Windows Forum

Ask something
Discussion Locked

Exchange 2000 OWA

0 helpful
19 replies

by david__ 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

This will be a very long process, hence the high number of points for sticking it out.
I have a Win 2000 Exchange Domain controller with Exchange 2000 behind a firewall. I would like to be able to get OWA going on it. BTW: I also, regretfully, have run the IIS lockdown tool on it.
When it try to check it, it gives a error "HTTP 500 - Internal Server Error" My problem may be anything from the lockdown tool to the firewall to the setup not being right.

Thanks,
David

19 replies

by curlergirl

Well, you're right about this being a very long process. First of all, check the following:

1. Make sure the web site (usually the Default Web Site, unless you've changed it) is running on your Exchange server.
2. Make sure you see the Exchange web folders in the web site - you should see Exchweb, Exchadmin, Public, and Exchange folders on your default web site.
3. If the folders have red x's on them, stop and restart the web site and then refresh your screen. They should become active at that point.
4. Check the directory security settings as follows:
a. On the Exchange Server, open the Exchange Manager, drill down to your server level, open Protocols/HTTP/Exchange Virtual Server and you should see Exchange and Public folders. Look at the Properties/Access tab and click Authentication - should be set to Basic or Integrated Windows (NOTE - integrated windows authentication can be problematical with firewalls, even Microsoft's ISA server).
b. In the console for the web site, check the directory security for the Exchweb folder - should be set to allow anonymous access.
5. Check the NTFS permissions on the \exchsrvr\webdata and \exchsrvr\webtemp folders - should be set to allow full control for AuthenticatedUsers.
6. Your firewall needs to allow port 110 (both directions) and GRE.

See how this does for you - hope it helps!

by david__

That was some great info.
This is what I found:
1. Good.
2. Good.
3. Had to restart - Good.
4. a. Good
b. had to set access.
5. webdata and webtemp do not exist.
6. Good.
I also found that in the exchange console under the exchange virtual server there are the three directorys (exadmin, exchang, public), but nothing in them.
What now boss?

Thanks so much,
David

by curlergirl

OK - I mis-wrote on the NTFS folder permissions - Webdata and Webtemp are Exchange 5.5 folders, not 2K. For 2K, you need to check the minimum level of permissions on the following: \exchsrvr\exchweb and \exchsrvr\Mailroot folders - Authenticated Users (or Everyone) full control; c:\Inetpub and c:\Inetpub\wwwroot folders - Authenticated Users (or Everyone) Read & Execute, Read, and List Folders Contents.

Also, one thing I forgot to mention, in the Basic Authentication settings, you should see a box for the domain name. Be sure that your correct NetBIOS domain name is shown here. If there is a "\" or if the box if blank, change it to your domain name.

Once that's done, try to run Outlook Web Access internally by going to http://[servername]/Exchange. See if this works. If it doesn't, try just going to http://[servername] and see if you can at least get to the web site itself. If you CAN get to both Exchange and the web site internally, then try externally again see what happens. Good Luck! Let me know the results of this.

by reference

This may be crazy enough to be the problem.....doubtfull though
Is port 80 opened on your firewall and forwarded to your server?

by shmaltz

Actualy the last part (from BTW and on) of your problem is very easy to figure out.
If you can run OWA using the local Exchange Server machines Internet Explorer than the problem is not with the config of OWA. If you get the same error when using the local Exchange Server as the client browser than the problem is with the OWA config.
If it works from the local machine but not from the Network; if it works from withing the firewall but not outside the firewall. The problem is with the firewall. If it doesn't work even on the LAN then the problem might be with the IIS LockDown tool.
Let me know and I'll try to help you.

by david__

Sorry to change to the subject, but the more I look at trouble shooting OWA the more unsecure it looks and the more I'm not sure if I want to use it. Would it be easier to get Exchange working with just a Pop3 client (like Outlook Express) than getOWA working? Would it be more secure?
Thanks,
David

by shmaltz

Security:
Depends if you are talking client (capturing packets) or server (take over control of your server) security.
Server:
Using OWA is less secure for your server then using POP. However if you don't allow any connections to your WEB server unless they are authenticated using either (don't use basic, even though it will allow you to connect from any client, since it is not secure) intergrated, SSL, or Digest (SSL is the best, but costs the most to setup) then your risk of being attackedusing HTTP is reduced enough to be able to say that it is almost as secure as POP or more, since it doesn't allow any one to captured packets because it is secure.
Client:
If you use POP then anyone that can capture the packest on the Internet will be able to read the usernames and passwords. Which is far more insecure than having a web server running OWA. Since every Exchange user is also a domain user. However the fact that POP is enabled on your server will not make your server unsecure asmuch as OWA does. For example if you enable OWA but don't have any user that has on the user level permissions to use the HTTP protocol (which means that no one can use OWA), your Server is much less secure than when you have enabled just POP and nouser that can use POP. If however you decide to use encrypted POP then you will have a much secure Server, but again this is not easy to set up.

by shmaltz

I use POP and OWA on my Exchange Server. OWA is enabled for every user using Intergrated security. I host only one web site on this Exchange Server which is OWA, and is restricted to Intergrated Authentication. I have personally tried to hack this server with known vulnerabilties that worked on other IIS 5.0 Servers before the Fix from MS that fixed that known vulnerable was applied. An IIS Server that allowed anonymous connections I was able to exploit with that vulnerable. However my ExchangeServer on which I don't allow any anonymous connections, I wasn't able to exploit.
I enable POP only for remote users, or users that need it for a few days/weeks because they are traveling. If the user is a remote user then there is alot of places that I have to make sure that are secure, and they are considered high risk users anyhow, for whom I enforce a lot of restrictions (like changign passwords more often, more complicated passwords, and restricted system access on the whole network). Ifit is a traveling user that needs it temporarly, I just require them to change the password once they are back to normal, and then disable POP.

by shmaltz

If you want to go with POP rather than OWA, here is how you set it up.
POP (like every protocol in Exchange) has to be enabled in 2 places, 1 in the Server level, and 2 at the user level. Server level you do in System Manager, under the server there is a protocol folder just make sure that POP is enabled. User level you do in Active Directory Users and Couputers. Under the protocl button (I think that you have to enalbe advanced view to see the tab that has the protoclos button, I'm not sure though). You also have to make sure that both port 25 (SMTP) and 110 (POP) are open to your Exchange Server from the Internet, so clients can succesfuly send and receive email.

by shmaltz

If you want to go with POP rather than OWA, here is how you set it up.
POP (like every protocol in Exchange) has to be enabled in 2 places, 1 in the Server level, and 2 at the user level. Server level you do in System Manager, under the server there is a protocol folder just make sure that POP is enabled. User level you do in Active Directory Users and Couputers. Under the protocl button (I think that you have to enalbe advanced view to see the tab that has the protoclos button, I'm not sure though). You also have to make sure that both port 25 (SMTP) and 110 (POP) are open to your Exchange Server from the Internet, so clients can succesfuly send and receive email.

by david__

This is looking good so far, thanks for the info so far.
How do I setup Exchange 2000 to require Secure SSL for SMTP and POP? Just to make sure, this will secure the user name and password, correct?

Thanks,
David

by david__

I ended up useing vpn. I would like to split the points between you two guys. How can I do that?
Thanks,
David

This discussion is closed to new replies.