1

I need to determine which end users to contact, and ask them to fix their configuration or upgrade to something that supports SSL.

I don't want to send a broad email and shut off the service without knowing who is affected.

How do I determine who is using non SSL enabled POP3, IMAP, and SMTP?

1 Answer 1

2

Not familiar with Exchange but can you check the logs?

I assume that this is for your local corporate environment.

Alternatively, you can setup a man-in-the-middle attack (say using proxsmtp or similar) to listen on the non-SSL ports and forward those connections onto the main server. You can log the users IP/login and use that information to find out who is not using SSL.

Alternatively, you can setup a sniffer (using wireshark or similar) just before the mail server to capture the packets and inspect it to see who is connecting via these protocols.

Alternatively, depending on the size of your organisation, how about just asking people how they are checking mail? Via outlook client or webmail application, etc.

Just some random thoughts.

4
  • I've checked the Event Logs and only get IP address and username. I've looked at Exchange 2003 Diagnostics tab and enabled all logging. Yes this is for my corporate environment (5,000 users) and potentially an application I'll program and distribute to other Exchange administrators. Packet sniffers may be impractical for my purposes... Jan 29, 2011 at 2:48
  • If you have the IP and username in the logs, wouldn't it be a matter of just parsing the logs and say, sending out warning emails to those affected users?
    – sybreon
    Jan 29, 2011 at 3:00
  • I would suggest just setting up wireshark listening on ports 110 and 143. Collect the user names from the packet dump.
    – bahamat
    Jan 29, 2011 at 3:01
  • If you happen to have either ISA or TMG server as your firewall, you can enable logging on the firewall service. I would then analyse the logs for the type of traffic in question.
    – redknight
    Jan 29, 2011 at 9:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .