Blog
Projects
About
Backtrack:
Blog
›
Restrict access to Exchange Ad…
Comments
Restrict access to Exchange Admin Center to local subnets
posted on March 5th 2015, at 12:35
by
lunarg
By default, when opening up OWA (Outlook Web App) access to the internet, you could technically also get into Exchange Admin Center (EAC) by appending /ecp after the external OWA URL, potentionally creating a security vulnerability and increasing the chance for a brute-force attack to succeed.
While it is generally a good idea to deny access to the Administrator user to manage the Exchange-server, this is not always possible or desireable. Additionally, because EAC is a VirtualDirectory within a site in IIS, it is not possible to have it listen on a separate internal IP address and secure it through the edge firewall. Luckily, IIS also has some other mechanisms to secure access. There's an
...
read more
add a comment
On March 1st 2016 at 07:48,
Paul
wrote:
IP blocking on /ecp is a bad idea. Outlook Web App users also need access to /ecp for various settings.
It's beter to create separate websites on the same server, or use separate servers for internal/external users.
add a comment
Tags
computer
windows
software
vmware
microsoft
linux
exchange
hardware
network
news
mac
powershell
home
office365
msoffice
ad
server
sqlserver
dell
soaring
internet
esx
sbs
mssql
rds
events
terminalserver
powercli
hp
virtualization
Archive
«
‹
December 2024
›
»
Sun
Mon
Tue
Wed
Thu
Fri
Sat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
Links
-
@harkx
-
Cats & Dogs
-
Jargon-free Security Guide
Quote
«
Have you tried turning it off and on again?
»
The IT Crowd
Contact
© 2009-2024 Black Manticore – all rights reserved
code by
lunarg
, design by
SuriAmanah
, hosted at Cats&Dogs