Guide to the Secure Configuration and Administration of Microsoft ...
Guide to the Secure Configuration and Administration of Microsoft ...
Guide to the Secure Configuration and Administration of Microsoft ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Chapter<br />
5<br />
Multi-Server <strong>Configuration</strong>s<br />
Server-<strong>to</strong>-Server Communications<br />
Server-<strong>to</strong>-server communication in <strong>the</strong> Exchange environment is necessary <strong>to</strong> facilitate<br />
message transfers between users on different servers <strong>and</strong> for replication <strong>of</strong> direc<strong>to</strong>ry<br />
information <strong>and</strong> public folders between servers.<br />
Communication between servers is facilitated by use <strong>of</strong> a “connec<strong>to</strong>r” <strong>to</strong> connect <strong>the</strong><br />
server’s message transfer agents. The security posture <strong>of</strong> <strong>the</strong> Exchange environment is<br />
very dependent on which connec<strong>to</strong>r is used <strong>and</strong> how it is configured. There are several<br />
types <strong>of</strong> connec<strong>to</strong>rs available:<br />
Site Connec<strong>to</strong>r. The site connec<strong>to</strong>r uses remote procedure calls (RPCs) for server<strong>to</strong>-server<br />
communication.<br />
X.400 Connec<strong>to</strong>r. The X.400 connec<strong>to</strong>r can be used for connectivity between<br />
servers in different sites as well as connecting <strong>to</strong> o<strong>the</strong>r X.400 compliant mail systems.<br />
The connec<strong>to</strong>r complies with both <strong>the</strong> 1984 <strong>and</strong> 1988 CCITT X.400 st<strong>and</strong>ards.<br />
Dynamic Remote Access Service Connec<strong>to</strong>r – The dynamic remote access service<br />
(RAS) utilizes <strong>the</strong> Windows Remote Access Service for part-time network connection<br />
between Micros<strong>of</strong>t Exchange Server sites.<br />
Internet Mail Service (IMS). The IMS connec<strong>to</strong>r supports message transmission<br />
using <strong>the</strong> Simple Mail Transport Pro<strong>to</strong>col (SMTP) – <strong>the</strong> mail pro<strong>to</strong>col used on <strong>the</strong><br />
Internet. The IMS connec<strong>to</strong>r can be used for connectivity between servers in<br />
different sites as well as connecting <strong>to</strong> o<strong>the</strong>r SMTP compliant mail systems.<br />
For connecting two servers within <strong>the</strong> same Exchange site, only <strong>the</strong> Micros<strong>of</strong>t Exchange<br />
Site Connec<strong>to</strong>r can be used. Data sent via <strong>the</strong> site connec<strong>to</strong>r is au<strong>to</strong>matically encrypted<br />
using RC4 128-bit encryption (in <strong>the</strong> North American version <strong>of</strong> Exchange). Server-<strong>to</strong>server<br />
communications are au<strong>the</strong>nticated using <strong>the</strong> st<strong>and</strong>ard Windows NT<br />
challenge/response.<br />
For communications between sites, <strong>the</strong>re are more numerous options. The site<br />
connec<strong>to</strong>r can be used here, as well. When using <strong>the</strong> site connec<strong>to</strong>r in this manner, once<br />
again encryption is au<strong>to</strong>matically invoked. No encryption is available when using <strong>the</strong><br />
X.400 connec<strong>to</strong>r <strong>and</strong> au<strong>the</strong>ntication is via simple, plaintext passwords. When using <strong>the</strong><br />
dynamic remote access connec<strong>to</strong>r, security is dependent on <strong>the</strong> setup <strong>of</strong> <strong>the</strong> Windows<br />
22
Change language