Securing Exchange Server - 02 Sep 1999

Configure Exchange or Outlook Messaging API (MAPI) clients to use encrypted remote procedure calls (RPCs), the default when communicating between servers at the same site. On the client you can use RPCs over the network and with dial-up connections. Unless you're in a security-sensitive environment, or running Windows NT outside North America, this 40-bit encryption might be all you need. You can force Exchange Server to use fixed ports for communicating via TCP/IP, something you would want to do to enable RPC communications through a firewall without opening up a wide range of ports (see http://www.microsoft.com/exchange/55/gen/Security.htm for more information). With Outlook 98 you can use the Outlook 98 Deployment Kit (ODK) to pre-configure and lock down your client options.

Use Outlook Web access with Secure Sockets Layer (SSL), a method that provides a manageable solution for basic email, contact, schedule, and public-folder access via Internet connections. With the Microsoft Windows NT 4.0 Option Pack, you can use Microsoft Certificate Server to become your own Certificate Authority (CA) and issue the required certificate for the Internet Information Server (IIS). Be sure to consider the encryption level you can and will support--either 40- or 128-bit encryption--especially if you plan to allow access from outside your intranet.

Use PPTP, included with RAS or RRAS, and 128-bit encryption. You can use the Connection Manager Administration Kit (CMAK), also available with the Option Pack, you can easily distribute and manage preconfigured dial-up connections including Internet and PPTP connections. CMAK provides for multiple dial-up entries, so you can use it with a central RAS phone book to automatically update DUN entries upon connection--a method that allows use of any client (POP3, IMAP, MAPI) with encryption for all communications provided over the PPTP channel.