URLscan is a DLL module that loads into the IIS process. Technically you could call it MITM, but no more so than a loadable module in Apache.
Insofar as configuring it is concerned - there is specific configuration recommended for Exchange. If you go beyond that configuration (which the OP has), then it specifically warns that you WILL have issues. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Kurt Buff [mailto:[email protected]] Sent: Thursday, July 14, 2011 3:49 PM To: MS-Exchange Admin Issues Subject: Re: OWA 2003 & URLScan On Thu, Jul 14, 2011 at 08:13, Osborne, Richard <[email protected]> wrote: > I have URLscan installed on my Outlook Web Access 2003 server. It is > set to block '\', '%', and '&' characters in the hope of making the > server more secure. Unfortunately this causes e-mails that use those > characters in the Subject not to open. Am I being unreasonably > paranoid? Do you allow these characters? Thanks. > > > Richard Osborne So, this sounds like URLscan MITMs the HTTPS conversation. Did you feed it the cert key so that it can decrypt the streams? I've never played with that product, but those characters are deprecated in the RFCs as being unsafe. Too paranoid? I don't think so, but this will ultimately be a political call, and you're likely to lose, unless you can get them to believe you when you point to the RFCs. Kurt --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist
