Secure Exchange Server 2003 POP3 Publishing

The first step is to enable the POP3 service on the Exchange 2003 server. By default, the POP3 service is disabled and it is not configured to start up automatically on system startup.

Perform the following steps to enable the POP3 service:

1. Click Start, point to Administrative Tools and click on Services.
2. In the Services console, locate the Microsoft Exchange POP3 entry and right click on it. Click the Properties command.

3. On the Microsoft Exchange POP3 Properties dialog box, click the down arrow on the Startup type drop down list box. Select the Automatic option.

4. After the Automatic option is selected, the Start button will become available. Click the Start button to start the POP3 service.

5. The Service Control dialog box shows a progress bar for starting the POP3 service.
6. Click OK on the Microsoft Exchange POP3 Properties dialog box after the service has started.
7. The Microsoft Exchange POP3 entry in the Services dialog box will show the service as Started and the Startup Type as Automatic (figure XX).

Now that you have a Web site certificate installed on the Exchange 2003 machine and bound to the POP3 service, you can configure the POP3 virtual server to require TLS security for all incoming connections:

1. Open the Exchange System Manager, expand your organization name and expand the servers node. Expand your server name and then expand the Protocols node. Expand the POP3 node and click on the Default POP3 Virtual Server node. Right click on the Default POP3 Virtual Server node and click the Properties command.
2. The General tab is the first to appear in the Default POP3 Virtual Server Properties dialog box. Click the down arrow for the IP address drop down list and select an IP address for the secure POP3 site. Make sure that this is not the same IP address used by any other POP3 server on the Exchange Server computer. You can use the same IP address used by another Exchange Server service, such as the IMAP4 service, but do not assign the same address to two POP3 virtual servers.

3. Click on the Access tab. Click the Authentication button in the Access control frame.

The computer that will be the ISA Server 2000 firewall must meet the following minimum requirements:

• A personal computer with a 1.5 MHz or higher Intel/AMD-compatible CPU
• For the operating system, Windows 2000 Service Pack 4 or Windows Server 2003
• 256 MB of memory (RAM)
• 20 MB of available hard disk space for program files
• Two network adapters that is compatible with Windows 2000 or Windows Server 2003 , for communication with the internal and external networks
• One local hard disk partition that is formatted with the NTFS file system for log files and Web caching (if you wish to run the ISA Server firewall’s Web caching facilities)

The ISA Server firewall and Web caching components work very well on modest hardware. This is true even when the SMTP filter is enabled and protecting the published SMTP servers. However, if you run decide to use the SMTP Message Screener on the firewall, or if you use SSL to protect Web Published Web site, or if you use the ISA Server firewall as a VPN server, you need to increase the minimum requirements to support processor intensive encryption services.

Install ISA Server 2000 after installing Windows Server 2003 onto the firewall computers. You must go through some specific procedures outside of the standard ISA Server 2000 installation when installing the firewall software onto a Windows Server 2003 computer. Please refer to Installing ISA Server 2000 on Windows Server 2003 for details.

Now you can create the secure POP3 Server Publishing Rule. Perform the following steps to create the POP3 Server Publishing Rule:

Perform the following steps to create the secure POP3 Server Publishing Rule:

1. Type in a name for the Server Publishing Rule in the Server publishing rule name text box on the Welcome to the New Server Publishing Rule Wizard page. Click Next.
2. On the Address Mapping page, type in an IP address for the internal secure virtual POP3 server in the IP address of internal server text box. Click the Browse button next to the External IP address on ISA Server text box. Select the IP address on the external interface of the ISA Server firewall that you want to listen for incoming secure POP3 connection requests in the New Server Publishing Rule Wizard dialog box. Click OK and then click Next on the Address Mapping page.

3. Click the down arrow for the Apply the rule to this protocol drop down list box on the Protocol Settings page. Select the POP3S Server.

4. On the Client Type page, select the Any request option. Click Next.
5. Review your settings on the Complete the New Server Publishing Rule Wizard page and click Finish.

6. The new POP3 Server Publishing Rule appears in the right pane of the ISA Management console. Note that in this example that I’ve created an unsecured POP3 Server Publishing Rule for testing purposes. You can create an unsecured POP3 Server Publishing Rule to test basic connectivity, but please disable or delete that rule as soon as you confirm connectivity.

The most common configuration has the POP3 client download mail from the POP3 server and remove the messages from the server. You can configure most POP3 clients to leave the messages on the server if you do not want them removed. The message stays on the Exchange 2003 Server and is available to the user at a later time. You might want to set up this type of configuration when the user uses POP3 on the road and the full MAPI Outlook client while in the office.

POP3 allows for downloading only. You must use SMTP to send responses to the messages or to create and send new mail. The POP3 client has several options:

If the POP3 user logs onto an ISP that provides an SMTP server address, the user can use the local ISP’s SMTP server to send messages. The ISP may even offer secure SMTP access that allows the use to protect credentials and data using SSL/TLS. Note that when the user uses a local ISP’s SMTP server, it becomes the users’ responsibility to force a secure connection with the SMTP server. Allowing the user to decide on the level of security provided for any connection is poor security policy.

If the user does not log on to a local ISP, or if the user uses an ISP that does not provide a secure SMTP server, you can create your own secure SMTP server. The secure SMTP server can be placed on the ISA Server firewall as a secure SMTP relay, or you can publish a secure SMTP virtual server located on the Exchange Server.

I’ll provide details on how to both create a secure authenticating SMTP relay on the firewall itself and how to create a secure authenticating SMTP server on the Exchange 2003 server in future articles.

The problem with this configuration is that it does not allow the POP3 component to work when the VPN connection is established. This would require split tunneling and split tunneling is an extreme security risk. For more information on the dangers of split tunneling, please see VPN Client Security Part 2: Forcing Firewall Policy on VPN Clients and Forcing Firewall Policy on VPN Clients

The most common solution to this problem is to have the user change the IP address used for the POP3 server to the Exchange Server’s internal IP address while connected to the VPN and then change it back to the public address used in the secure POP3 Server Publishing Rule when the VPN link is disconnected. No matter how you cut it, its not a very functional solution.

The SMTP client must be configured to negotiate a TLS connection with the authenticating SMTP relay. The method used to configure the client to use secure SMTP connections varies with the client. Regardless of the SMTP email client application, all clients will need a copy of the Root CA certificate of the CA that assigned the authenticating SMTP server its Web site certificate. I cover the details on how to configure the Outlook Express SMTP client in a future article.

In this article we discussed the procedures required to create a secure POP3 server. You saw how to request a certificate for the POP3 server and how to force a secure connection to the server. Finally, you saw how to create the secure POP3 Server Publishing Rule that forwards the incoming POP3 requests to the secure POP3 server.