RE: [fw-wiz] NTLM authentication from DMZ

From: Ben Nagy (ben@iagu.net)
Date: 09/19/02 

From: "Ben Nagy" <ben@iagu.net>
To: "'Jan van Rensburg'" <jan.van.rensburg@epiuse.com>, <firewall-wizards@honor.icsalabs.com>
Date: Thu Sep 19 07:44:16 2002

Short answer - don't do it.

Longer answer - Um...this is contra-indicated from a security
perspective.

Long answer - If at gunpoint, I would run the IIS box which does the
actual Exchange Webmail function on a separate box, in a separate
domain, with one-way trusts, and stick _that_ box in the DMZ with the
appropriate holes for the required traffic. From memory, you need the
works for this, including MS-RPC.

The key threat is that someone will hack your IIS box and then sit on it
gathering valid password pairs for the LAN domain, and then just access
C$ on whatever box they like as soon as anyone in the Domain Admins
group checks their mail. We could argue about countermeasures to that,
but believe me when I say that once someone has control over the DMZ box
then you're in some pretty major schtuck unless you have an extremely
smart IDS or Tingling Spider Senses.

Note that I always recommend that Exchange boxen not talk SMTP to the
outside world - setting up a secure mail relay in the DMZ is cheap, easy
and can provide some good first-pass filtering / screening capabilities.

Cheers, 

--
Ben Nagy
Network Security Specialist
Mb: +41792504687  PGP Key ID: 0x1A86E304 
> -----Original Message-----
> From: firewall-wizards-admin@honor.icsalabs.com 
> [mailto:firewall-wizards-admin@honor.icsalabs.com] On Behalf 
> Of Jan van Rensburg
> Sent: Wednesday, September 18, 2002 10:27 AM
> To: firewall-wizards@honor.icsalabs.com
> Subject: Re: [fw-wiz] NTLM authentication from DMZ
> 
> 
> A related question I've sometimes wondered about, is where is 
> the best 
> place to put a company's Exchange server. Let us assume that the 
> Exchange server is part of the normal company domain, so that 
> you only 
> have one authentication database to deal with. The second 
> assumption is 
> that people will access their Exchange mail remotely from the 
> Internet. 
> Now the obvious answer to this is a VPN, but lets assume that this is 
> not possible.
> 
> The two options left is:
> 1. Place the exchange server in the DMZ, but that would 
> require a whole 
> lot of ports open between the LAN and DMZ for the authentication to 
> work.
> 2. Place it on the LAN, but that would require opening ports from the 
> Internet to your LAN.
> 
> Which of the two is worse? Any other (non VPN) alternatives?
> 
> Jan van Rensburg

Relevant Pages

  • Re: OK, Im sold on SBS2003 now
    ... >>> talking about a real DMZ with a different network. ... A web server belongs in the DMZ, not in the LAN. ... > An Exchange server, for a single server, works very nicely in the DMZ ...
    (microsoft.public.windows.server.sbs)
  • Re: [fw-wiz] NTLM authentication from DMZ
    ... Exchange server is part of the normal company domain, ... have one authentication database to deal with. ... Place the exchange server in the DMZ, but that would require a whole ... Place it on the LAN, but that would require opening ports from the ...
    (Firewall-Wizards)
  • Re: Where to put the server
    ... I did end up placing the 2003 IIS box in the DMZ. ... > Put the 2003 IIS Server in the DMZ. ... > SBS box or another LAN server. ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: More DMZ
    ... Without buying a new exchange server I don't think there is ... you somehow sychronise the DMZ Exchange with another one in the LAN? ... I am about to use the DMZ port on the firewall to add a ... LAN, i.e. not being routed through the DMZ port. ...
    (microsoft.public.windows.server.sbs)
  • Re: Access DB through a DMZ
    ... >> I have an IIS server sat in a DMZ and I want it to be able to access an ... > LAN to the DMZ without allowing anything from the DMZ to the LAN, ... > Since you running IIS, why not create a page that lets you query the ... I can do it by sitting the DB on the IIS server in the DMZ as my LAN users ...
    (comp.security.firewalls)