Check: Exch-1-208
Exchange 2010 Client Access Server STIG:
Exch-1-208
(in version v1 r9)
Title
HTTP authenticated access must be set to Integrated Windows Authentication only. (Cat II impact)
Discussion
This feature controls the authentication method used to connect to the OWA virtual directories. Ensure this is set to Integrated Windows Authentication only. Anonymous access provides for no access control. Basic Authentication transmits the password in the clear and risks exposure, and the other methods are not recommended by Microsoft for this control. Failure to configure this as per the recommendation may result in unrestricted access to OWA virtual directory, passwords being sent in the clear, and/or the inability to correctly authenticate, depending on which change is made.
Check Content
Open the Exchange Management Shell and enter the following command: Get-OwaVirtualDirectory -server ‘<Identity Name>’ | Select Name,Identity,*Authentication If the ‘WindowsAuthentication’ is not ‘True’, this is a finding. If any other result for ‘WindowsAuthentication’ is set to 'True', this is a finding. NOTE: Typical results for this command would result in this display: Name : owa (Default Web Site) Identity : <Identity Name>\owa (Default Web Site) BasicAuthentication : False WindowsAuthentication : True DigestAuthentication : False FormsAuthentication : False LiveIdAuthentication : False
Fix Text
Open the Exchange Management Shell and enter the following command: Set-OwaVirtualDirectory -WindowsAuthentication $true -Identity '<IdentityName>'
Additional Identifiers
Rule ID: SV-44065r2_rule
Vulnerability ID: V-33645
Group Title: Exch-1-208
Expert Comments
CCIs
Number | Definition |
---|---|
No CCIs are assigned to this check |
Controls
Number | Title |
---|---|
No controls are assigned to this check |