disabling OWA pending config of FE/Encryption

[kaizer]

hello
i am new to OWA configs. I just found out that with no config at all, i am able to use OWA from home to access my office mail/exchange. It was a bit of a surprise since nowhere have i read that OWA is ready to go after an exchange installation. Ofocurse, what concerns me is the security aspect of this ability. So, i'm thinking i should disable OWA access altogether until i find time to configure a front end etc etc.
how do i do that? do i change setting in IIS or do i have to disable the http for every user manually?
thx

 

[Zelandakh]

what do you mean no config at all you can access OWA? You mean you get a username and password prompt I assume.

Check again. Do you do secure or not?

It works fine out of the box with HTTP only. HTTPS needs a certificate then it works straight off.

 

[kaizer]

hello Zeladakh
I do get a login dialog
but i'm assuming that communication is not encrypted and is just protected by the password?
In any case, how safe can it be when all i read is about ways to secure OWA?