In these trying times

Unless you're reading this from your tropical island fortress (which I hope at least one of my readers has), you are no doubt seeing the dismal news coming out of just about every world market.  Times are tough and money is tight.  Every job is on the line, every new project is being scrutinized and every penny pinched until Lincoln screams.  Not only here in America, but Europe, Asia and every other corner of the world; a recession is being felt, and felt hard with few exceptions to be found.  Literally, as I am writing this, major market indices are falling like a stone on yet another set of bad economic news.

Now, this is a blog about Exchange Server, so how does that relate?  Pretty easily.  Email systems have been one of the most effective solution sets for reducing enterprise costs year over year.  Exchange Server has had a role in that, without a doubt. By reducing the costs of telecommunication and postage dramatically since their introduction, email solutions like Exchange Server have made it possible to continually do more with less.  As Exchange has evolved, the impact on your bottom line it provides has also grown.  Office Communications Server, Live Meeting and Unified Communications Services have all allowed businesses to grow their reach and access to clients without putting additional physical office space into play.

So without a doubt, we must renew our commitment to using technology to extend budgets, cut waste and continue to streamline business processes for our end-users.  There are a few things that this means to the average Exchange Engineer, and they are critical to take into consideration.

1 - Can you make due with less?  Overloading and Exchange Server to attempt to squeeze more life out of existing hardware may be a near-sighted option in the long run.  Machines collapsing under the strain of too many users can result in countless hours of overtime pay and unproductive time, which will lose money instead of helping the business make it.  There are many great resources for finding out just how much you can squeeze out of any given Exchange Server.  MSExchange.org, for example, has a great series of article on sizing Exchange 2003 which starts here.

2 - Are you ignoring maintenance?  Keeping the servers up and running 24x7 without maintenance windows for routine upkeep is definitely the number one cause of server failure.  No one wants downtime, but your uptime numbers (such as the fabled 5 nines) are for tracking unexpected downtime - NOT maintenance!  Each month, Microsoft releases critical patches and hotfixes that cannot be ignored because corporate concerns do not want to allow the servers to be rebooted. Failure to patch will cause security holes, allow memory leaks to cause damage and open you up to a host of other problems, all of which impacts your servers's ability to continue functioning, and impacts your bottom line directly.  This may not be the best time to try to upgrade, but that only strengthens the need for proper maintenance windows to be scheduled and upheld.

3 - Get all the data protection that you can afford.  Downtime (unscheduled, non-maintenance downtime to be exact) is expensive.  Fixed costs like power, salaries, benefits, real estate costs, taxes and the like continue to build up while the people who generate revenue can't make money, so every minute you're offline when they need to be working is a minute you're losing money.  It's as simple as that.  The solution, however, is rarely that simple.  Not every organization can possibly afford extensive Disaster Recovery solution sets (see disclaimer below).  This does not, however, mean you can ignore the problem.  Whatever backup/recovery/failover tools you can afford should be in your arsenal to keep the servers up and running whenever business is going on. For many, this means making due with existing solution sets.  That's fine, as long as you can make those solutions meet the needs of the organization.  If you use tape backup, make sure you can back up the entire data-set within your backup window.  If you use replication technologies, make sure you're meeting your Recovery Point Objectives and truly protecting the data.  No matter what, test...test...TEST!

Times are tough, no one can doubt that these days.  Technology is nearly always a cost center that gets looked at harshly during points of budget pinches.  Sometimes new systems and technologies are still required to meet the needs of the organization, but you can give your company the benefit of a well-run Exchange Server system with minimal additional spending, as long as you remember to take a common-sense approach to what needs to be done and what cannot be ignored.

Update now - no I mean it, NOW

Though I'm known for keeping a level head during these kinds of scenarios, there is an emerging vulnerability in both Exchange Server and Internet Explorer that you'll have to address immediately to keep your enterprise safe.  I wish I was kidding, but no, it's true.

The long and short of it is that specially crafted messages could be sent to an Exchange server that - even if only previewed by a user - can allow an attacker to take control of the Exchange server itself with full Exchange Admin privileges.  The details can be found at this link, but I'll summarize here.

If an attacker crafts a message in certain ways via TNEF (Transport Neutral Encapsulation Format), and that message is then either previewed or opened by an end-user (which is the point of email after all), then the attacker can gain elevated privileges on the Exchange server and wreak havoc. While that sounds like a major problem, there is good news.  The attack would require a sophisticated attacker creating just the right message and then finding a live mailbox to send it to.  Not only that, but it would need to get past the SPAM and CAPTCHA systems if you use them.  Finally, eventually the anti-virus vendors will jump in as well, scanning for messages crafted with the exploit.

