Exchange 2010 Receive Connector

K

KapsZ28

2[H]4U
Joined
May 29, 2009
Messages
2,114
Is it bad to have the receive connector set to accept email from all IP addresses with Anonymous access?
 
Not necessarilly. It could be the connector to recieve public internet email. Do you have any more information that makes you think it's suspicious?
 
mxtoolbox was showing the server as an open relay and people were using it to send spam.
 
By default, the internet email recieve connector will only recieve mail destined for your authoritative domain. There are ways to change the security to make that connector an open relay but that takes a trip to the EMS and some CLI. Did you step into this issue or just setting up? What will working with this connector affect? What is the desired behavior?
 
Nate7311 said:
By default, the internet email recieve connector will only recieve mail destined for your authoritative domain. There are ways to change the security to make that connector an open relay but that takes a trip to the EMS and some CLI. Did you step into this issue or just setting up? What will working with this connector affect? What is the desired behavior?
Click to expand...

This is true. Take a look at your send connector.
 
The Send Connector is unrelated. We need to catch the bogus relay email coming in the door rather than try and attempt to filter the outgoing. Without any other info, the quick fix is to delete the recieve connector and create a new one. The Open Relay security settings on the old one disappear with it, leaving a fresh Connector that will only accept email for the local domains.
 
Nate7311 said:
By default, the internet email recieve connector will only recieve mail destined for your authoritative domain. There are ways to change the security to make that connector an open relay but that takes a trip to the EMS and some CLI. Did you step into this issue or just setting up? What will working with this connector affect? What is the desired behavior?
Click to expand...

Well, the primary server already had this issue that I am stepping into, but based on what you said, I am now wondering about the second server which has a different public IP address. I was on the phone with Postini and they had me run the following command.

Get-ReceiveConnector "Reinjection" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "ms-Exch-SMTP-Accept-Any-Recipient"

This was so I could setup the second exchange server in Postini as an outbound reinjection server. Now when I check the second server, it is set as an open relay. Is that because of the command above? If so, how do I fix this, but still allow Postini's reinjection configuration to work?
 
Typically Postini's reinjections are limited by IP security, i.e. restricted to ONLY apply to their servers. Having that security hole apply to the Default recieve connector did exactly what you feared, create an open relay. I haven't seen the Postini commands for integration with Exchange 2010, but I would image that you would want to leave the default internet connector alone and create an additional connector, limit it via IP to your Postini system block, and open up relay via that command they sent you. Personally, I've never had very good experiences with Postini and Exchange, so I've moved on to other services that either have better integration or do not require this type of integration.
 
Nate7311 said:
Typically Postini's reinjections are limited by IP security, i.e. restricted to ONLY apply to their servers. Having that security hole apply to the Default recieve connector did exactly what you feared, create an open relay. I haven't seen the Postini commands for integration with Exchange 2010, but I would image that you would want to leave the default internet connector alone and create an additional connector, limit it via IP to your Postini system block, and open up relay via that command they sent you. Personally, I've never had very good experiences with Postini and Exchange, so I've moved on to other services that either have better integration or do not require this type of integration.
Click to expand...

Cool, thanks for the info. Yeah, I am not a fan of Postini, but unfortunately we are stuck with it for now.
 
Cardinals said:
You should only allow smtp inbound from Postini IP addresses in your Firewall solution then.
Click to expand...

Yuppers...in addition to locking down the receive connector in Exchange...always good to ALSO lock it down via hardware at the edge. Greatly helps in cutting down on grinding attempts from China/Russia....retards trying to poke your servers SMTP services looking to get in and hijack.
 
You must log in or register to reply here.
Back
Top