Securing SharePoint Sites with Forefront TMG 2010

SharePoint sites comprise one of the more common types of content that are secured by the Forefront Edge line. This stems from the critical need to provide remote document management while at the same time securing that access. Although Forefront UAG is the preferred solution for reverse proxy of a SharePoint environment, the Forefront TMG product is also a highly capable product that allows for reverse proxy functionality. Both products are covered in this chapter, but this section illustrates the creation of a Forefront TMG publishing rule for a SharePoint site for clients with an investment in Forefront TMG but without a Forefront UAG environment.

Forefront TMG can be used to secure a SharePoint implementation can be deployed in multiple scenarios, such as an edge firewall, an inline firewall, or a dedicated reverse-proxy server. In all these scenarios, Forefront TMG secures SharePoint traffic by “pretending” to be the SharePoint server itself, scanning the traffic that is destined for the SharePoint server for exploits, and then repackaging that traffic and sending it on, such as what is illustrated in Figure 14.1.

Figure 14.1. Conceptualizing the process of securing a SharePoint site using Forefront TMG.

Forefront TMG performs this type of securing through a SharePoint site publishing rule, which automatically sets up and configures a listener on the Forefront TMG server. A listener is a Forefront TMG component that listens to specifically defined IP traffic and processes that traffic for the requesting client as if it were the actual server itself. For example, a SharePoint listener on Forefront TMG would respond to SharePoint HTTP/HTTPS requests made to it by scanning them for exploits and then repackaging them and forwarding them on to the SharePoint server itself. Using listeners, the client cannot tell the difference between the Forefront TMG server and the SharePoint server itself.

Forefront TMG is also one of the few products, along with Forefront UAG, that has the capability to secure web traffic with SSL encryption from end to end. It does this by using the SharePoint server’s own certificate to re-encrypt the traffic before sending it on its way. This also allows for the “black box” of SSL traffic to be examined for exploits and viruses at the application layer, and then re-encrypted to reduce the chance of unauthorized viewing of the traffic. Without the capability to scan this SSL traffic, exploits bound for a SharePoint server could simply hide themselves in the encrypted traffic and pass right through traditional firewalls.

This chapter covers one common scenario that Forefront TMG server is used for: securing a SharePoint site collection (in this example, home.companyabc.com) using Forefront TMG. The steps outlined here describe this particular scenario, although Forefront TMG can also be used for multiple other securing scenarios as necessary.