Blog
Projects
About
Backtrack:
Blog
›
Restrict access to Exchange Ad…
Comments
Restrict access to Exchange Admin Center to local subnets
posted on March 5th 2015, at 12:35
by
lunarg
By default, when opening up OWA (Outlook Web App) access to the internet, you could technically also get into Exchange Admin Center (EAC) by appending /ecp after the external OWA URL, potentionally creating a security vulnerability and increasing the chance for a brute-force attack to succeed.
While it is generally a good idea to deny access to the Administrator user to manage the Exchange-server, this is not always possible or desireable. Additionally, because EAC is a VirtualDirectory within a site in IIS, it is not possible to have it listen on a separate internal IP address and secure it through the edge firewall. Luckily, IIS also has some other mechanisms to secure access. There's an
...
read more
add a comment
On March 1st 2016 at 07:48,
Paul
wrote:
IP blocking on /ecp is a bad idea. Outlook Web App users also need access to /ecp for various settings.
It's beter to create separate websites on the same server, or use separate servers for internal/external users.
add a comment
Tags
computer
windows
software
vmware
microsoft
exchange
linux
hardware
network
news
mac
home
powershell
office365
msoffice
server
sqlserver
ad
dell
soaring
internet
esx
sbs
rds
events
mssql
terminalserver
powercli
antivirus
hp
Archive
«
‹
April 2024
›
»
Sun
Mon
Tue
Wed
Thu
Fri
Sat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Links
-
@harkx
-
Cats & Dogs
-
Jargon-free Security Guide
Quote
«
Most people tend to avoid true conflict. Ironically this breeds more conflict.
»
Contact
© 2009-2024 Black Manticore – all rights reserved
code by
lunarg
, design by
SuriAmanah
, hosted at Cats&Dogs