Avatar of tamray_tech
tamray_tech asked on

Help with Exchange tools and configuration

I need to assist a school in hardening their Exchange 2010 server. From what I have learned, users are getting bogus email about their mailbox and are clicking on the link provided in the message. This is somehow providing a pipe for spammers to use them as a relay through the schools internal mail server. They are being put on many blacklist because of this.

I need to help them harden up the configuration to prevent this and hopefully identify the local machine that is being used as the middle man.

I am not an expert with Exchange and could use some guidance in my effort to help them.
ExchangeEmail Servers

Avatar of undefined
Last Comment
tamray_tech

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
Marcus Capps

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
achaldave

You need spam filter device, application or hosted service these are some of the products which offer both in house or hosted solution.
http://www.gfi.com/products-and-solutions/email-and-messaging-solutions/gfi-mailessentials
http://www.trendmicro.com/us/small-business/hosted-email-security/index.html
http://technet.microsoft.com/en-us/forefront/ee708281.aspx
https://www.barracuda.com/
http://www.cisco.com/web/about/ac49/ac0/ac1/ac259/ironport.html

You can check with the school they might already have forefront online protection available with their license

You need to disable any open relay on the server to prevent outbound spams
http://alanhardisty.wordpress.com/2010/07/12/how-to-close-an-open-relay-in-exchange-2007-2010/
ASKER
tamray_tech

I will need to get more concrete information, but an initial test shows the domain is not on any of the 90 blacklist and is not accessible as an open relay when tested at mxtoolbox.com

The problem, as described to me, is that the internal users pc is somehow the conduit to relay through the Exchange server. I will know more tomorrow. We have firewall rules in place that only allow access to port 25 on their public IP from my mailscanner servers, and that was confirmed with the test.
Mohammed Khawaja

My recommendation would be to outsource the anti-spam and anti-virus to a vendor such as FuseMail.com where your MX would be pointing to their servers, they will cleanse the messages and then forward it to your Exchange.  Your Exchange will be configured to relay all messages through their servers.  And the beauty of it is that would cost $2 to $3 per month and no admin work.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
Simon Butler (Sembee)

You need to be sure the email is coming from an internal source first. I would doubt if it is. To be an internal source it would have to be highly targetted. It is much easier for a spammer to just write a script that sends to the domain example.com and mentions example.com through the email message (Depending on the to email address).
If tha tis the case, then a decent antispam tool should catch it. SPF records setup correctly and antispam tools inside would also catch a lot of it. No need to outsource the filtering at all.

Simon.
ASKER
tamray_tech

School hired an exchange expert to deal with the issue.