OWA Protection Handler
Purpose
The OWA Protection Handler specifically protects the web application Microsoft Outlook Web Access against brute force attacks and prevents access to third party mailboxes.
For more information regarding adding and editing Handlers, see Editing Handlers.
Severity
Events triggered by this handler are given the severity: high.(For details on severity levels, see Severity of Events Triggered by Handlers).
Recommendations for use
Only required to protect Microsoft Outlook Web Access, but should in this case always be used.
Attributes
| Attribute | Meaning |
|---|---|
|
userMailbox |
Activate this option to prevent users being able to access mailboxes other than their own. In the event of an attempt to access a third party mailbox, the user is then logged out automatically. |
|
limitLoginTries PerMinute |
Maximum permissible number of login attempts from a specific IP address. If the specified number is exceeded, vWAF blocks the access for this IP address for one minute. If you don't want to limit the number, enter the value 0. |
|
usertext |
Optional: Here you can specify some text that vWAF adds to the log file entries created by this handler. You can use this, for example, to document why you've added the handler to your configuration, and how the handler is intended to behave. |
|
enable logging |
Disable this option if you do not want vWAF to create a log file entry when the handler is executed. This can be useful to keep log files smaller in case the handler creates a large number of entries but you don't need these entries. When in detection mode, disabling logging de facto makes the handler ineffective. Disabling logging also prevents the actions of the handler from being taken into account for the Top-10 lists in Attack Analysis, and from being listed in Reports. To decrease the size of the log files, also consider to enable reduced logging, which excludes all non-handler-related information from the log files (see Editing Applications). |
For details regarding entries added to the log file by this handler, see the relevant section in Entries in Application-Specific Log Files.