Anyone have any checklist for securing the smtp server on my web server so no one else can hack it and send spam fro it?
2 Answers
It depends on how you are using the server. As MikeR mentioned, if you are not using it at all, uninstall the service or disable it.
If you are using it and only need a local web server to connect, go into the server properties and under Connections, set it to only allow connections from 127.0.0.1 and/or your local IP block (if multiple servers need to use it). This prevents anyone on the outside from connecting to it at all.
If people on the outside need to be able to connect for some reason, set the Relay permissions to only allow your local IP addresses and any external IP addresses that you trust to relay out. This way, if someone connects and attempts to relay they will be rejected.
It's actually very easy to lock down.
answered Apr 28, 2010 at 19:10
You don't mention if you are actually using the SMTP server on your IIS installation, first step if you aren't using it for any reason would be to disable SMTP completely.
Microsoft have a fairly good page on Technet that explains how to secure the SMTP Virtual Servers under IIS, the authentication, connection and relaying sections are all worth looking at.
