Security

Ask something
Discussion Locked

Block HTTP access to OWA

0 helpful
7 replies

by psx 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I would like to limit connections to my OWA site to only https connections.

Currently I am allowing both http and https traffic to my OWA server from all clients(internal and external). I modified the default.htm file to redirect clients to an https connection (my users prefer to not have to type "https://" when accessing their mail).
I am not hosting anything other than OWA on this server so disabling http access will not affect anything else.

How would I go about redirecting http requests to https? I tried redirecting http requests to https (port 443) on my firewall but that didn't work.

7 replies

by techkid

As a note: Microsoft doesn't recommend you do the fix I gave you. They recommend you close port 80 traffic entirely to stop all port 80 threats at the firewall. They recommend you force/teach your users to consciously enter httpS

by psx

Closing port 80 at the firewall was my original plan, but before that can happen, I must have something in place otherwise my phone will be ringing off the hook (most of my users are among the if-it's-not-broken-don't-fix-it crowd).

by psx

I would expect some tricks on the firewall, not on IIS itself.

Thanks. Once again, TechKid to the rescue! :)

For those of you too lazy to click on the link, the solution was creating a redirection page and changing the default page for the "HTTP 403.4?Forbidden" message to that redirection page. So, when your user types in http://mail.yourdomain.com, they will be redirected to the "HTTP 403.4?Forbidden" error page but the page has been replaced with an ASP code to, again, redirect you to https://mail.yourdomain.com.

I'll keep the thread open for another couple of days to see if there's any other solutions to this problem.

by jt

if you change the properties in IIS manager to require secure
communications it should do it. pull up your IIS manager and
expand web sites and then default website, then right click
exchange and pull up properties. Hit the directory security tab
and check "Require secure channel (SSL)"

Do this for Exchweb as well, this should work. you can also do
this at the default web site level (confirm that it follows through
though) I would also recommend that you point the home
directory of the default web site to "A redirection to a URL" and
enter the https url of the exchange web access to make it easier
for your users. That way when they hit the default site, they are
automagically redirected.

by psx

Well...I am retracting my comment. I implemented this solution but found out that on certain systems (XP Home, IE6 w/ all patches) the browser does not pull the 403.4 error page from my server. I'm still not sure where it's getting the https error 403 page but it's not getting it from my server. Because of this, the user does not get redirected and so they are lost.

This particular user happens to be one of the small group of very important people in my organization so I had to quickly reverse the changes thus I didn't have time to investigate further as to why the browswer is not looking to my server for the error page.

Anybody else have a solution to this?

This discussion is closed to new replies.