Thanks for taking the time for the history and explanation. That helps very much.
We are budgeted to upgrade Exchange this year so I think I'll stand pat and let this be one of the new features. -----Original Message----- From: Michael B. Smith [mailto:[email protected]] Sent: Thursday, July 14, 2011 4:21 PM To: MS-Exchange Admin Issues Subject: RE: OWA 2003 & URLScan This is getting to be a LONG time ago. And my memory isn't 100% clear, which is why I didn't respond initially. Windows 2000 and the initial release of Windows 2003 didn't have any protections like URLscan. So, if you installed Exchange 2000 or installed Exchange 2003 on Windows 2000, then URLscan was a requirement (it helped prevent doing stupid stuff like allowing the execution of cmd dot e-x-e --- and that's how you found it spelled on lots of mailing lists after URLscan was initially released because otherwise URLscan would generate errors on anything that contained the non-specialized content). Windows 2003 sp1 and Windows 2003 sp2 have protections built into IIS that, for the most part, obviate the need for URLscan. Exchange 2003 via OWA also introduced protections into sp1 and sp2 that now examine/inspect every link displayed by OWA before a user is allowed to click on it (which causes its own set of problems, but we won't go there right now), which also reduced the need for URLscan. URLscan is no longer released for IIS 7 or 7.5, because its functionality is now part of the IIS core and some things that it protected against are simply flat-out not allowed anymore and the many of the rest require explicit configuration. Exchange 2007 and Exchange 2010 still investigate every URL that a user MAY click before passing that click through. That may or may not continue in the future, because the problem it was initially designed to address has now been handled by IIS. Perhaps this explanation helps, perhaps not. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Osborne, Richard [mailto:[email protected]] Sent: Thursday, July 14, 2011 5:06 PM To: MS-Exchange Admin Issues Subject: RE: OWA 2003 & URLScan http://support.microsoft.com/kb/823175 is the relevant article. The example .ini file blocks '\', '%', '&' and the article text explains the ramifications. I was trying to get a feel for how much risk allowing these characters would introduce, but I suppose that depends on what bugs are found in OWA & IIS. I'm getting the impression most people don't install URLscan on their OWA servers. -----Original Message----- From: Michael B. Smith [mailto:[email protected]] Sent: Thursday, July 14, 2011 3:51 PM To: MS-Exchange Admin Issues Subject: RE: OWA 2003 & URLScan For clarity's sake: when I say "it specifically warns", there is text in the configuration file that has the warning. There isn't a pop-up or event error or anything. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Michael B. Smith [mailto:[email protected]] Sent: Thursday, July 14, 2011 4:43 PM To: MS-Exchange Admin Issues Subject: RE: OWA 2003 & URLScan URLscan is a DLL module that loads into the IIS process. Technically you could call it MITM, but no more so than a loadable module in Apache. Insofar as configuring it is concerned - there is specific configuration recommended for Exchange. If you go beyond that configuration (which the OP has), then it specifically warns that you WILL have issues. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Kurt Buff [mailto:[email protected]] Sent: Thursday, July 14, 2011 3:49 PM To: MS-Exchange Admin Issues Subject: Re: OWA 2003 & URLScan On Thu, Jul 14, 2011 at 08:13, Osborne, Richard <[email protected]> wrote: > I have URLscan installed on my Outlook Web Access 2003 server. It is > set to block '\', '%', and '&' characters in the hope of making the > server more secure. Unfortunately this causes e-mails that use those > characters in the Subject not to open. Am I being unreasonably > paranoid? Do you allow these characters? Thanks. > > > Richard Osborne So, this sounds like URLscan MITMs the HTTPS conversation. Did you feed it the cert key so that it can decrypt the streams? I've never played with that product, but those characters are deprecated in the RFCs as being unsafe. Too paranoid? I don't think so, but this will ultimately be a political call, and you're likely to lose, unless you can get them to believe you when you point to the RFCs. Kurt --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist
