successfully.  In the process, our web page security was changed to require a secure connection for access.  We changed that in IIS to no longer require SSL.  Users can now access our website.

This whole process made me question the optimum security and authentication settings for my server.  I need to allow Anonymous Authentication for my website, yet I would like good security for remote access to our Exchange Server that is connected to our website.

It seems to me that should be fairly easy using the correct SSL and authentication settings.  Because we have a range of smart phones that access our Exchange Server from android, to IOS to windows phones, I want to make sure authentication is set up properly.  We also access our site using VPN and Remote Desktop.

I found the default settings on the attachment on the web, but I don't believe they will work for our configuration:

Any help for recommended settings would be appreciated.

Question by:ArchitectChuck
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 63

Accepted Solution

Simon Butler (Sembee) earned 300 total points
ID: 39620227
Simply put, you shouldn't have a private web site (Exchange) on the same web site as a public web site. Simple as that. A public web site is best hosted in a data centre.

As you are using Enterprise edition of Windows, you could have split the functionality out in to separate virtual machines - you can have four VMs on the same server with Enterprise edition.

Then if you insist on having public resources on an internal server it could have its own dedicated virtual machine which can be isolated by the firewall and the VM hypervisor from the rest of the network.

I don't think you can secure the system correctly without some major redesign, simply because you are mixing the traffic and are unable to separate it.

LVL 25

Assisted Solution

by:Mohammed Khawaja
Mohammed Khawaja earned 50 total points
ID: 39620241
I agree with Sembee2 but what is done is done.  What you could do is the following:

1. Assign a second IP to the server
2. Bind internal web site to the second IP and you could create a DNS that would point to the IP
3. Set the internal site to http
4. Set the external site to https
5. On your firewall, ensure you do not allow access to the second IP

Assisted Solution

Smighty earned 50 total points
ID: 39620260
I concur with Sembee2. With a Machine that has 32GB of RAM and Windows Enterprise Edition a Virtual Machine would be best suited to seperate your Websites with anonymous access.
Since I had to do that recently I thought I share some thoughts on how you could do that:

Install Hyper-V and setup a fresh Server OS (the IIS-Versions change with every Release, so best to use the same OS version as the host - Server 2008 R2 in your case).

Be careful seperating the external IPs, Exchange relies heavily on its own IP address (MX record, Reverse Lookup Pointer, SPF-Entry, Blacklisting, etc.), so best to use other Address(es) for the Website(s) and let them Point to the new Address in your external DNS.

Microsoft Best Practice for Hyper-V include that you don't use a NIC for Host and virtual machine at the same time, better to have one additional NIC just for virtual Access (in your case, you'd need 2 - one for internal (Traffic, Domain, Database, Management, etc.) and one with the public IP address.

So yes, it is best to seperate internet facing roles when possible and use other machines for that. :)

Author Closing Comment

ID: 39657531
Thank you all for your comments and suggestions.

I have no doubt that your recommendations are correct.  I have not had time to look further into creating a virtual server and implications for backup and restore.


Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As tax season makes its return, so does the increase in cyber crime and tax refund phishing that comes with it
After hours on line I found a solution which pointed to the inherited Active Directory permissions . You have to give/allow permissions to the "Exchange trusted subsystem" for the user in the Active Directory...
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
Suggested Courses

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question