16.4. Microsoft ExchangeMicrosoft Exchange is perhaps best known as a mail server, but it also provides a number of other services, including news, calendar maintenance, contact management, and document exchange.
Both Exchange client-server conversations and the Exchange Administrator use Microsoft RPC, which is discussed in Chapter 14, "Intermediary Protocols". In addition, depending on how it is configured, Exchange may use SMTP, POP, IMAP, NNTP, LDAP, X.400, and/or LDAP over SSL. SMTP, POP, IMAP, X.400 over TCP/IP and NNTP are discussed in this chapter; LDAP and LDAP over SSL are discussed in Chapter 19, "Real-Time Conferencing Services".
Microsoft RPC is difficult to safely allow through a firewall using any technology because it involves connections at arbitrary ports and embedded IP addresses. It is difficult to secure with packet filtering and requires protocol-aware proxies or network address translation systems, which are not widely available. Therefore, you should avoid trying to support Exchange through a firewall using Microsoft RPC.
Almost all of the other protocols that Exchange supports are quite easy to allow through a firewall. Using them instead will impose three kinds of restrictions:
Exchange servers that are speaking to other servers can do all Exchange operations without using Microsoft RPC, using what are called Connectors that embed operations in other protocols. You can therefore make server-to-server connections over SMTP without losing functionality, although there will be some performance penalty.
Because Exchange is a large and complicated system, it's relatively risky to allow access from the Internet to an Exchange server, even if you use the more controllable options. If you need to support remote users from anywhere on the Internet, attempt to limit them to mail reading, preferably using IMAP over SSL. If you provide HTTP access, restrict it to a limited range of source addresses.
Administering Exchange is an extremely complex topic, and we cannot do it justice here. You may want to consult a book on Exchange administration (for instance, Managing Microsoft Exchange Server, by Paul Robichaux, O'Reilly & Associates, 1999).
16.4.1. Summary of Recommendations for Microsoft Exchange
Copyright © 2002 O'Reilly & Associates. All rights reserved.