Check for visible external virutal directorys

[pauljex]

Hi

I look after several customers that have Windows 2000 or 2003 SBS servers. I set up access for my cusotmers so that they can access their Outlook remotely with OWA (secured with a username/password and restricted user access).

Becuase this requires port 80 to be fordward in to the LAN, it could be considered to be insecure and dangerious. I have taken measures to redirect any port 80 traffic that is not directed at the /exchange virtual directory to redirect to the customers main web site. I have also change the default virtual name of exchange to add an additional layer of security.

So hence my question, how can I check for other virtual directorys I have may have missed???

Thanks in advanced.

Paulj

 

[mrdenny]

I would recommend getting an SSL cert for them, so you can use https on port 443 not port 80. When using port 80 you are having them pass there windows username and password in clear text between the browser and the server.

It would be very easy for someone to watch that traffic and capture someone's account info, then log into there mailbox and read all thier mail.

Denny

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(My very old site)