5

I have an Exchange Server 2010, that uses a smart host to send out mails. A day ago the owner of smart host contact us and told us that we send out spam.

I have try different open relay test on the net and all of them come back saying that this server is secured and can not be used as relay server. But I can see in my Exchange Queue Viewer that it keeps coming in new messages. Here is an example of how it looks.

Identity: mailserver\3874\13128
Subject: Olevererbart:: helladian@xxx.xxx Pfizer -75% now
Internet Message ID: <7388a3e0-7171-408d-ab24-806725beffb1@xxx.xxx>
From Address: <>
Status: Ready
Size (KB): 6
Message Source Name: DSN
Source IP: 255.255.255.255
SCL: -1
Date Received: 2010-12-09 21:46:22
Expiration Time: 2010-12-11 21:46:22
Last Error: 
Queue ID: mailserver\3874
Recipients:  urinee6024@proxad.net

How can I secure our exchange server more, to stop this from happening?

Could I have got an virus that hooks up to our exchange server and send mail throw that?

As I can see the From Address is always <>, is there someway that I can stop sending mails that don't have a from address that I describe?

Pleas help

Ben Pilbrow
  • 12,049
Magnus Gladh
  • 151

5 Answers5

12

Since you already tried the open relay tests from the internet, that means it's a computer on the internal network sending spam. It's most likely a compromised machine with a virus on it, so that needs addressing as a matter of urgency as well.

It sounds to me like you have a Receive Connector which is set up to allow open relaying from inside the network (which is why the external tests didn't pick it up).

The message tracking logs should tell you what Receive Connector the mails are being received through, so you'll need to look at the properties of that Receive Connector and make them more restrictive. Use the command Get-MessageTrackingLog -MessageId "<<Spam Message ID>>" |ft MessageId, ConnectorId in the Exchange Management Shell to give you the Receive Connector it's going through.

My guess is your receive connector is set to accept mail from the whole of your internal network (for example 10.1.1.1 to 10.255.255.255) rather than specific IP addresses that need to send unauthenticated email.

Standard practice is to leave the Receive Connector that was created when you installed Exchange as it is and create a new Receive Connector (for example "Allow Anonymous Relay") with the following settings.

  • On the Network tab, Listen on all available IP addresses on port 25
  • On the Network tab, Add any IP addresses which need to send unauthenticated mail (printers, web servers, monitoring software etc)
  • On the Authentication tab, untick everything except Externally Secured (for example, with IPSec)
  • On the Permission Groups tab, untick everything except Exchange Servers

Edit: Sorry! On the very last line I said untick everything except Anynymous users - I really meant untick everything except Exchange Servers. My bad :'(

Ben Pilbrow
  • 12,049
2

If your relaying configuration is correct, and you're not configured as an open relay, it's most likely one of the following things:

  1. A compromised user account is connecting to your publicly-accessible SMTP service, authenticating, and sending spam
  2. A server on your network authorized to relay unauthenticated through Exchange is compromised, and sending spam through your Exchange servers
  3. As above, but with a desktop machine

In any case, you want to be checking your Delivery Reports for the destination address on that email, which should give you both the sending user and the originating system for the message.

jgoldschrafe
  • 4,425
0

What are the client protocols you have enabled and are all of them configured to require client authentication before accepting outgoing email?

You should also look into the Exchange Anti-Spam features.

Franci Penov
  • 1,148
  • 7
  • 7
0

I tried the command in Powershell, but the connectorid is empty. Could this be because it's actually not sent out (i did find the messageid in Queue viewer).

I could see one diffrent from the mails I create and the spam mails in the messageid and that is that in the mails I create the name of the mailserver is supplied, but in the spam messages it's only the domain name.

ex: xxxxxx@mailserver.microsoft.com vs xxxxx@microsoft.com

I think I need to set up some network sniffer on my mailserver and try to see from what computer in the network that is sending the mails...

This is the information I Got from the power shell command:

Identity : MAILSERVER\Default MAILSERVER AuthMechanism : Tls, Integrated, BasicAuth, BasicAuthRequireTLS, ExchangeServer Bindings : {192.168.0.5:25} Enabled : True PermissionGroups : AnonymousUsers, ExchangeUsers, ExchangeServers RemoteIPRanges : {0.0.0.0-255.255.255.255} 
Identity : MAILSERVER\Client MAILSERVER AuthMechanism : Tls, Integrated, BasicAuth, BasicAuthRequireTLS Bindings : {192.168.0.5:587} Enabled : True PermissionGroups : ExchangeUsers RemoteIPRanges : {192.168.0.0/26}

I close down port 25 in the firewall, and then the spam stops. So it has to be an open relay. But it's strange that it passes all the test, and I have no clue how to stop it.

If I remove the AnonymousUsers (which looks like a good idea...) from the Default Connector the spams stops, but then I can't receive mails. Get "The error that the other server returned was: 530 530 5.7.1 Client was not authenticated (state 13)." error, when somebody tries to send mails to our server.

Magnus Gladh
  • 151
  • Did you look at your receive connectors to check the permission groups on them? Could you post the output of Get-ReceiveConnector | fl Identity, AuthMechanism, Bindings, Enabled, PermissionGroups, RemoteIPRanges from the Exchange Management Shell - that will list all your receive connectors and you should be able to determine which Receive Connector the emails are coming through on from the permissions. – Ben Pilbrow Dec 12 '10 at 14:35
0

I had the same issue. It was due to a computer in the network sending out spam. It's hard to locate the computer but I was able to find it in a slightly different way. Here's a way to find the culprit. THIS WILL TAKE THE NETWORK DOWN MOMENTARY.

Get and install Wireshark on a computer that you don't mind losing for some time. Obtain a HUB(yes one of those old networking devices :) ). It's important that this is a hub since this will forward all traffic to all ports. Connect the Hub in between the network and the modem. Connect computer with Wireshark to the hub as well. Like Below

Internet-----Hub----WireShark Computer AND Switch

Now when you open Wireshark and start capturing you will get ALL network traffic. I set up Capture filters to ignore all ports but 25 and all IPs that I know are okay.

Jeff
  • 685
  • 7
  • 18