Please excuse if this is a n00b question. I'm a programmer acting as a network admin.
We received a large number of failed audit events in our security event log which appears to be a brute force attack on our Exchange 2003 server. The log details are as follows:
Event ID: 529 Process: Advapi Logon Type: 3 User Name: (all sorts of strange usernames) ProcessID: (points to Inetinfo.exe)
So I am guessing that our Exchange/SMTP is accessible publicly on port 25. Is it a good idea to set up a firewall rule to block external access on port 25? (and only allow traffic from within our network?)
Note that we use the Exchange mail website when working from home and need to be able to continue doing so.
PS: The server runs Windows Small Business Server 2003 and also acts as the domain controller.