Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have recently been combating an SMTP AUTH attack in which one of my email accounts had been compromised and was being used to solicit spam. I have been able to identify the account and change the password however I would like to further restrict my exchange server. By default exchange 2010 allows for any authenticated user to specify any email address as the MAIL FROM address and it will accept it. Is there any way to restrict this so that only the authenticated account's email address will be able to be used as the MAIL FROM address? I have been looking through all ADPermissions for the SMTP connector however I can't find any documentation on how to accomplish this. Any suggestions would be greatly appreciated.

Telnet Test Picture

Telnet Test

SMTP Connector Properties Pictures

Permissions Tab

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I'm not sure what you are asking here. Your "by default" assumption is incorrect, unless I'm reading you wrong.

You shouldn't have default delegation/send as permissions for all mailboxes, especially for any user, and changing the MAIL FROM to something like "omghi2u@smtpdomain.com" sending to an external user should fail with:

"You can't send a message on behalf of this user unless you have permission to do so. Please make sure you're sending on behalf of the correct sender, or request the necessary permission. If the problem continues, please contact your helpdesk."

Can you maybe elaborate?

EDIT: Now if you are sending email through a relay receive connector you are able to make up a fake SMTP FROM address, but if that's how your default mail connector is setup it shouldn't be. You can use such a connector for app servers, etc. that need to relay email through the Exchange server, but you should restrict it down to certain IP addresses that connector accepts mail from.

share|improve this answer
    
I apologize if my "default" assumption is incorrect. It could just as easily be my own ignorance. I edited my original post to include some pictures. I tested using telnet and I am not an open relay, nor can a user relay without "auth login". I can give you more information concerning the send connector if you tell me what you need to diagnose it properly. I was aware that my current configuration is ideal for app servers and such however I don't know how to fix my send connector to achieve the behavior desired. I have been google'ing for a while to no avail. Thanks for your time! –  Chance Nov 26 '12 at 22:34
    
Your default receive connector is correct. –  TheCleaner Nov 26 '12 at 22:48
    
I thought it was. What else should I check for? –  Chance Nov 26 '12 at 22:56
    
What's the 3rd tab look like in the receive connector? Your telnet test will allow any FROM address because the receive connector won't validate the actual FROM address as legitimate. If you are sending to an internal email address at that point it should allow it but external RCPT TO should say "unable to relay" –  TheCleaner Nov 26 '12 at 23:04
    
I can't post any more hyperlinks / pictures due to rep so I will just type it. My receive connector on port 25 has the following checked on the authentication tab: TLS, Basic Authentication, and Integrated Windows Auth. My connector on port 587 has the exact same with the addition of "Offer Basic authentication only after starting TLS." –  Chance Nov 26 '12 at 23:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.