Microsoft Exchange Server
TMA-EXCHANGE-OWA-HTTPS
Ensure Outlook on the web virtual directories publish only HTTPS URLs
Beschreibung
OWA internal/external URLs must use HTTPS so that forms-based logon credentials and session cookies are never sent in clear text. Prints the number of OWA virtual directories with a non-HTTPS URL (expected 0). Run from an Exchange Management Shell or after `Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn`; the audit loads the snap-in itself when Get-ExchangeServer is missing and fails if it cannot.
So wird geprüft
Prüfmethode: Shell-Befehl
$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn -ErrorAction Stop }; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { throw 'Exchange Management Shell cmdlets are not available' }; $bad = @(Get-OwaVirtualDirectory -ADPropertiesOnly -ErrorAction Stop | Where-Object { ("$($_.InternalUrl)" -and "$($_.InternalUrl)" -notlike 'https://*') -or ("$($_.ExternalUrl)" -and "$($_.ExternalUrl)" -notlike 'https://*') }); $bad.Count- Erwartete Ausgabe
0
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Set-OwaVirtualDirectory '<server>\owa (Default Web Site)' -InternalUrl https://<fqdn>/owa -ExternalUrl https://<fqdn>/owa and keep 'Require SSL' enabled on the IIS owa application.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- exchangeowa
- Referenz
- CIS Microsoft Exchange Server Benchmark - Outlook on the web / Virtual directory URLs and SSL (verify section number for your release)
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target exchange