Security Basics mailing list archives
Re: RPC over HTTP security
From: "Steve" <securityfocus () delahunty com>
Date: Tue, 1 Feb 2005 22:46:44 -0500
We ran OWA with SSL, didn't mean our server didn't get owned by a hacker. Consider running a reverse proxy 'nix based box in front of your OWA box which runs on IIS. STEVE ----- Original Message ----- From: "Eric McCarty" <eric () piteduncan com> To: "Paris E. Stone" <pstone () alhurra com>; "Shawn Wall" <sjwall () shaw ca>; "Kevin Doheny" <kdoheny () CNP net>; <sf_mail_sbm () yahoo com>; <security-basics () securityfocus com> Sent: Friday, January 28, 2005 2:43 PM Subject: RE: RPC over HTTP security Aren't we talking about : "Are you using Exchange? Why not use OWA and secure it with SSL?" If so the idea is to authenticate to the Exchange Server with Credentials which may not be encrypted, but flow through an encrypted tunnel. SSL does not provide Authentication, correct, but it does provide a secure transport for said authentication via other means, in this case the OWA Authentication (via whatever method setup by the user). E. -----Original Message----- From: Paris E. Stone [mailto:pstone () alhurra com] Sent: Friday, January 28, 2005 11:37 AM To: Shawn Wall; Eric McCarty; Kevin Doheny; sf_mail_sbm () yahoo com; security-basics () securityfocus com Subject: RE: RPC over HTTP security Maybe he means there is no Authentication to HTTPS? Anyone can type https:// and accept a certificate. All that does is make the traffic past that point illegible to an IDS, etc.... -----Original Message----- From: Shawn Wall [mailto:sjwall () shaw ca] Sent: Friday, January 28, 2005 12:54 PM To: 'Eric McCarty'; 'Kevin Doheny'; sf_mail_sbm () yahoo com; security-basics () securityfocus com Subject: RE: RPC over HTTP security I'd have to agree with Eric on this one. SSL is a proven encryption method. Billions of dollars are transefer via SSL encypted sites every year. If was as trivial to 'hack' as you suggest, Kevin, I don't think it would be in use. Perhaps you could do as Eric suggested and provide some factual proof. shawn -----Original Message----- From: Eric McCarty [mailto:eric () piteduncan com] Sent: Friday, January 28, 2005 10:35 AM To: Kevin Doheny; Shawn Wall; sf_mail_sbm () yahoo com; security-basics () securityfocus com Subject: RE: RPC over HTTP security Your joking right. "SSL in and of itself provides very little security" That's why most of the internet uses it right?. Your gonna have to back up statements like yours with some serious factual backing otherwise your comments will be discarded as B.S coming form someone who doesn't know what they are talking about. E. -----Original Message----- From: Kevin Doheny [mailto:kdoheny () CNP net] Sent: Friday, January 28, 2005 5:06 AM To: Shawn Wall; sf_mail_sbm () yahoo com; security-basics () securityfocus com Subject: RE: RPC over HTTP security SSL in and of itself provides very little security... Way to easy to hack. Look into a Neoteris (now Juniper) SSL VPN/Proxy. This way evil hack3r can not ride the SSL stream into your network and past any IDS or IPS systems. Kevin -----Original Message----- From: Shawn Wall [mailto:sjwall () shaw ca] Sent: Wednesday, January 26, 2005 11:04 PM To: sf_mail_sbm () yahoo com; security-basics () securityfocus com Subject: RE: RPC over HTTP security Are you using Exchange? Why not use OWA and secure it with SSL? shawn -----Original Message----- From: sf_mail_sbm () yahoo com [mailto:sf_mail_sbm () yahoo com] Sent: Wednesday, January 26, 2005 6:03 AM To: security-basics () securityfocus com Subject: RPC over HTTP security Hi List, We are thinking about deploying RPC over HTTP to access email from the Internet Wanted to get some information on the technology and the security implications of same Not much info from Microsoft's site any help would be greatly apreciated Thanks, Ronish
Current thread:
- RE: RPC over HTTP security Shawn Wall (Jan 31)
- <Possible follow-ups>
- RE: RPC over HTTP security Depp, Dennis M. (Feb 01)
- Re: RPC over HTTP security Steve (Feb 02)
- Re: RPC over HTTP security Barrie Dempster (Feb 03)
- Re: RPC over HTTP security Ansgar -59cobalt- Wiechers (Feb 04)
- Re: RPC over HTTP security Barrie Dempster (Feb 07)
- Re: RPC over HTTP security Barrie Dempster (Feb 03)