???????? ???????? ???? ??? ??? ??????? ????? IIS Lockdown ?? ???? Exchange 2000 Server

???? ??? ??????? ????? Lockdown ????? ??????? ?????? (IIS) ??????? 2 ?????? ???? ??? ????? ??????? ?????? ????? ???? Microsoft ?? ?????? ??? ??????? 2.1 ??? ?????. ??? ????? IIS Lockdown ????? ???????? ???? Microsoft Exchange 2000 Server ????? ????? ????????? ??? "????? ????" ????? ?????? ????? ??? ??? ???? ???? ????. ??? ???? ??????? ??? ??? ??? ????? ?????? Exchange 2000 ??? ????? ??? Access ??? Outlook ?? Microsoft "(OWA)" ???????? ??????? "? ????? ?????? ??????? ?? ?????? ???, ????? ????? ????????? ??? ???????? ?? ??? ??????? ???????.

??????: ?? ?? ??? ????? ????? ????????? ?? ??? ??????? ??? Exchange 2000.

??????? ????????

????? ??????? ????????? IIS Lockdown ????? ??????? ?????? ???? ???? ?????? Exchange 2000 ???? ???????. ?????? ??? ???? ?? ?????????? ???? ??????? ????? Lockdown IIS ?????.

????? ??????? ??????? ????? ????????? ???? ?? ??????? ???? ??????? ??? ????? ????? ???????? ??????? ??????. ???? ??? ???? ?? ????? ?? ???? ???? ????? ?????? Urlscan.ini ?? ?????? ???? ????? ??? ????? ?????. ??? ??? ????? Urlscan.ini ?? ?????? ??????:

??????? ????

• ?????? ???? ?? ????. ???? ?? ????? ??? ??????? ??? "1" ?????? ?? ?? Outlook Web Access ???? ?????? ??? ???????? ????? ?? ???????? ????????? ??????? ??????? Outlook Web Access. ?????????? ??????? ?????? ????? Microsoft Internet Explorer 5 ??????? ? ????? Microsoft Internet Explorer 4.x ?? Windows 95 ?????????? ??????? ? Microsoft Internet Explorer 4.01 ?????? ????? ?????? Service Pack 2 ????? ??????? Windows 98 ?????????? ??????? ? Netscape Navigator.
  
  ???? ??? ??????? ????? ??? ????? ?????? ???????. ?????? ????? ?????? ??????? HTTPDAV (??? Outlook Web Access). ????? ??? ????? ??? ??????? ??? ?? ???????? ???? ????? ??? ????? ???????? ????????. ?? ???? ????? ??? ??????? ??? ????? ????????? ?????? ??? ???????? ?? ?? ???? ????? ???????? ???????? ??? ????? ????????? ???.

Outlook Web Access Exchange 2000 Server

• ?????? ?????. ?????????? ??? ????? ??????? .htr. ??? ?? ????? ??? ????? ?? ??????? ?? ???? ???? Outlook ??? Access ????? ???? ??????.????? ?? ????????? ??? ??????? ??? ????? ???? "????? ???? ??????" ?? Outlook Web Access ???? ??? ??? ??????? ?????? ?????? ?? "????? ??????? ?? Microsoft:
  297121

  (http://support.microsoft.com/kb/297121/ )

  ????? ????? ???? "????? ???? ??????" ?? ???? "?????? Access ??? Outlook"
• ??? ??????? Url. ?? ?????? [DenyUrlSequences] ???? ?? ??????? ?? ???? ???? ??????? ???? ??? ????? ???? ???? ?????? ??? Outlook Web Access. ?? ????? ?????? ?????? ?? ??? ???? ?????? ???? ????? ??? ?? ?? ??????? ????? ?????? ?? ??? ??????:
  • ..
  • ./
  • \
  • %
  • &
  ??? ???? ??????, ?????? ?????? ?? ???? ???? ??? ?????? ????? ???? ???? ?????? ??? ???? ????? ??????? ????? ????? ?? ". /":
  / Folders/Projects./Costings.eml ??????/Exchange/????
  ?????? ?????? ????? ?? ???? ???? ????? deny ???? ?? ".." ? ????? ???? traversals ??????:
  / ??????/Exchange/????/???? message.eml
  ??? ????? ??? ?????? ?????? ??? ?????? ???? Outlook Web Access ?? ????? Urlscan ? ???? ?? ??? Urlscan.log ?????? ??? ??????? ?? ????? ??? ???. ???? ??? Urlscan.log:
  WinDir\System32\Inetsrv\Urlscan

