Windows Forum

Ask something
Discussion Locked

IIS4/Exchange Security question

0 helpful
2 replies

by kcrosby1

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a Exchange Mail server that uses OWA. IIS4 is installed on the same server. No choice about that. I understand that there is a new SP4 for Exchange 5.5 but what else might I do to security IIS4 from unwanted attacks????.... Probably basic IIS4 security things that I might need to turn off.

Any suggestions or pointed in the right directions would be appreciated,

Thanks, Kevin/Detroit

2 replies

by shanghai sam

In my experience, good security begins with 3 things:
a. Remove/disable any unnecessary services.
b. Install the latest security patches.
C. Monitor the system regularly.

Follow those general rules, and you will be in good shape.
If you're looking for a more detailed checklist, MS has one specifically for NT 4.0 running IIS available at: http://www.microsoft.com/technet/security/iischk.asp

Also, you should signup for notification of alll security related hotfixes. You can do this here:
http://www.microsoft.com/technet/security/notify.asp

by dao251

I would review your reasons for using OWA. Do you have many notebookless travelling people? Why don't you just use Outlook?

In case your big concern is security -- you better remove OWA and leave only known services allowed -- SMTP and RPC (the two Excahge ports IS & DS).

Elsewhere you really need to spend some time learning potential holes, cover them thouroughly and subscribe to MS Security bulletins and fix your IIS almost weekly.

I believe noone can answer you in two-three words like "close that and that".

Dima

This discussion is closed to new replies.