Jayblowfish Hosting

STILL IN PROGRESS

First off let me just say to all of my faithful and excellent subscribers, sorry for taking so long to add new content.  It is a busy life as you know and we still aren’t paying all the bills with this company. (close though )  Anyway, I have moved to a new job that keeps me busy but also has taught me a ton.  So, I have renewed energy to publish.  Hee goes!

Ok folks, here is my attempt at documenting my efforts in the past several months on a bunch of projects.  The first and biggest project was to deploy exchange services for customers as well as making it secure, easy to access, and providing native functionality with Outlook (RPC) without using VPNs or special connections.  I also am in the middle of an anti-spam filter solution using open source and some long hard hours figuring out how to deploy some promising software.

In order to accomplish this task you must attend to the following pieces:

1. Good working knowledge of Windows 2003 Server…especially IIS.

2.  Good working knowledge of Exchange Server….for my purpose 2003.

3.  Decent understanding of SSL and how certificates work in a Windows environment.

4. End User application configuration knowledge.

I will start this article by assuming a few things other than the above mentioned items.

a. A working installation of Windows 2003 Server SP2 or later.

b.  A registered domain name

c.  And, either a static IP address (public) or a working dynamicDNS account.

Ok, given these things I will now go into as much depth as I can about the process I followed using as much sequential skill as possible.

First things first:

Get your windows server and exchange server installed and working correctly.  This is not easy and takes a bit of work  there are many great tutorials and walk throughs at Microsoft and other sites that can help you if you run into trouble.  The main thing to remember is the follow the Exchange installation steps closely making sure each step is done successfully.  If you do that your Exchange installation will work.

Once you have Exchange installed run the Internet Mail Wizrd from the Exchange System Manager.  If your server is setup correctly and DNS is working properly you should pass the test for Internet email.  Once the wizard is finished you should now be able to send and receive emails from the outside world.  Very cool.  This is not anywhere near being done even though you are now sending mail successfully.

NOTE:  There are some compatibility issues with Exchange 2003 and Server 2003 (thanks for keeping it clean Microsoft) so sometimes the Internet Mail Wizard, even though completed does not receive email from the outside world.  Not to worry!  Microsoft always keeps us on our toes and then throws out a service pack to pacify the masses.  Check out the Service Pack 1 and Service Pack 2.  Usually I just install SP2 and am done with it.  However, I have found that, on occasion, it is helpful to install them both in sequence.  Having said that, unless you have to get this done today in a hurry, install them both.

This should fix the receiving mail problem.  The other resolution for this problem is to remove the SMTP virtual server connector under:

Administrative Groups>First Group>Servers>your server name>Protocols>SMTP.  Delete the connector and run the Internet Mail Wizard again.  (of course do this after you have installed the service packs…remember sequence!)

Getting Your Certificate Free and Effective (security)

Ok, if you are like me and don’t have money for anything extra you might enjoy getting into the big boy arena a little cheaper than usual.  If so here is what I did that really worked well. (don’t listen to people who say that Microsoft, Apple, and others will not function correctly without a signed certificate from a ‘Microsoft Approved’ signer.)

Go to https://startssl.com and make a free account.  Follow the website’s directions carefully and don’t take shortcuts.  You must register and get the authentication certificate installed onto your local machine using FireFox web browser.  Don’t try to do this in a different, custom, or unique way.  DO WHAT THEY SAY.  Trust me I did not follow directions well and wound up paying to have some certs revoked so I could start over.  Once you pay for your mistakes with real cash you tend to stop making them or you don’t finish your project.

Make sure you backup your newly installed certificate somehwere safe and secure.  Personally I would put it on a cheap old 256mb pendrive and put it in the top drawer of your desk and never move it unless you need it in the future to reauthenticate to startssl.com.  I lost mine and it is a real bummer fixing it TRUST ME!

Now, a couple of tips about doing this:

1. Make sure that you match the certificate’s COMMON NAME with the host name of your Windows 2003 Server. This is extremely important because the certificate will throw a signing error in Internet Explorer for all of your users if you don’t have a good clean match.  To me, I would use a self signed certificate if IE wouldn’t put up such a fuss.  I find it distracts users and also does not work properly all of the time.  So just to be clear using an example from one of my servers:

during the signing request the system asked for Common Name.  The W2k03 server name was Mailserver.  So I entered Mailserver for the common name.    Actually, the rest of the signing request process doesn’t matter much.  It is important to make a 2048 signing request for enhanced security; and startssl wants it this way.  Once you are done with the request you copy the code from the generated .csr file and past it into the text field on the startssl website.  Generation of the actual certificate is automated but it takes a little while. (i usually wait an hour then check it)  In the Control Panel go to Retrieve Certificates and you will see your new certificate waiting for you.  Get the code by copying it and go to your windows server IIS mmc and install the code into the pending request wizard.  (step by step certificate installation) Once your certificate is installed you can test it by opening up port 443 on your firewall, ensuring that the default web site in IIS is set to use port 443 and the new certificate.  Use your web browser (preferably IE since it is the most susceptible to SSL errors) and manually enter: https://yourdomainname.your extension.  You should get a white address bar and no certificate warnings or errors.  If you do get errors don’t worry.  Make sure you cn hit your web server from a browser that is strickly outside your network.  If you are sure that the errors persist from an outside hit then you need to redo the certificate making sure the common name and the server name match.  Also, read up on startssl website about making accurate certificates.

If all is working as expected then you are well on your way to having secure emails with full exchange features.

Testing OWA and Preparations for RPC over HTTP

Now that your certificate works you can also test OWA.  If you do not have a separate web server and plan to use IIS then you can simply type into a web browser http://yourdomainname.extension/exchange  This will bring up and authentication windows asking for username and password.  If you see this be HAPPY!