Exchange Extended Protection and HAProxy

[Timer]
OnCalendar=
OnCalendar=*-*-* 04:00:00
RandomizedDelaySec=900

#! /bin/bash
for DOMAIN in $RENEWED_DOMAINS; do
case $DOMAIN in
exchange.mycompany.com)
/var/local/ExchangeCert/copy_cert.sh
;;
esac
done

#! /bin/bash
#
# Converts the certificate generated by Let's Encrypt for use with the Exchange server and
# saves it together with a timestamp file on a network share for exchange.
LE_PATH="/etc/letsencrypt/live/exchange.mycompany.de"
MOUNT_TARGET="//fileserver/Documents/ExchangeCert"
MOUNTPOINT="/mnt/exchangecert"
PFX="${MOUNTPOINT}/exchange_cert.pfx"
# Determine the directory of this script
SCRIPT_PATH=$(dirname $(realpath $0))
# Mount network share
test -d ${MOUNTPOINT} || mkdir ${MOUNTPOINT}
mountpoint -q ${MOUNTPOINT} || mount -t cifs ${MOUNT_TARGET} ${MOUNTPOINT} -o "credentials=${SCRIPT_PATH}/smbcredentials"
# Convert PEM to PFX.
# A password is required for the import, which is taken into account here.
openssl pkcs12 -inkey ${LE_PATH}/privkey.pem -in ${LE_PATH}/cert.pem -certfile ${LE_PATH}/chain.pem -export -out ${PFX} -name "$(date +'%Y-%m-%d') Letsencrypt from proxy" -passout pass:dummy
# Save timestamp to file
echo "$(date +'%Y-%m-%d %H:%M:%SZ')" > ${MOUNTPOINT}/timestamp_certcopied.txt

