Patrick
Fri Feb 03 13:36:22 CST 2006
snoopkilla wrote:
> Ok, so from a non-techy point of view.
>
> I am at the office, using my iBook on the airport, connected to the internet.
> Presumably my activites online can be traced, and the sites I visit can be
> monitored.
> I use
http://exchange.xxxxx.com/exchange. I am asked for a user name and
> password.
> I give it, i'm in.
> Now what is showing up and where?
> What are the ISS logs?
> Can normal monitoring of my http activity reveal what I am doing if I had to
> use a password to get to where I am - is it not secure?
> Am I being flagged at all on the exchange server itself?
>
> Sorry but I am somewhat of a tech neophyte but I find this all fascinationg.
>
>
> "Robert Moir" wrote:
>
>> Phillip Windell wrote:
>>> "Robert Moir" <robspamtrap+msnews@gmail.com> wrote in message
>>> news:eaHQwjCKGHA.2828@TK2MSFTNGP12.phx.gbl...
>>>> Phillip Windell wrote:
>>>>> I don't have the silly password policies that are described
>>>>> here,...but if one user knew another user's credentials and got into
>>>>> the email I wouldn't know how to find a "trail". The mail server
>>>>> would have no way to distinguish the wrong user from the right user
>>>>> since they are both using the same credentials, and I have never
>>>>> seen any "trail" recorded in Exchange that would tell me anything
>>>>> anyway. The only thing I ever saw was the last Access time/date,
>>>>> the last logon time/date, and the user account used for it,...it
>>>>> doesn't even have the IP# or machine name they came from.
>>>> Ah but the IIS logs will have that.
>>> With SMTP, yes
>>> POP3? Maybe, but doesn't that depend on what version of IIS? The IIS
>>> on Server2003 was the first with a POP3 service, but does Exchange
>>> use that one or use one of its own (like Server2000/IIS which had no
>>> POP3 service). With MAPI (Outlook) running on the internal LAN?, I
>>> don't think that will be in the IIS log.
>> You're right, I'm thinking of the sort of casual browing in OWA that people
>> might indulge in, without worrying about it too much or thinking they're
>> leaving a trace because they don't alter any of their settings. You've got
>> the log of all HTTP transactions if this is what they're doing.
>>
>>> I think the best way to monitor it would be to use some kind of
>>> method at the Database level of Exchange, rather than the transport
>>> level before it gets to the database.
>> For sure - and this is where it gets tricky... you can audit damn near
>> everything that happens of course but good luck seperating the wheat from
>> the chaff at this point, God knows its difficult enough with my suggestion!
>>
>> Rob
>>
>>
>>
While I can't answer your original question (or this one in that
context) I can say this much. I wouldn't be using your laptop anywhere,
but at the office to access your mail. Especially NOT an airport or
anywhere public.
Here's a scenario for you (and this is my opinion only). You are
sitting at an airport, and access
http://exchange.xxxx.com/exchange and
log in. Then, you start playing around with other user accounts.
Meanwhile, someone else is sitting in the airport with their laptop, and
they're recording what other people are doing on THEIR laptops. Not
only do they have your username and password, but because you started
playing around, they have other usernames and passwords.
It's a safe bet, that if this happened, your company would do three
things. 1) Put a stop to the stupid password policy. 2) Fire the IT
people and bring in a consultant to find out who was hacking their
systems. 3) Fire you, when the consultant finds that your username and
password are the ones that were used to log in. **Note, this wouldn't
happen overnight, but would eventually happen when the person 'sniffing'
your original access starts causing damage.***
So, truth be known, my recommendation is this. Even if your company
puts out a newsletter showing what everyone's username and password is,
leave it alone. Don't go playing where you don't belong. In the long
run, that's going to keep your job, while someone else loses theirs.
--
Patrick Dickey <pd1ckey43@removethis.msn.com>
http://www.pats-computer-solutions.com
Smile.. someone out there cares deeply for you.