John Howard - Senior Program Manager in the Hyper-V team at Microsoft : ISA Server

ISA 2004 Web Publishing HTTP Filter stops default website page URL redirection

jhoward — Tue, 25 Apr 2006 19:35:00 GMT

Quick questions: In a firewall, if you're presented with a checkbox asking if you want to block requests with ambigious extensions, what would you do? I'm guessing the answer from 99% of you would be "of course, I want to be as secure as I can be". Well, read on. Maybe you won't want to check that box after all.

Here's a real annoyance I found last night (I must be in rant mode, sorry!). What's more annoying is I couldn't find a solution on microsoft.com or newsgroups to solve it. As I explained yesterday, over the weekend I setup a web-server for photo hosting running at home.

To do this, I simply used the web-publishing wizard in ISA 2004 to publish my IIS server out on the internet, filtering the accessible paths. However, I didn't set any HTTP filtering on the web publishing rule. Being a consciensious (ha ha) administrator and as good practice, it's best to ensure only the methods and extensions you are actually using on the web-site are allowed through the rule, and to block unwanted signatures.

The first part of the ISA rule HTTP filtering lockdown is on the methods tab. As this web-site is serving static content only, the only method I need is GET.

Then it's on to the Extensions tab. As this is a photos web-site, jpg and gif are in there. Similarly htm and html for obvious reasons. The skinning for the site uses CSS (cascading style sheets). The ico is an interesting one and I certainly learnt something last hight. You may have noticed on certain web-sites, a seperate icon appears on the tab if you're using Internet Explorer tabbed browsing through MSN desktop search (and other browsers of course), which also is stored in your favourites if you bookmark the site. I'd been curious for a while how that was done - well, not that curious, but on the list of things to find out at some point in the dim distant future. It turns out that the browser (if you do a network trace) sends a request for favicon.ico. Although I don't have a custom icon yet, it made sense to allow requests for icons to go through.

Now here's the real gripe. If you leave the rule as-is shown above, everything works. Let's say I go to http://www.mysite.com, I have a default.html in that directory on the IIS server and I get a redirection request (HTTP 304 IIRC - I'm at work typing this) to http://www.mysite.com/default.html. This makes it much easier for people not to have to type in the full URL. BUT, I want to block requests containing ambiguous extensions - the ISA property page tells me I can, it sounds like a good thing to do, so I checked it and re-applied the rule.

Once you do this, the redirect is blocked by the ISA server HTTP filtering. I found a few articles, mainly relating to people griping about exactly the same thing but no answers. I'm going to track down someone internally from the ISA team who may be able to help here, but this struck me as a very strange thing to do. A redirect doesn't really have an extension as such, so what can you put into the list to allow the redirection to take place?

Rant over. Hopefully I'll find the answer soon. There's some info on configuring HTTP Filtering here, including a baseline Mail Server Pubishing HTTP policy - guess what I'm going to be doing this evening....

Cheers
John.

ISA 2006 Beta Available

jhoward — Fri, 03 Mar 2006 19:42:00 GMT

http://www.microsoft.com/isaserver/2006/default.mspx is worth checking out - you can download the beta of ISA Server 2006. I can't download it myself as I'm off-site, but will be sure to install it at home in the next couple of weeks...

ISA Server 2004 SP2 Availability

jhoward — Mon, 06 Feb 2006 20:18:00 GMT

You may have spotted I haven't posted for a few days, but I've been off ill with the 'flu. Hence, my excuse for not having spotted the availability of ISA Server 2004 SP2 last week. It's also worth mentioning Maartens excellent blogcast on the features.

ISA Server 2004 SP2 Site (for download links and further information) on microsoft.com

IT Forum Highlights in Reading

jhoward — Fri, 27 Jan 2006 17:58:00 GMT

For those of you who were unable to attend IT Forum 2005 in November, a quick reminder that there are two full-day events re-running some of the most popular content. This will be held on the Microsoft Campus in Reading. The registration links are below - I know they are close to filling up, but if you want to go, please add your name to the waiting list. Similarly, if you are already booked but know you won't be able to make the day, please make sure you cancel your place to allow someone else to attend instead.

31st January: Topics include SQL Server 2005, ISA Server, Windows Server 2003 R2, MOM Management Packs & Virtual Server 2005 R2

9th February: Topics include Exchange 12, Security Configuration Wizard, Monad, Mobility and Windows Vista

RPC/HTTP and OWA through ISA Followup

jhoward — Sat, 07 Jan 2006 17:50:00 GMT

If you've been watching the series on RPC/HTTP I recorded a little while back, you'll know that I did a "trick" to allow both OWA and RPC/HTTP connectivity through a single external IP Address under ISA Server 2004. There was an annoying flaw which although caused no problem directly, caused ISA Server to log warnings about multiple IP addresses on a single network interface. I'd just lived with this for a long time not worrying about it, but now that I have MOM also running (just) at home, the alerts are getting on my nerves.

