Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Exchange 2003 relay lockdown

Posted on 2010-08-30
5
Medium Priority
?
443 Views
Last Modified: 2012-08-13
Hello all,

I've been getting authenticated relay attacks on my exchange 2003 server.  It's a single server setup, which, I know, is not ideal, but it's what fits in the budget.  I know the basics of all of the settings for relaying but I have a few questions regarding it.  

1.  I know that I have to leave the checkbox checked that says allow all authenticated computers to relay.  If I don't, nobody will be able to send mail.  This network only has about 15 users.  Should I name each IP address and specify that only those computers can relay?   How will this affect OWA and Outlook anywhere users?

2.  In Event Viewer, under security, what exact logon types am I looking for to see which user's account was comprimised?  

3.  Are there any other settings that I can lock down to help?
0
Comment
Question by:Sean Rhudy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 13

Expert Comment

by:IT-Monkey-Dave
ID: 33563353
With so few users, maybe you can force everyone to change their password?  Just an idea.  If someone's credentials are compromised, that's potentially more serious than just email relaying.
Just sayin'.
0
 
LVL 32

Expert Comment

by:endital1097
ID: 33563374
do you use an internal private ip scheme? (10.x or 192.168.x)
if you do, you can update the settings to allow an ip range of your internal systems
0
 

Author Comment

by:Sean Rhudy
ID: 33563477
everyone already changed their password, but is there anything else I should check?
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33563773
You mentioned that you are facing authenticated relay attacks.
How did you arrive at this conclusion ? (just want to make sure that diagnosis is correct)

did you check exchange message tracking logs and track the number of messages sent using logparser ?
http://msexchangeteam.com/archive/2007/09/12/446982.aspx
http://www.msexchange.org/tutorials/Using-Logparser-Utility-Analyze-ExchangeIIS-Logs.html

Lets try to define what are we looking for ?
a) We are looking for a client IP / netbios name which is sending boat-load of spam.
b) It maybe one/more than one username.

What you can do ?
a) See the guide here on auth relay attacks.
http://www.vamsoft.com/authattack.asp

You can also download a trial version of VamSoft ORF which natively logs the compromised user.
http://www.vamsoft.com/

0
 
LVL 17

Accepted Solution

by:
aoakeley earned 500 total points
ID: 33565718
Why do you have to "I know that I have to leave the checkbox checked that says allow all authenticated computers to relay.  If I don't, nobody will be able to send mail."

If users are using Outlook in "Exchange Mode" not "POP/SMTP" you can untick this.
0

Featured Post

Fill in the form and get your FREE NFR key NOW!

Veeam® is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

One-stop solution for Exchange Administrators to address all MS Exchange Server issues, which is known by the name of Stellar Exchange Toolkit.
The core idea of this article is to make you acquainted with the best way in which you can export Exchange mailbox to PST format.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question