|
Recently came across a scenario where hub transport server of an organization was being breached for open relaying leading to consequences like choking the mail flow in organization, blacklisting the organization domain
We tried lot of solution which included trying to trace down the spammer,
Finally we solved and rescued the server using following procedure (looks simple but at point of attack it really doesnt clicks so fast)
1. Select 'New Transport Rule'
2. Type a name and comment and press next
3. From the conditions window select 'From users inside or outside my organization' and 'Send to users inside or outside my organization' and from the details select the 'Inside' links and switch both to 'outside' then press next
4. From the 'Actions' window select the last action 'Delete the message without notifying anyone' and press next
5. If you have any exceptions you can configure it in the 'Exceptions' window ,If not just press next again
6. Press 'New' then 'finish
7. Please also run the following command from the Exchange Shell:
Get-ReceiveConnector "YourReceiveConnectorName" | Remove-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "ms-Exch-SMTP-Accept-Any-Recipient"
Change the "YourReceiveConnectorName" to match your Receive Connector Name and that should disable anonymous relaying.
Also if you want to check status of your domain/organization/server you can use following link:
http://www.mxtoolbox.com/
|