asked on

Stoping malicious email sent from inside domain to outside using all in one server (HT-CAS-MBX) connected through non-windows Smarthost

Hi All,

When I do a simple test of telnet to my mail server, i just realize that it allows me to send email like this scenario:

from inside to outside: bill.gates@microsoft.com to myemail@live.com
from inside to inside: ceo@mydomain.com to myemail@domain.com (while sending in fake payrise email to myself :-| )

how to make the sen connector more secure by not allowing those attack ?

Any idea would be appreciated.

Thanks,

SOLUTION

Rammestein

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER CERTIFIED SOLUTION

Rajith Enchiparambil

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

Rajith Enchiparambil

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

jjoz

ASKER

Rajith, thanks for the reply

from the test I've found that the reverse DNS is not correct

Reverse DNS FAILED! This is a problem.

is there a way of how to fix this ?

jjoz

ASKER

To Rammstein,

When i query the send queue using get-message I've found that the
MessageSourceName = SMTP:Receive Connector
SourceIP = My Own Smarthost IP

I've created SPF for this cause and for the smtp authentication (Receive connector authentication)

Transport Layer Security
Basic Authentication
Exchange Server authentication
Integrated Windows authentication
Externally Secured (for example, with IPsec).

all of them left unchecked.

I wonder what should i enabled / check on the EMC | Server Configuration | Hub Transport | Receive Connectors on both Authentication and Permission groups tab ?

SOLUTION

Mestha

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

jjoz

ASKER

OK,

I just realized that using a transport rule is so powerful to stop mail relay attack,
see the attached rule that I've just created:

Cheers.

Internal SPAM prevention
 
 
Rule Comments: Spam relay attack rule.
 
Apply rule to messages
from users Outside the organization
   and sent to users Outside the organization
log an event with Spam Relay attack !
   and prepend the subject with [SPAM]: 
   and redirect the message to Administrator
#################################################
Summary: 1 item(s). 1 succeeded, 0 failed. 
Elapsed time: 00:00:00
 
 
Internal SPAM prevention
Completed
 
Exchange Management Shell command completed:
set-TransportRule -Name 'Internal SPAM prevention' -Comments 'Spam relay attack rule.' -Conditions 'Microsoft.Exchange.MessagingPolicies.Rules.Tasks.FromScopePredicate','Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToScopePredicate' -Actions 'Microsoft.Exchange.MessagingPolicies.Rules.Tasks.LogEventAction','Microsoft.Exchange.MessagingPolicies.Rules.Tasks.PrependSubjectAction','Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RedirectMessageAction' -Exceptions  -Identity 'Internal SPAM'
 
Elapsed Time: 00:00:00

Open in new window

SOLUTION

Rammestein

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

jjoz

ASKER

thanks for your suggestion guys !