username=
password=
domain=

# With activation of "Exchange Extended Protection" (as recommended by Microsoft) it is necessary,
# that the same certificate is set up on the Exchange server as on the server that accepts the
# connections from the Internet. Otherwise Outlook would always ask for the password of the
# user's password.
#
# This script checks whether the certificate provided by the proxy (or the generated timestamp file) is
# is more up-to-date than the previous one and then installs/activates it for the Exchange server if necessary.
# must run this script at the times when the proxy can be updated,
# must be started regularly via a task so that after the renewal of the proxy and the renewal of
# at the Exchange server as little time as possible passes (as the users are no longer able to access the Exchange server during this time due to the
# Extended Protection, users can no longer access the Exchange server).
Assign # variables
$Source_Dir = "\\fileserver\Documents\ExchangeCert"
$CertFile = "$Source_Dir\exchange_cert.pfx"
$TimestampFile = "$Source_Dir\timestamp_lastimport.txt"
$LogFile = "$Source_Dir\powershell_log.txt"
$MailDomain = "exchange.mycompany.com"
function WriteLog
{
Param ([string]$LogString)
$Stamp = (Get-Date).toString("yyyy-MM-dd HH:mm:ss")
$LogMessage = "$Stamp $LogString"
Add-content $LogFile -value $LogMessage
# Additional output to console
Write-Output $LogMessage
}
# Variable can be (temporarily) set to true for debugging.
[bool] $ShouldImport = $false
# Check whether the PFX file has a newer date than the timestamp of the last import
if (Test-Path -Path $TimestampFile -PathType Leaf) {
$filePFX = Get-ChildItem $CertFile
$fileTimestamp = Get-ChildItem $TimestampFile
WriteLog "Date certificate: $($filePFX.LastWriteTime.ToString("s"))"
WriteLog "Date Timestamp: $($fileTimestamp.LastWriteTime.ToString("s"))"
if ($filePFX.LastWriteTime -gt $fileTimestamp.LastWriteTime) {
WriteLog "Current certificate is newer than the last import"
$ShouldImport = $true
}
} else {
$ShouldImport = $true
}
# Import
if ($ShouldImport) {
Clear # log file to log only the last execution (and save a log rotate)
Clear-Content -Path $LogFile
# Get Exchange-Snapin
# Source: https://github.com/win-acme/win-acme/blob/master/dist/Scripts/ImportExchange.ps1
WriteLog "Searching for Exchange snapin..."
Get-PSSnapin -Registered `
| Where-Object {
$_.Name -match "Microsoft.Exchange.Management.PowerShell" `
-and (
$_.Name -match "Admin" -or
$_.Name -match "E2010" -or
$_.Name -match "SnapIn"
)
} `
| Add-PSSnapin -ErrorAction SilentlyContinue -PassThru `
| WriteLog
# Test if the Cmdlet is there now
$Command = Get-Command "Enable-ExchangeCertificate" -errorAction SilentlyContinue
if ($Command -eq $null)
{
WriteLog "Exchange Management Tools for Powershell not installed"
return
}
WriteLog "Import..."
try
{
# The certificate must be password-protected for the import. When exporting on the proxy and taken into account here accordingly.
# Unfortunately, the import function does not return an object, so that a direct assignment to "$ImportCert" (see below) is not possible.
Import-ExchangeCertificate -FileData ([Byte[]]$(Get-Content -Path $CertFile -Encoding byte -ReadCount 0)) -Password (ConvertTo-SecureString -String 'dummy' -AsPlainText -Force) -ErrorAction Stop | Out-Null
WriteLog "Certificate has been imported"
}
catch
{
WriteLog "Error during import-ExchangeCertificate"
WriteLog "Exception: $_"
throw
}
# Assign certificate to Exchange/IIS
try
{
WriteLog "Updating Exchange services..."
# Determine the latest certificate
$ImportCert = Get-ExchangeCertificate | where {$_.Subject -match $MailDomain} | Sort-Object NotBefore | Select -Last 1
WriteLog "ImportCert: $ImportCert"
WriteLog "Enable-ExchangeCertificate"
Enable-ExchangeCertificate -Services IIS -Thumbprint $ImportCert.Thumbprint -Force -ErrorAction Stop
WriteLog "Certificate assigned to Exchange"
}
catch
{
WriteLog "Error with Enable-ExchangeCertificate"
WriteLog "Exception: $_"
throw
}
# Adjust timestamp
WriteLog "Update timestamp..."
Get-Date -Format "u" | Out-File -FilePath $TimestampFile
# Clean up
try
{
WriteLog "Delete expired certificates"
# Select all expired certificates.
# The certificate that has just been renewed is normally valid for another month and therefore remains valid for the time being.
Get-ExchangeCertificate | where {$_.Subject -match $MailDomain -and $_.NotAfter -lt $today} | Remove-Item
}
catch
{
WriteLog "Error deleting the old certificates"
WriteLog "Exception: $_"
throw
}
WriteLog "Exit"
}