Outlook Web Access Exchange Server 5.5

• ????? ???? ??????. ??? ??? ???? ?????? ?????? ????? IIS Lockdown ????? ???? Exchange Server 5.5 Outlook Web Access ?? ???? ???????? ??????? ???????? ????? ????? ???? ??????:
  1. ????? ????? ???? ????? Iisadmpwd ?? ????.????? ?? ????????? ??? ????? ????? ????? ???? ????? Iisadmpwd ???? ??? ??? ??????? ?????? ?????? ?? "????? ??????? ?? Microsoft:
     301428

     (http://support.microsoft.com/kb/301428/ )

     ??????? ??????? ???????? ?? Outlook Web Access ?? ????? IIS
  2. ?????????? ??? ????? ????????? ?????? .htr ?????. ??????? ????????? .htr ???????:
     1. ??? ????? ????? ????? ??????.
     2. ???? ??? ?????? ?????? ??? ???? ??? ????????? ?? ???? ??? ?????.
     3. ???? ??? ????? ??????? ?????? ??????? ?? ???? ??? ?????.
     4. ???? ??? ????? .htr ?? ???? ??? ?????. ????? IIS Lockdown ?????? ??? ??????? 404.dll. ????? ??????? ??? ism.dll.
     5. ???? ??? ????? ?????? ???????.
  3. ?????? ?? ??? Urlscan.ini. ???? ?? ???? ???? .htr ?? ?????? AllowExtensions ?????? ?? ?????? DenyExtensions.
     
     ?????? ???? ?? ?? ?????? .htr ??? ?? ?????? & .ini & ????? ????? ??????? ??????? ??????? ??????. ????? ?? ?????????? ???? ??? "????? ?????? ???????" ?? ??? ???????.

????? ????????? ???????

• ?????? ?????. ???? ?? ?? "ACL" ? "?????" ???? ??? [AllowVerbs] ??????.????? ?? ????????? ??? ??????? ???? ?????? "???????? ???????" ???? ??? ??? ??????? ?????? ?????? ?? "????? ??????? ?? Microsoft:
  298421

  (http://support.microsoft.com/kb/298421/ )

  ????? ????? ???? ??????? ??????? ???????? ???????

????? ?????? ???????

• ??? ??????. ??? ????? .com ?? ?????? [DenyExtensions] ?? ??????? Urlscan.ini ??? ??? ???? ???? ??? ?????? ??????? (DNS) ????? ??? ?????? ??????? .com.

?????? 2000 Exchange ????? ????

????? ??? ?????? ??? ??????? ????? ???????? ???????:

• Outlook Web Access
• ????? ???? Exchange
• ????? ????????? ???????
• ?????? ???

????? ????? IIS Lockdown ????? ????? ?? ????? ?????? ????? ??? ???? Exchange 2000 ????. ????? ?????? ?????? ?????? ????? ?? ????? ??? ????? ??? ??????? ??? ????? ??? ????? ???????. ?? ???? ???????? ????? ??? ????? ??????? ?? ?????? [AllowVerbs] ?? ????? Urlscan.ini. ??? ???? ?? ????? ???? ?? ?? ??????? ???????? ????? ?????? ?? ?????? ??????? ???????.

?????? ??? ??????? Urlscan.ini ??? ????? ?? ?????? ??????: ?? ?????? ????? Urlscan.ini ???????? ??? ??? ???? 2000 Exchange.

??? ?????? ????? ?????? ??? ?????? ???? Outlook Web Access ?? ????? Urlscan ? ???? ?? ??? Urlscan.log ?????? ??? ??????? ?? ????? ??? ???. ?????? ????????? ???? Urlscan.log:

Outlook Web Access

?????? ?? ????? ????? ???????? ?? ?????? [AllowVerbs] ?? Outlook Web Access:

• ??????
• ???
• ?????
• ?????????
• propfind
• bmove
• bcopy
• ????????
• ???
• proppatch
• bproppatch
• ???
• bdelete
• mkcol

????? ????????? ???????

?????? ?? ????? ????? ???????? ?? ?????? [AllowVerbs] ?? "???????? ???????":

• ????????
• ????? ????????
• ??????????
• ?????
• ?????????
• propfind
• proppatch
• acl

????? ?????? ???????

?????? ?? ????? ????? ???????? ?? ?????? [AllowVerbs] ?????? ?????? ???????:

• ???
• propfind
• ?????
• proppatch
• ???
• mkcol
• ???
• ????
• ??????

?????? ???

?????? ?? ????? ????? ???????? ?? ?????? [AllowVerbs] ??????? ???:

• ??????
• propfind
• ???
• bcopy
• ???
• bdelete
• mkcol
• ??????
• ?????
• ????? ?????
• ???

??? ?????? ??? ?????? ????? ????? URL: