To secure the mail flow from Office 365 to the On Premises Exchange we request that customers allow the Exchange Online Protection IP addresses through their firewall on Port 25. That’s all very well and good, and we (and most others think nothing more about it once done). It wasn’t until we had that very question ourselves we actually thought “yeah, what is there to stop someone creating a send connector in their own tenant to another companies hybrid server?”

We did the usual, had a chat about it and threw a few ideas in the hat, and initially certificates were decided the best avenue to explore. But, the certificates are on the Microsoft end are managed by Microsoft so there is not much we can do there.

We then thought, lets ask Microsoft, but they could not help us (there a surprise!). Their response “Its by design”, typical!

We then thought about a transport rule?

I was in the middle of re-building my Exchange lab in Azure so I thought this was going to be a perfect opportunity to test the Transport Rule theory.

So, the first thing I thought I would check was the headers. I checked the headers of 3 types of messages:

1. External email to my Exchange lab
2. My Office 365 lab to my Exchange lab
3. My main Office 365 account to my Exchange Lab

A little bit of background to my lab mail flow.

My allthings365.co.uk MX Records point to Mimecast. And that has a delivery route to deliver to my Exchange lab, which then routes up to Office 365. I’d run the Hybrid Configuration in my Office 365/Exchange lab so I had all the connectors in place. And finally my main Office 365 account was sending to allthings365.co.uk via the public MX Records of allthings365.co.uk.

The headers were all as expected. But the header that caught my eye was on the the email that was sent via the hybrid connector that was built by the HCW. and the X-OriginatorOrg header:

The other two message headers did not have this header.

I then created a Send connector in my “production” Office 365 tenant where I run my kemponline.co.uk email address from.

when I then analysed the message headers I noticed it then had an X-OriginatorOrg header:

So that go me thinking. What about creating a Transport Rule that would delete all emails from “Outside” the Organisation with an Exception of the header includes allthings365.onmicrosoft.com:

I then tested an email from the lab 365 tenant (allthigns365.onmicrosoft.com) and my main Office 365 tenant (kemponline.co.uk) via the scoped send conenctor.

I received the validation email from my lab Office 365 tenant but not my main Office 365 tenant. Job’s a good’un! Well its half way there.

I then tried sending a test email using the Send-MailMessage CMDLet to simulate sending an email from an anonymous user which is how Multifunctional Devices work.  As that anonymous and not listed as “internal” traffic as it originated outside the Exchange Organisation. And guess what? the email was not received.

So, my first thought was to add another exception based on the received header including the IP Address of the network to allow the emails through, but, that would effective reverse the “block rule” for any emails from senders who have that same network… Now lets face it, a lot of people will be using a 192.168.X.X, 10.X.X.X or 172.16.X.X subnets so there would still be some risk there, as any one doing this from a subnet the same as my lab subnet would still be allowed through. So I decided to try it with an exception of the “Senders Domain”:

This seemed to do the trick. So all good? No

I tested from the 3 sources again:

1. External email to my Exchange lab
2. My Office 365 lab to my Exchange lab
3. My main Office 365 account to my Exchange Lab (with a direct send connector)

Emails from external to my lab were not received, emails from my Office 365 lab to my Exchange lab were received and emails from my mail Office 365 tenant to my Exchange lab were not received. Not great as external email was being deleted too. Again I thought exception in the Received headers? Nope, that would allow emails through from other Office 365 send connectors if they are using the same subnet as me. The only fix I could think of is route external email from Mimecast to Office 365 to then route to On Premises, rather than Mimecast to On Premises then on to Office 365. You’ll be pleased to know that actually Worked .

Conclusion

Whilst there maybe some other things to consider, especially if its a larger enterprise, it does seem possible to block your hybrid server from receiving email from other Office 365 tenants, but this way may cause more work and administration in the long run and you may need to add more exceptions than I have depending on your infrastructure. IT will also mean from the outset all external email will need to be routed through Office 365 initially to deliver to On Premises and not routing to On Premises initially and then on to Office 365. I you use an On Premises appliance for filtering email then this will not work, however I would always recommend companies (especially large enterprises) to run a dual cloud environment with Office 365 and have something sitting in front of Office 365.

I’d certainly be keen to see if there are any other ways to secure the Hybrid received connector to receive emails from only your own tenant.

The licensing terms for the Hybrid server were pretty clear cut before Exchange 2016:

https://support.microsoft.com/en-gb/help/2939261/how-to-obtain-an-exchange-hybrid-edition-product-key-for-your-on-premi

Microsoft, now provide you with an Exchange 2010/2013/2016 Hybrid License Key so what’s the deal here?

I came across this article about the 2010/2013/2016 Licensing to clarify things:

http://www.garethjones294.com/exchange-hybrid-product-key-distribution-now-free/

So the way I understand that is Microsoft now provide the Hybrid license free regardless of your current infrastructure setup.

Looks pretty good! So that would mean you could deploy an Exchange 2016 Hybrid server in your Exchange 2010/2013 environment. Sure that’s great, but there are a a few things to consider before going ahead and deploying your new server. The 2 main questions I ask my customers are:

1. Are you running a Load Balanced front end environment? if yes then cutting over to one frontend server would give you a single point of failure or are you going to deploy multiple new 2016 servers?
2. Is it really worth installing a 2016 before you migrate? The Hybrid Configuration Wizard was designed to run on Exchange 2010/2013 and 2016 so why add risk to your migration by introducing extra complexity, deploy the Exchange 2016 server at the end of the migration reducing the risk and impact to users.

I’m a fan of making use of what you have to achieve the task, but, for me, the key thing is Exchange 2010 SP3 is still supported for hybrid and for me it goes to the old saying “if it ain’t broke don’t fix it”.

There are some times when installing an additional Server for the migration maybe be required, I’ve worked with customers who have had a 3rd party hosting their Exchange, which is a separate site within their AD and due to network issues/patching issues it was not possible to configure the hybrid against the servers, so a new Exchange server was deployed at their own site with a new public URL (hybrid.domain.com as opposed to using mail.domain.com for example) and the migrations were all done through that endpoint. This then meant they could serve notice to the 3rd party once the migrations were complete and still maintain the management capabilities.

All I would say is take a second to re-evaluate the need of installing your new 2016 server before jumping the gun and deploying it if you’re running Exchange 2010 or 2013.

Regardless of the customer sites I go in to I always have a default set of tools and resources I use so I thought I would list them here (in no particular order).

Google

This has to be one of the most used resources for me! I feel like a fraud some times going to a customer site, but 9 times out of 10 the error I am presented with if I’ve not come across it before then Google is the default go to resource. Personally, I think that deciphering Google search results sometimes is a task in its self or knowing what kind search string to look for also.

Greenshot

I take a lot of screen grabs when I’m working and whilst there is the Snipping tool built in with Windows Greenshot allows me to assign a key to a certain screen grab task:

1. capture the entire screen
2. capture the current active window
3. capture a region
4. capture the last region

Greenshot not only captures it to the clipboard but it also saves a copy to a specified location

ADModify

This tool is one of the best tools for any AD Admin. it gives you the ability to edit multiple AD users attributes in one go. its pretty easy to get the syntax wrong for this so you do need to be careful, however, one of the features I like most about it is that there is an undo option!

I use this for various tasks like removing email addresses from user accounts for specific domains eg when the EmailAddressPolicy had the doain.local address applying to all users and you need to remove from all users for a Hybrid Setup or something.

its also great for bulk adding additional addresses so that users who do not have the EmailAddressPolicy applied can get things like the .mail.onmicrosoft.com address in a hybrid environment for example or you want ti bulk as SIP:prefix@domain.com to set the users SIP Address in AD.

I typically use for adding additional Exchange Attributes but there are so many more optoins for which it can be used for.

Putty

I use putty a lot from time to time to test port 25 for example on a customers server. I have a VM in azure that I can RDP on to and then perform a telnet through Putty to their mail server just to verify that they have added addresses requested to the firewall rules. Putty is also used for when I SSH on to my Ubuntu VM in Azure.

OneDrive for Business

I work on the road a lot and no office based so it makes sense for all my files to be cloud based. Up until about 3 years ago I was keeping all my files in OneDrive, now I use OneDrive for Business as it is more secure via DLP and IRM Policies being applied and also the ability to allow conditional access. IT also means I can flatten my computer, re-install windows from scratch and within 30-40 min of the computer being back I I have all my files again.

Office Lens

This is a great mobile app that I have running on my iPhone. Its a great app for taking photos of whiteboards, print outs and other documents that you may want to take a photo of. it goes to the point of auto cropping so the image is a clear as possible and very little glare or tilting of any images.

Spotify

Where would we be without music? working from home could become boring and  I’d soon find it hard to concentrate. having some tunes playing in the back ground (for me) helps me get motivated.

Notepad ++

This is a really neat Notepad editor it not only dose it open all type of text/ps/vbs/bat etc…. files it also opens them in new tabs. Also if you for example open your local hosts file up and go to save it and you’ve not opened with admin privileges then you will be prompted to restart with admin rights  rather than having to save a copy and then replace.

I use this a lot for writing smaller PowerShell scripts.

Office XML Builder

This is a great resource for building custom XML files for Office 365 Pro Plus deployments, you can also use it to push out Visio/Project too. it also has a neat MSI app creator too.

OneNote

This has to be one of the most used apps on my Surface, and is pretty much always opened. I have several “Notebooks” configured, one for Scoping Calls, one for Implementations, one for blogging ideas, One for common issues I have come across and some other ones for other needs. OneNote also offers the ability to capture screen shots too.

PowerShell

This is one of the best used resources to gather information from a customer. I have a set of PowerShell Scripts that I can run that gathers information from a customers environment. weather its from AD or Exchange I can usually get all the info I need from a few lines of a PowerShell Scripts.

There are lots of other resources out there that I use and I am sure that there are more that other people use and the guys I work with use, however these are the ones I like to use on a daily basis

1. Mail flow, any users left on premises email the user will have sent to the On Premises mailbox and any users in Exchange Online will be sending to the Cloud mailbox. External messages to the mailbox will be coming in to where ever the external mail delivery is pointed to.
2. Autodiscover, if the user is on prem then outlook will configure using the SCP and locate the mailbox on premises, and depending on how the public autodiscvoer record is set will determine where Outlook/ActiveSync etc… will point to.

So, the view in the Exchange Admin Centre in 365 shows:

Yet, the On Premises Exchange Management console shows:

The problem seemed to stem form a permissions issue for the account migrating the mailboxes and not updating the following AD Attributes:

• homeMDB
• homeMTA
• msExchHomeServerName
• msExchVersion
• msExchRecepientDisplayType
• msExchRecipientTypeDetails
• msExchRemoteRecipientType
• targettAddress

So the, the first 3 attributes (homeMDB, homeMTA and msExchHomeServerName) need to be cleared and the other 5 attributes need to be set to the following:

The easist way to do this if it is a few users is to run a script manually. If there are a lot of users then you may want to look at using a CSV file for this:

$ADUser = read-host "What is the username of the user affected?"
$TargetAddress = "SMTP:" + $ADUser + "@tenant.mail.onmicrosoft.com"
Set-ADUser –id $ADUser -Clear homeMDB, homeMTA, msExchHomeServerName -Replace @{msExchVersion="44220983382016";msExchRecipientDisplayType="-2147483642";msExchRecipientTypeDetails="2147483648";msExchRemoteRecipientType="4";targetAddress=$TargetAddress}

When you run this script it will prompt you for the user name of the user and then do the rest for you.

Once run refresh the Mail Contact view in the Exchange Management Shell and you should then see the account showing as a Remote User Mailbox

The 4 Parts are broken in to the following sections:

Part 1 – Deploying Ubuntu on Microsoft Azure
Part 2 – Configuring LAMP on Ubuntu
Part 3 – Install and Configuring WordPress on Ubuntu
Part 4 – Trouble shooting the common issues

Trouble shooting the common issues

Left “as is” WordPress will work, however there are a few “Quirks” to be aware of:

1. If you forget your password and want to email yourself a link to reset it it will not work
2. Email notifications of new comments etc… will not work either, infact no email functions will work
3. Permalinks will not work.

Fix the email issue:

To fix the email issue you will need to install PostFix do this by running the following command:

sudo apt-get install mailutils

There are several ways to configure PostFix however the way to configure it for the server in this case is to set it up as an Internet Site:

Specify the domain name that will be used:

Then edit the /etc/postfix/main.cf file:

Ensure that the inet_interfaces is set to = localhost

Press Ctrl+X to save and exit:

Restart the PostFix service by running:

sudo service postfix restart

WordPress can then send email notifications. Please add the public IP Address of your WordPress site to your SPF Record as you will possibly have some mail delivery issues as mail filters may well pick it up as Spoofing.

Fix the Permalinks

When you change the Permalink settings you will most likely get this error:

This is a simple fix you will need to make a change to the site config and enable mod rewrite.

Run

sudo a2enmod rewrite

Then edit the conf file and add the following before </Virtualhost> line at the bottom:

<Directory /var/www/allthings365.co.uk/>
    AllowOverride All
</Directory>

Once done save and exit and then run:

sudo service apache2 restart

Jobs a good’un it will the enable PermaLinks to work.

Another issue is that when you go to install a new theme or update a plug in you may well receive the following:

The fix for this is to run the following command

sudo chown -R www-data:www-data /var/www

When you next go to update/install a plugin/theme you will not be prompted for connection details!

And that is it you now how a fully functioning Ubuntu LAMP server running your own WordPress blog

The 4 Parts are broken in to the following sections:

Part 1 – Deploying Ubuntu on Microsoft Azure
Part 2 – Configuring LAMP on Ubuntu
Part 3 – Install and Configuring WordPress on Ubuntu
Part 4 – Trouble shooting the common issues

Install and Configuring WordPress on Ubuntu

So, in part 1 we looked at deploying a Ubuntu Server on Microsoft Azure and part 2 we looked at deploying and configuring LAMP on Ubuntu. In part 3 we will look at installing and configuring WordPress on the server so you can then host your very own blog on there.

There are a few ways to install WordPress on Ubuntu however the way I like to do it is to download the latest build from http://wordpress.org to the Ubuntu Server extract the files to the folder you created for the website and go from there. So lets get cracking…

Firstly create the folder as to where WordPress will be installed to:

sudo mkdir -p /var/www/allthings365.co.uk

The set the permissions on the new folder:

sudo chown -R $USER:$USER /var/www/allthings365.co.uk
sudo chmod -R 755 /var/www

This next permission is to enable the ability so you can write the wp-config.php file when it comes to configuring WordPress. Once WordPress is configured it is recommneded to set the permissions back to 757 for the folder

sudo chmod 757 /var/www/allthings365.co.uk

Then get the lates build of WordPress and extract to the newly created folder:

wget -c http://wordpress.org/latest.tar.gz
tar -xzvf latest.tar.gz
sudo rsync -av wordpress/* /var/www/allthings365.co.uk

Next Create the Database:

mysql -u root -p<br />CREATE DATABASE wordpress;
CREATE USER wordpressuser@localhost IDENTIFIED BY 'Pa55w0rd';
GRANT ALL PRIVILEGES ON wordpress.* TO wordpressuser@localhost;
FLUSH PRIVILEGES;
Exit

Create the Website:

sudo nano /etc/apache2/sites-available/allthings365.co.uk.conf

<VirtualHost *:80>
    ServerAdmin admin@althings365.co.uk
    ServerName allthings365.co.uk
    ServerAlias www.allthings365.co.uk
    DocumentRoot /var/www/allthings365.co.uk
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Ctrl+X

sudo a2ensite allthings365.co.uk.conf

Sudo service apache2 reload

Update DNS/Host File so that you can browse to the site:

Lastly

change the permissions for the root folder to 755:

sudo chmod 755 /var/www/allthings365.co.uk

The 4 Parts are broken in to the following sections:

Part 1 – Deploying Ubuntu on Microsoft Azure
Part 2 – Configuring LAMP on Ubuntu
Part 3 – Install and Configuring WordPress on Ubuntu
Part 4 – Trouble shooting the common issues

Configuring LAMP on Ubuntu

In order to run WordPress on Ubunto you need to install and configure the LAMP (Linux Apache MySQL PHP)services on your Ubuntu VM.

So, first things first, connect to the server.

I use Putty to connect to SSH sessions. Open up Putty and then put in the public IP Address of the Ubuntu server

Click Yes to trusting the SSH host key

Login with the credentials you setup in Part 1

First thing to do is to install any updates:

Run

sudo apt-get update

Once the update has downloaded the available updates run

sudo apt-get upgrade

to upgrade the server:

Next you will be able to Install the services:

Once installed you are then ready to install LAMP on the Ubuntu Server by running the following commands:

Install Apache:

To install Apache run the following command and answer Y to any prompts:

sudo apt-get install apache2

This will take next to no time to install.

Then install MySQL server by running the next command. Again answer any prompts you may be given:

sudo apt-get install mysql-server

Enter in the password you want to set for the MySQL root account and then confirm it after.

Then once MySQL has been installed install the following modules:

sudo apt-get install php libapache2-mod-php php-mcrypt php-mysql

Lastly (I like to put this on for my own benefit) install PHPMyAdmin:

sudo apt-get install phpmyadmin

Select Apache

Select the option to sue a password

Set the password

Confirm the password if you’re required to

That’s it, your server is now setup.

You can test by browsing to the public IP Address in any web browser:

eg http://52.166.254.66

The 4 Parts are broken in to the following sections:

Part 1 – Deploying Ubuntu on Microsoft Azure
Part 2 – Configuring LAMP on Ubuntu
Part 3 – Install and Configuring WordPress on Ubuntu
Part 4 – Trouble shooting the common issues

So, with out further a do lets get cracking on Part 1 which is:

Deploying Ubuntu on Microsoft Azure

With Azure there were 2 options for to deploy WordPress

1. Use one of the pre-built WordPress services from the Azure Market Place
2. Deploy my own Ubuntu Server in Azure and configure WordPress on there.

As you will see there are a “few” options in the Azure Market Place for WordPress if you decide t go down the “prebuilt” route:

However I decided to deploy my own Ubuntu Server in Azure and build it myself from there.

Log in to https://portal.azure.com and add a new compute resource:

I created a Server running Ubuntu 16.04:

I then set the basic info in the Azure Portal:

Then, I selected the VM Size, there are LOADS of sizes to choose from ranging from about £7 per month to £5,500. Needless to say as I was running Ubuntu one of the cheaper plans would be more than sufficient.

Once I’d selected the size I then checked over the settings and left them all as they were as for me they were fine.

Once I was happy with the summary I click on the Purchase option to build the VM.

The only change I needed to do once the VM had been created was to edit the Network Security Group (NSG) to allow access via port 80 to the server so you can browse to it form the internet:

Select networking:

Then click on Add Inbound:

Select the HTTP service from the service drop down list and then click on ok

That’s it, the Ubuntu Server now up and running ready to receive web and HTTP traffic. To increase security you could look at locking down SSH to only permitted IP Addresses if you’d prefer.