The really bad news is that end-users do NOT have to open an attachment this time.  They can unwittingly infect the mail servers by previewing the message body or opening the message itself.  Since Outlook clients and now even Outlook Web Access both Auto-Preview by default, end-users can follow all best-practice safety protocols and still end up infecting the organization through no fault of their own.  Add to this that some anti-virus tools may use MAPI viewers to scan mail, which means that the system designed to shield you could accidentally infect you instead.  The same goes for backup agents that use MAPI clients to do brick-level backups.

There is one more bit of scariness to be told, though information on this last peice is more sketchy than the other exploit vectors. It would appear that the TNEF message may not need to be even previewed by an end user, but could in fact attack a server just be being received by the server itself.  Even until we know more for sure on this last point, I think the previous points - which are verified by this author and others - are bad enough that you should jump on this right now.

Microsoft has released a patch - also available via this same link, under "Security Update Deployment" and so you can protect yourself and your organization.  I strongly urge you all to do this immediately, and to have your end-users run Windows Update (Start|Windows Update on Vista, Microsoft Windows Update Online for everyone else) to get critical Internet Explorer patches as well.

Now, this is not only your Exchange server that you are protecting.  If an attacker gains privileges on your mail server, they can use it as a launching pad for attacking other servers with the same exploit or any other they'd care to try.  That means that if you don't patch your systems, you could inadvertently be responsible for attacks against other servers all over the net.

And so, I am asking my readers to protect the community at large as much as they can, by spending the time necessary to download and install the appropriate patches.  Yes, this will mean a maintenance window for a reboot.  Yes, it's annoying that we've gotten hit with yet another critical vulnerability.  But, yes, it is our responsibility to make sure that the attacks stop at our own borders, and that our own mail servers do not become the launching point for the next Code Red.

Exchange 14?

Few things strike as much terror into the heart of Exchange Engineers as the following sentence:

"A new version of Exchange Server has been announced."

As it is Friday the 13th, I figured today would be a good day to do my write up on what we know so far.

Exchange 14 (no release name suggested yet) is going to be Microsoft's next generation Exchange Server platform to replace Exchange Server 2007.  Development is already well underway, and several feature sets have worked their way into the public through official and unofficial channels.  There's even a video about some upcoming features on the Exchange Team Blog site (See this link).

What we know so far isn't that much, but there are some things that are becoming clear:

1 - No SQL back end yet (insert stream of obscenities here).

2 - Merging of discrete-server design with "Software as a Service" (SaaS) theories.

3 - OWA is going to now work properly with non-Internet Explorer browsers

 

No SQL is annoying, we really wanted to see a more robust back-end solution than the ESE/JET Engine system, but with x64 performance, I'm sure it'll hold up under the strain.  This is not a huge drawback, but is very disappointing.

SaaS is the new "Web 2.0," and therefore seeing this make its way into Exchange isn't a shocker.  The idea is that your local Exchange Server will be able to share mail data with Microsoft's forthcoming Exchange Live Service.  This means that mail will effectively be available in multiple locations and on multiple servers.  There are some major hurdles to overcome with this, and I'm going to be very interested in learning how they'll be cleared.  First, what about data security of corporate mail on shared server space with Exchange Live?  If a hacker compromises an EL server, does that mean that everyone's mail is at risk?  Secondly, how will that mail get to the EL servers?  Log shipping is designed to allow for only one active server system, so that's out, and without an AD merge it would be difficult for any semblance of Database Portability to get morphed in.

In the end, I am sure we'll be hearing about new methods for overcoming these two issues (and others) as the product moves toward Beta stage.

OWA working properly on Firefox and other browsers is a huge step for Microsoft.  Prior to now, you could only use the scaled down version of OWA in a non-IE browser window, which left a lot to be desired.  Allowing enterprises to use whatever browser they want to standardize on (within limits) makes the idea of removing Outlook from the desktops (and therefore saving a ton on licensing) very appealing.

All told, the software isn't even in Beta yet, so everything is subject to change.  However, these little tidbits of pre-release info are causing quite a stir, so stay tuned for more stuff as I get hold of it!

Nope, didn't forget about you

Hi folks, the blog is not dead, I promise!  Next week we'll be back in full force, starting with a nice long post on Online Maintenance!

In the meantime, I hope everyone had a great Holiday Season, and see you soon.