Exchange 2010 Security on Small Business Server

Posted on 2013-11-03
Last Modified: 2013-11-18
Our system includes a 2008 R2 enterprise server (64 bit) that hosts our web server, ftp server, exchange server and file server.  (Our server includes 2 Xeon processors and 32 GB RAM.)

I know that we are not supposed to have all of these services on a single server, but we do.  We are a small business, and everything has worked very well in the past, with minimal load on the server.  System backups to tape are fairly easy to manage with a high level of dependability.

We recently needed to renew our Exchange SSL certificate.  Apparently, the renew function on Exchange Servers encrypts the .req file so the third-party certificate provider could not use that file, and we were required to request a new certificate.  (This may not be critical to the discussion, but this is a major certificate provider who says the renew .req files from an exchange server never works.  You would think Microsoft would fix that.)

We did request a new certificate and installed it successfully.  In the process, our web page security was changed to require a secure connection for access.  We changed that in IIS to no longer require SSL.  Users can now access our website.

This whole process made me question the optimum security and authentication settings for my server.  I need to allow Anonymous Authentication for my website, yet I would like good security for remote access to our Exchange Server that is connected to our website.

It seems to me that should be fairly easy using the correct SSL and authentication settings.  Because we have a range of smart phones that access our Exchange Server from android, to IOS to windows phones, I want to make sure authentication is set up properly.  We also access our site using VPN and Remote Desktop.

I found the default settings on the attachment on the web, but I don't believe they will work for our configuration:

Any help for recommended settings would be appreciated.

Question by:ArchitectChuck
LVL 63

Accepted Solution

Simon Butler (Sembee) earned 300 total points
ID: 39620227
Simply put, you shouldn't have a private web site (Exchange) on the same web site as a public web site. Simple as that. A public web site is best hosted in a data centre.

As you are using Enterprise edition of Windows, you could have split the functionality out in to separate virtual machines - you can have four VMs on the same server with Enterprise edition.

Then if you insist on having public resources on an internal server it could have its own dedicated virtual machine which can be isolated by the firewall and the VM hypervisor from the rest of the network.

I don't think you can secure the system correctly without some major redesign, simply because you are mixing the traffic and are unable to separate it.

LVL 24

Assisted Solution

by:Mohammed Khawaja
Mohammed Khawaja earned 50 total points
ID: 39620241
I agree with Sembee2 but what is done is done.  What you could do is the following:

1. Assign a second IP to the server
2. Bind internal web site to the second IP and you could create a DNS that would point to the IP
3. Set the internal site to http
4. Set the external site to https
5. On your firewall, ensure you do not allow access to the second IP

Assisted Solution

Smighty earned 50 total points
ID: 39620260
I concur with Sembee2. With a Machine that has 32GB of RAM and Windows Enterprise Edition a Virtual Machine would be best suited to seperate your Websites with anonymous access.
Since I had to do that recently I thought I share some thoughts on how you could do that:

Install Hyper-V and setup a fresh Server OS (the IIS-Versions change with every Release, so best to use the same OS version as the host - Server 2008 R2 in your case).

Be careful seperating the external IPs, Exchange relies heavily on its own IP address (MX record, Reverse Lookup Pointer, SPF-Entry, Blacklisting, etc.), so best to use other Address(es) for the Website(s) and let them Point to the new Address in your external DNS.

Microsoft Best Practice for Hyper-V include that you don't use a NIC for Host and virtual machine at the same time, better to have one additional NIC just for virtual Access (in your case, you'd need 2 - one for internal (Traffic, Domain, Database, Management, etc.) and one with the public IP address.

So yes, it is best to seperate internet facing roles when possible and use other machines for that. :)

Author Closing Comment

ID: 39657531
Thank you all for your comments and suggestions.

I have no doubt that your recommendations are correct.  I have not had time to look further into creating a virtual server and implications for backup and restore.


Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Check out this infographic on what you need to make a good email signature that will work perfectly for your organization.
Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now