Well, I kind of had a busy but not so busy time over the Christmas break. One Virtual Server host machine was rebuilt on new disks as an an additional domain controller running Windows Server 2003 R2 this time. My other VS host now also needs updating to R2, but that will have to wait a couple of weeks. I also went through a full IP renumbering of my home network - primarily because I want to configure VPNs to & from other networks also using the 192.168.0.x range, plus have several easily managed subnets for quarantine, wireless access etc. The other thing I did simultaneously to the renumbering was move my "production" ISA Server into a Virtual Machine. I had a badly configured standby VM running if the physical ISA Server, a struggling and lowly old PIII/700 with 256MB RAM were to finally go bang. However, I built a new clean VM instead.

Back to the plot though. What I never thought of when doing my RPC/HTTP configuration was simply to use a loopback adapter as an additional network in ISA Server to bounce OWA traffic through rather than providing a secondary IP address to an existing network card. Obvious in it's simplicity in retrospect, and means that there's no more annoying ISA Event Log entries.

ISA Server 2004 Port Scan alerts

jhoward — Thu, 05 Jan 2006 17:17:00 GMT

I've been running ISA Server at home for a number of years now - first with ISA 2000, and more recently ISA Server 2004 SP1. I've realised over time that there are many false alerts of port scans, and know that most times, they are false. However, there's an interesting article here which goes into a lot of detail about what can causes these alerts and how to analyse them further.

Part 25: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Integrated Auth

jhoward — Fri, 16 Dec 2005 11:45:00 GMT

Continuing the blogcast series on infrastructure essentials.

The final part to the RPC/HTTPS series shows you how to alter the configuration we have such that Outlook 2003 can move seamlessly between external and internal connectivity through the use of integrated authentication. To do this, we need to change both the ISA server and the Exchange server. The overall end user experience, as you will see, is far better.

So over the Christmas break, I'll get round to recording a few more parts to the series, including VPN connectivity.
Click here to view.

Series Index:

0. Network configuration and series background.
1. Getting started
2. ISA Server configuration to allow basic web browsing capability
3. ISA Firewall Client basic configuration
4. ISA Firewall Client auto-detection through WPAD configuration
5. Configuring an Exchange mailbox and Outlook profile
6. Fixing 0x8004010F on Outlook send/receive
7. Installing our first Certificate Authority
8. Publishing OWA through ISA using Forms Based Authentication
9. OWA /exchange redirection
10. OWA nearly goes SSL - we have a certificate
11. OWA is available over SSL/HTTPS
12. Sending external email - Configuring outbound SMTP
13. Mail retrieval through POP3 polling
14. Preparations for Email retrieval through SMTP Transfer
15. Completing Email retrieval through SMTP Transfer
16. RPC/HTTP: Overview and installing RPC Proxy component
17. RPC/HTTP: IIS Config and a bit on certificates
18. RPC/HTTP: Exchange IIS Config completion
19. RPC/HTTP: Working from internal network
20. RPC/HTTP: Revisiting our ISA rules
21. RPC/HTTP: Outlook working externally. OWA still requires more work
22. RPC/HTTP: Bounce OWA through localhost
23. RPC/HTTP: OWA Back to HTTPS
24. RPC/HTTP: RPC Publication

Part 24: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - RPC Publishing

jhoward — Tue, 29 Nov 2005 13:48:00 GMT

Continuing the blogcast series on infrastructure essentials.

In the last part, forms based authentication for Outlook Web Access was back running again, bouncing through the localhost listener. In this part, we put RPC/HTTP back into place. We create a publishing rule for the Exchange Virtual Directory being published (/rpc). We also create a publishing rule for the RPC server. However, since recording this blogcast a couple of months ago now, this step is actually not necessary - I recommend you do not do this part of the configuration.

Click here to view.

Part 23: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - OWA back to HTTPS

jhoward — Thu, 24 Nov 2005 16:51:00 GMT

Continuing the blogcast series on infrastructure essentials.

We now move Outlook Web Access back to HTTPS, and we correct a naming error on the Network Listener "FBA LocalHost 443" in the last part (it's actually listening and remains listening on port 80). After having ripped things apart over the last few parts to this series, we piece things back together by updating the publishing rule "ExternalBasic-LocalHost (OWA)" for redirection of https://mail.contoso.com to https://mail.contoso.com/exchange

Only two more parts to go for a fully configured ISA Server publishing Exchange OWA and RPC/HTTP. Stay tuned.

