Dangers of Exchange inside LAN (non-DMZ)

[MulLa]

Well, it'll be limited access for people who belong to this company. It's not open for everyone's access. Mainly for those that need to travel interstate and the sales reps. They all have SAV loaded on their computers and I'm fairly confident that they are not infected. I wanted to let people well mainly the big boss who travels overseas and everywhere a lot to be able to access Exchange through his outlook. So he gets all his calenders, contacts etc just like as if he's in the office.

The servers will all have SAV + Symantec Mail Security loaded even if an infected client joins the network it shouldn't do too much damage.

 

[Nothinman]

Well, it'll be limited access for people who belong to this company. It's not open for everyone's access

That's a given, but the fact that someone could potentially break into the VPN can't be ignored, especially if you're going to use only a pre-shared key for the authentication.

 

[Boscoh]

Originally posted by: MulLa
Well, it'll be limited access for people who belong to this company. It's not open for everyone's access. Mainly for those that need to travel interstate and the sales reps. They all have SAV loaded on their computers and I'm fairly confident that they are not infected. I wanted to let people well mainly the big boss who travels overseas and everywhere a lot to be able to access Exchange through his outlook. So he gets all his calenders, contacts etc just like as if he's in the office.

The servers will all have SAV + Symantec Mail Security loaded even if an infected client joins the network it shouldn't do too much damage.

Well, if you feel confident enough in your antivirus product to bet your job on it, then cheers :beer:.

I manage an IPSec VPN, a good sized one, and we have a lot of home users. It's a nightmare from an administration standpoint. I can tell you that we'd have been screwed several times if we didnt have the very granular ACL's in place that we do. Expecting average Joe home-user to update their AV software and Windows is like expecting a cat to clean his own catbox.

Also remember: a virus/worm does not have to infect a computer to cause damage to it.

 

[MysticLlama]

This is getting a bit away from the main topic, but the direction it's going isn't a bad thing.

As far as VPNs go, it is a big risk allowing someone that much access to your network.

I've actually started to build an Extranet as part of my "VPN Elimination Program". VPNs aren't bad in and of themselves, but can be dangerous in the wrong hands.

What I've been doing is taking whatever services I can and moving these to the Extranet.

A really good example is that I took some of our web reports, and moved them from the Intranet to the Extranet. Just that one move alone kept 2 people from having any other reason at all to VPN in and have full access to the entire network. Why should I give them full access when I can just expose the little bit they need in a different way?

Just something to think about.

 

[MysticLlama]

Whoops.

 

[MulLa]

Hi all,

Considering that the people who will be VPNing into our network for Exchange access will have normal access into our network anyway. I mean they normally work in the office and on occassion that they have to go out for a week or couple of weeks they just take their laptops with them.

Their anti-virus software are setup to updated daily and locked down so they can't change any of the settings so I'm fairly confident in them.

How easy is it to hack into a VPN box with preshared key?

Now call me a noob But I do have one very stupid question. If I put Exchange in the DMZ, I would have to open up a whole lot of ports at the internal firewall for the LAN to access the exchange don't I? Then at the external firewall I just open up ones that are relevant to the services that I wanted to provide over the internet.

Let's say now if people hacked into my DMZ it won't take much for me to get inside would it? Since the internal firewall have more open ports than the external one??? Or am I missing something here???


Thanks once more for all the response!!

 

[Nothinman]

But I do have one very stupid question. If I put Exchange in the DMZ, I would have to open up a whole lot of ports at the internal firewall for the LAN to access the exchange don't I?

If you only have 1 Exchange box, yes you would need to open up some ports, I'm not sure what all is necessary for Exchange though. It would probably be better to use something like Citrix and/or their Secure Gateway so you only have to open up ports 443 and maybe 1494 depending on where you put everything.

Let's say now if people hacked into my DMZ it won't take much for me to get inside would it?

Again, depends on what all you're allowing in. If it's a single DMZ Exchange server talking to another Exchange server and maybe a DC then their access would be limited to those boxes so they would have to break into them to get anywhere else on the network.

 

[Boscoh]

Originally posted by: MulLa
Hi all,
How easy is it to hack into a VPN box with preshared key?

Assuming you're using a reasonably secure VPN device, such as a PIX, or a Netscreen, as well as IPSec/ISAKMP using 3DES encryption. It's fairly difficult to crack 3DES encryption. The goal is to get the key you use to encrypt/decrypt your data. You'd need to set your security-association lifetimes low enough so that a new key is generated often enough to deter anyone who might try to find your key. You can use something like an 8-hour lifetime if you want to. You might go as low as 15 minutes for *extremely* sensitive links.

3DES is pretty secure, AES is supposed to be a little more secure and a lot more efficient. I say it's "supposed" to be because compared to 3DES, it hasn't been around as long. Time will tell, but it is the current government standard.

ISAKMP handles the rekey procedure for IPSec. So it's safe to assume that if someone hijacked your ISAKMP session, they'd recieve your newly renegotiated 3DES key and have the key for your actual data tunnel. That said, ISAKMP is pretty hard to break into. It's got all sorts of mechanisms to prevent tampering with packets enroute, and other attacks.

While I wont say what lifetime's I use when I configure devices, I'll put it in a range. Anywhere between 15 minutes and 8 hours for IPSec, and 8 hours to 24 hours for ISAKMP.

It is FAR easier to break into a remote machine that is connected via VPN than it is to actually hijack the VPN tunnel itself. If you break into the machine and get control of it, you'll also get control of the VPN tunnel unless there is another layer of authentication that you have to pass through before you get access to any resources on the other side (read: username/password).

Personally, I think you ought to buy some books about VPN's and how to secure end systems to make sure you know what you're getting yourself into. I dont know how your company works, but I know of someone who brought up the idea of VPN with his company, was put in charge of implementing it for home users, didn't put in the right controls and had a virus wipe out half of his company's server farm and is now in search of a new job.

If you think I'm just preaching doom, just leave all your home users with unrestricted access to your network for a few months and see what happens. Eventually somethings going to get by your AV software.

I think it was Spidey that said VPN's are the demise of all network security. That's pretty close to the truth. You gotta know how to secure em, and to do that you gotta understand the technology and what you're dealing with.

 

[MulLa]

Thanks Nothinman, you're always extremely helpful. I suppose that's why all these books I read on Exchange are preaching front / back end setups. So in otherwords am I correct in saying "I won't gain much from a DMZ if I only have a single Exchange system for the organisation"?

Boscoh: No, you're totally correct in your comments about the importance of security. Very true about the ease of breaking into the machine itself rather than hijacking the session.

Alright then everyone. What would be the best way to deploy a single Exchange server for both LAN and internet access for company employees only. With limited external access on the internet, meaning not all staff will be given home access only executives with laptops. On one hand I have to open a whole lot of ports for Outlook access. On the other hand VPN can give too much access to users. Is there any other way? Or would I have to make a decision on either one? Factoring in the cost as well for a 35 user company.

Thank you once again (Forever saying thanks).