global
# Log HTTP requests, but later write only those relating to tarpit to haproxy-tarpit.log via rsyslog.
# The remaining log entries are still written normally in haproxy.log.
log /dev/log local0 info
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
stats timeout 30s
user haproxy
group haproxy
daemon
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
# generated 2021-12-22, Mozilla Guideline v5.6, HAProxy 2.2.9, OpenSSL 1.1.1k, intermediate configuration
# https://ssl-config.mozilla.org/#server=haproxy&version=2.2.9&config=intermediate&openssl=1.1.1k&guideline=5.6
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
defaults
log global
mode http
option httplog
option dontlognull
timeout http-request 5s
timeout connect 5s
# Avoid connection resets due to higher timeouts, see
# https://discourse.haproxy.org/t/high-number-of-connection-resets-during-transfers-exchange-2013/1158/6
# Client/server timeouts were previously set to 50 seconds. At least no problems were noticed.
timeout client 1000s
timeout server 1000s
listen stats
bind *:9000
mode http
stats enable
stats uri /
stats auth admin:ENTER PASSWORD HERE
frontend fe
# SSL: Specifying a directory loads all certificates available in it.
# HAProxy uses the appropriate certificate depending on the requested domain.
bind :80
bind :85 ssl crt /etc/haproxy/ssl/
bind :443 ssl crt /etc/haproxy/ssl/
# Pass through Let's Encrypt for Proxmox Mail Gateway.
# Is processed there.
acl domain_is_mailgateway hdr_dom(host) -i mail.example.de
# Let's Encrypt for everything else
acl is_certbot path_beg /.well-known/acme-challenge/
# Redirect from http to https
# 301 for "Moved Permanently"
http-request redirect scheme https code 301 unless { ssl_fc } or is_certbot or domain_is_mailgateway
# Depending on the condition or domain, redirect to the corresponding target server
use_backend ProxmoxMailGateway if domain_is_mailgateway
use_backend certbot if is_certbot
# Configuration for Exchange
# Uses "exchange.example.de" and "autodiscover.example.de"
no option httpclose
acl eas path_beg -i /Microsoft-Server-ActiveSync
acl autodiscover path_beg -i /autodiscover
acl ews path_beg -i /ews
acl mapi url_beg /mapi
acl oab path_beg -i /oab
acl owa path_beg -i /owa
acl rpc path_beg -i /rpc/rpcproxy.dll
acl ecp path_beg -i /ecp
# Not sure if the favicon.ico is only requested when OWA is called, but since it is otherwise
# ends up in the tarpit, it is simply passed on to OWA.
acl owa path_beg -i /favicon.ico
use_backend ExchangeActiveSync if eas
use_backend ExchangeAutoDiscover if autodiscover
use_backend ExchangeECP if ecp
use_backend ExchangeEWS if ews
use_backend ExchangeMAPI if mapi
use_backend ExchangeOAB if oab
use_backend ExchangeOWA if owa
use_backend OutlookAnywhere if rpc
# The rest (attacks, scans, etc.) ends up in the tarpit.
default_backend tarpit
backend certbot
server certbot 127.0.0.1:9080
backend ProxmoxMailGateway
server MEINPMGSERVER 192.168.120.5
# Exchange backends
# Source:
# https://www.bayreuth.tk/home/linux-und-bsd/haproxy-als-loadbalancer-und-ssl-offloader-fuer-microsoft-exchange-cas-server.html
# Since we only use one Exchange server, everything with sticky table removed.
backend ExchangeActiveSync
option httpchk HEAD /Microsoft-Server-ActiveSync
http-check expect status 401
server MEINEXCHANGESERVER 192.168.120.3:443 ssl verify none
backend ExchangeOWA
option http-server-close
option redispatch
option httpchk GET /owa
http-check expect status 301
server MEINEXCHANGESERVER 192.168.120.3:443 ssl verify none
# Requests to ECP are not forwarded for security reasons, as this is used for administration.
# also blocks things like the recognition of absences, but this is not important for us.
backend ExchangeECP
http-request deny if TRUE
backend ExchangeEWS
option httpchk GET /ews
http-check expect status 401
server MEINEXCHANGESERVER 192.168.120.3:443 ssl verify none
backend ExchangeAutoDiscover
server MEINEXCHANGESERVER 192.168.120.3:443 ssl verify none
backend ExchangeOAB
server MEINEXCHANGESERVER 192.168.120.3:443 ssl verify none
backend ExchangeMAPI
server MEINEXCHANGESERVER 192.168.120.3:443 ssl verify none
backend OutlookAnywhere
option redispatch
server MEINEXCHANGESERVER 192.168.120.3:443 ssl verify none
# Tarpit: Thwart attackers
# https://www.haproxy.com/de/blog/use-haproxy-response-policies-to-stop-threats/
# Would otherwise land on "fe/" and get 503 errors, but would not be delayed.
# Offers no protection, but ties up resources on the attacker's side (also for us).
backend tarpit
timeout tarpit 10s
http-request tarpit deny_status 403 if TRUE