Click here to view.

Part 22: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Bounce OWA through Localhost

jhoward — Fri, 11 Nov 2005 14:29:00 GMT

Continuing the blogcast series on infrastructure essentials.

To make the next steps clearer, here's a picture of what we're trying to achieve in combining Forms Based Authentication with RPC/HTTP, and the routes through which traffic will flow. Hopefully a picture speaks a thousand words - the blogcast goes through configuring ISA to bounce OWA traffic through our Localhost listener. As you watch, you'll notice that no-one is infallible (and especially count myself in that list), but it was only a minor mistake :)

Click here to view.

Part 21: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Outlook OK, OWA needs some work

jhoward — Mon, 07 Nov 2005 13:10:00 GMT

Continuing the blogcast series on infrastructure essentials.

With our new rule in place on the ISA Server, this sixth part of configuring TPC over HTTP for Outlook 2003 first takes a quick look at the effects on Outlook Web Access - we now get a basic authentication challenge instead of Forms Basic Authentication. However, we can still log on. We'll come back to that in a few parts time.

Our Outlook profile still has the internal name of our Exchange Server configured for the Exchange Proxy Server, so we alter that to point to the external name, mail.contoso.com. On restarting Outlook with the rpcdiag switch, we see that it connects using RPC over HTTPS through our ISA Server correctly from the Internet. Result!

We put our Outlook profile back to a more "normal" RPC/HTTPS configuration by connecting using TCP/IP on fast networks first, and HTTPS on slow networks first. We then take a look at what happens when we switch our client from internal to external to internal networks. Perfect!

Click here to view.

Part 20: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Start External Config

jhoward — Thu, 03 Nov 2005 12:44:00 GMT

Continuing the blogcast series on infrastructure essentials.

This fifth part of configuring RPC over HTTP for Outlook 2003 changes direction in getting RPC/HTTPS available from the Internet now that it is working internally. We backtrack on our ISA Server configuration as we can't (easily) have forms based authentication and basic authentication listening externally on port 443. Hence, we delete our old rules for publishing Outlook Web Access and new rules for our first stage in getting RPC/HTTPS available from the internet.

Click here to view.

Part 19: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Completing internal config

jhoward — Fri, 28 Oct 2005 15:07:00 GMT

Continuing the blogcast series on infrastructure essentials.

This fourth part of configuring RPC over HTTP for Outlook 2003 moves us on to ensuring that RPC/HTTP works internally from our Outlook 2003 client to our Exchange 2003 Server. First though, we correct a typo in the registry settings from the previous blogcast part (sorry!). One thing that is critical is to correctly configure our Outlook Profile for RPC/HTTP connectivity. We walk through the settings and change them, take a look at the "/rpcdiag" switch when starting outlook and end up with Outlook talking to our Exchange server through HTTPS internally.

Next week, we'll start tackling the ISA Server configuration to get RPC/HTTPS available from the Internet.

Click here to view.

Part 18: Infrastructure essentials Blogcast - RPC/HTTP for Outlook & Exchange - Initial Setup

jhoward — Tue, 25 Oct 2005 23:09:00 GMT

Continuing the blogcast series on infrastructure essentials.

The third part of configuring RPC over HTTP for Outlook 2003 configures the registry on Exchange 2003 and ensures that IIS is correctly configured on our Exchange server. This is a critical step in ensuring that internal problems are non-existant before continuing on to external publication.

Click here to view.

Securely Publishing Exchange 2003 using ISA Server 2004 - "Zero to Hero"

jhoward — Mon, 24 Oct 2005 22:35:00 GMT

Thanks for everyone who attended todays security event in London. I hope you got a lot out of the demonstration I ran through today, plus of course the other sessions. It was certainly the scariest and possibly "riskiest" session I've ever considered - taking on 90 mins+ of unrehursed demo could have gone very very wrong, but fortunately it all worked out perfectly. I totally underestimated the time it would take - if you had the patience, I could have gone on another hour and more besides, so sorry about that! At least no-one was snoring at the end :-)

Anyway, several people asked me for the slide deck (albeit very short and sweet), so here it is (it won't be going on the event site for download). Not the best deck in the world (sorry), but considering half of it was written during the train journey this morning having been awake since just after 3AM (Steve originally said no slides, just real live uncut stuff, but I had to bottle out of that one especially considering the subject material), I hope it helps.

Cheers,
John.