Ah. That makes sense. I didn't know if it was a separate piece of hardware or software, or whatever. I'd seen reference to it in random places, but never investigated it.
Kurt On Thu, Jul 14, 2011 at 13:42, Michael B. Smith <[email protected]> wrote: > URLscan is a DLL module that loads into the IIS process. Technically you > could call it MITM, but no more so than a loadable module in Apache. > > Insofar as configuring it is concerned - there is specific configuration > recommended for Exchange. If you go beyond that configuration (which the OP > has), then it specifically warns that you WILL have issues. > > Regards, > > Michael B. Smith > Consultant and Exchange MVP > http://TheEssentialExchange.com > > > -----Original Message----- > From: Kurt Buff [mailto:[email protected]] > Sent: Thursday, July 14, 2011 3:49 PM > To: MS-Exchange Admin Issues > Subject: Re: OWA 2003 & URLScan > > On Thu, Jul 14, 2011 at 08:13, Osborne, Richard <[email protected]> > wrote: >> I have URLscan installed on my Outlook Web Access 2003 server. It is >> set to block '\', '%', and '&' characters in the hope of making the >> server more secure. Unfortunately this causes e-mails that use those >> characters in the Subject not to open. Am I being unreasonably >> paranoid? Do you allow these characters? Thanks. >> >> >> Richard Osborne > > So, this sounds like URLscan MITMs the HTTPS conversation. Did you > feed it the cert key so that it can decrypt the streams? > > I've never played with that product, but those characters are > deprecated in the RFCs as being unsafe. Too paranoid? I don't think > so, but this will ultimately be a political call, and you're likely to > lose, unless you can get them to believe you when you point to the > RFCs. > > Kurt > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe exchangelist > > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist
