[7.450][BUG][FIXED] unable to login into OWA - blocked by IPS

since I begin to use this beta I can't login to my exchange OWA. I get the login window but after I put the credential it doesn't open the page:

https://myexchangeserver.com/owa/auth/owaauth.dll

Parents

0 BAlfson over 15 years ago

Gnomme, what is the link you provide?

Normally, access would be: https://publicFQDNforMail.com/exchange/

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 15 years ago in reply to BAlfson

Gnomme, what is the link you provide?

Normally, access would be: https://publicFQDNforMail.com/exchange/

Cheers - Bob

when I enter the url to access my owa (outlook web access) I use this url:
https://publicFQDNforMail.com/owa (exchange 2007)
It seems a IPS problem because if I disabled it I can access the OWA. I am using the same settings of my 7.402.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 15 years ago in reply to gnomme

What IPS rule appears in the log?

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 15 years ago in reply to BAlfson

I had every kind of atack pattern configured to drop.

now I changed to "alert": attacks against Servers (919 attacks, 784 warnings)

and now works. It seems the 7.402 was more permissive since they put a newer version of IPS in this beta one
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 15 years ago in reply to gnomme

OK, but have you identified the rule causing the problem? IPS should skip it automatically when you put your exchange server into 'SMTP Servers', so you HAVE found a bug (if you had your Exchange server recorded correctly [;)]).

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 15 years ago in reply to BAlfson

OK, but have you identified the rule causing the problem? IPS should skip it automatically when you put your exchange server into 'SMTP Servers', so you HAVE found a bug (if you had your Exchange server recorded correctly [;)]).

Cheers - Bob

YUUUUPIIII!!! Bug FOUND!
I have my email server correctly defined in my ASTARO.
Do I need to comunicate the ASTARO people in order to tell them about the bug so that I can win the licenses prize?

thanks BOB
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 15 years ago in reply to gnomme

No, they will work through the threads like this one. That's why you should start a separate thread for each bug you uncover.

Cheers - Bob
PS Just to confirm: on the 'Advanced' tab of 'Network Security >> Intrusion Protection', the host you defined for your Exchange server is listed in the 'SMTP Servers' box?

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Simon Shaw over 15 years ago in reply to BAlfson

Why would adding Exchange to SMTP servers make any difference?

It's not using SMTP to do web login to Exchange, it should all be port 443 traffic. Help if the OP posts any alerts that IPS throws when IPS is set to notify rather than drop so people can pin down the exact rule/s that are triggering.

Perhaps Astaro could consider adding an "Exchange Server" definition field to IPS instead of just SMTP servers?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Simon Shaw over 15 years ago in reply to BAlfson

Why would adding Exchange to SMTP servers make any difference?

It's not using SMTP to do web login to Exchange, it should all be port 443 traffic. Help if the OP posts any alerts that IPS throws when IPS is set to notify rather than drop so people can pin down the exact rule/s that are triggering.

Perhaps Astaro could consider adding an "Exchange Server" definition field to IPS instead of just SMTP servers?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 BAlfson over 15 years ago in reply to Simon Shaw

Good catch, Simon. You're right, the issue is HTTP/S, not SMTP!

Gnomme, the right question is whether you have the OWA server in 'HTTP Servers' on the 'Advanced' tab.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Pestilent over 15 years ago in reply to BAlfson

I have my OWA servers listed in both SMTP and HTTP server sections with all Attack Paterns listed as "DROP". This works fine on my setup. My exchange servers are 2003 and 2007 and OWA is beign hosted usign HTTPS.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 15 years ago in reply to Pestilent

Thanks, Pestilent. Now, Gnomme, using the Intrusion Protection log, what rule causes the blocking of OWA traffic?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 15 years ago in reply to BAlfson

MarCow has belled the cat: https://community.sophos.com/products/unified-threat-management/astaroorg/f/98/t/67552

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 15 years ago in reply to BAlfson

Good catch, Simon. You're right, the issue is HTTP/S, not SMTP!

Gnomme, the right question is whether you have the OWA server in 'HTTP Servers' on the 'Advanced' tab.

Cheers - Bob

Yes I have! Here is the message I recieve in email alerts:

Details about the intrusion alert:

Message........: WEB-MISC SSLv2 openssl get shared ciphers overflow attempt
Details........: http://www.snort.org/pub-bin/sigs.cgi?sid=8428
Time...........: 2009:06:03-19:13:19
Packet dropped.: yes
Priority.......: 1 (high)
Classification.: Attempted Administrator Privilege Gain
IP protocol....: 6 (TCP)
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 chow11 over 15 years ago in reply to gnomme

I ran into this. I have IE 8, FireFox and Google Chrome, and the rule only triggers for IE 8. (of course for the other browsers, you can only log in with owa light which does not use active X).

Creating an IPS->Advanced->Modified rule and disabling 8482 worked for me.
FYI, if you host a phpBB3 forum, you also need to disable 2229.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 nitehawk over 15 years ago in reply to BAlfson

gnomme, cannot confirm this one. Can you please provide more details?
Which IPS rule is the one to blame for this?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 15 years ago in reply to nitehawk

I think is: Attacks against Servers
not sure...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Astaro Beta Bot over 15 years ago in reply to gnomme

Astaro Beta Report
--------------------------------
Version: 7.450
Type: BUG
State: FIXED
Reporter: gnomme
Contributor: 
MantisID: 0010623
--------------------------------