Help -- I need to go to the beach this weekend...

[pnabby]

and I can't if I don't fix this problem.

We are running Server 2000 and Exchange 2000 and the prior IT Administrator had our mail relay set up to allow computers to relay through the SMTP virtual server "All except the list below" (which was blank) and to "Allow all computers which successfully authenticate to relay, regardless of the list above."

According to what I have read, this makes us an open relay, which is very bad and why I am still deleting 120K emails in the administrator account and why the queue is always full. We are also on the DBSL (Distributor Boycott Server List) and our ISP has threatened to boycott us if we do not remove the open relay.

I have 20 users that access email through the LAN and 4 users that access their email remotely. I have worked with 3 of those users and changed their outgoing SMTP from our mail server to their own ISP to prevent problems.

The last person is my boss and she routinely travels to NY and uses a dial up account to access her email. She also connects onto the LAN when she is here in town.

I left the "Allow allcomputers which successfully authenticate to relay, regardless of the list above" alone and changed the computers who may relay option to "Only the list below" and I added a range of our IP's that takes care of our LAN users.

After I made this change, my boss could not relay messages. I showed her how to use OWA until she returned and I could look at her laptop settings. However, she does not like OWA and she only wants to use Outlook. She also had no time/patience to read me any of her computer settings. She told me that I need to be available to her this weekend to help her with email, which means my beach trip is off....bummer!!!

I'm thinking that my only option is to change it back to the original configuration until she returns, which will of course put us back on the DBSL list and put us at risk of being shut down by our ISP.

I can't put in her IP address, since I don't know what it is or if it is static or dynamic, although I'm guessing dynamic on a dialup connection.

Any advice?? Please, I need to get away from this place if just for only 2 days!!!!!

Thanks,
Julie

 

[dennisbbb]

First of all the previous admin correctly set up the exchange server to prevent spam relaying.

Allow computers to relay through the SMTP virtual server "All except the list below" (which was blank) and to "Allow all computers which successfully authenticate to relay, regardless of the list above.

The problem you have can be two fold:

1) You have an account open and a spammer is using it to login to relay email. In this case, you should check on the event viewer to see which account is authenticating the most. Change that user's password.

2) Your server is being used as a Reverse NDR spam machine. Each time a spammer sends to a bogusname@yourcompany.com, it gets rebound with NDR to the sender (which is an email address used by spammer to spam to). You need a Reverse NDR fix which will not pass NDR to external users. Sorry I don't have the patch.

Good luck.

 

[Trashkk]

To resolve this whole mess completely is to setup VPN and have your remote users VPN in.

 

[pnabby]

If it was setup correctly, then how come relay tests come back positive? Also, according to Microsoft documentation, this is setup incorrectly.

 

[Davetoo]

Your Exchange server was setup incorrectly to begin with, you are correct. It should be set to Only the List Below and then enter internal addresses of servers/pc's that are allowed to relay due to various reasons (fax programs, etc). Then check the last one to allow any that authenticate regardless of the list.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[Davetoo]

Sorry, hit the wrong button...

To continue, you'll have to establish a way for your outside users to authenticate to the Exchange server in order for them to be able to send email to any user not located on your server. This can be a long and difficult road to take.

A VPN connection would solve the problem because if you VPN into your network, then the user has access to the Exchange server just as if they were physically connected.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[dennisbbb]

OK sorry I was thinking about IMS in Exchange 5.5.

You're right it is set up incorrectly. It should be set to
"Only the list below" and you add the ip and netmask to the list. Add an entire group by using netmask 255.255.0.0 and restart the smtp service.

 

[pnabby]

That's what I thought....bummer since I can't even get a hold of her laptop until next week.

thanks for the advice.