mail relay problems 1

[turnjt]

I use exchange server 5.5 with service pack 4 and all the microsoft set ups to prevent relaying but I still have people using my server to send messages. In the message from it says <>jupiter.ductco.com.au (jupiter is the server) with the <> being the person sending the mail. How can I get rid of this person or persons using my server?

 

[cmeagan656]

Sounds like a revers NDR attack. See faq10-5018.

Cheers.

 

[DistressedDes]

Hi turnjt,

I too am using exchange 5.5 sp4 and have the same problem. I too am of the understanding that exchange 5.5 cannot combat this problem directly. cmeagan686's link confirms what I have been unable to find.

I have decided to go for a relay to do this kind of work for me. I have built a linux relay based on suse 10.1 oss, postfix, spamassassin, clam anti-virus and maia mailguard as per Stephen Carter's procedure;

http://www.novell.com/coolsolutions/feature/16093.html

There were some installation issues dealing with more up to date software versions than those in the document, but relatively minor.

Although my relay hasn't gone live yet, I'm hoping it should be able to stop this type of message reaching my exchange server through the header checks of maia mailguard.

This may be a rather low cost option for you, providing you have a spare computer around, or even test build it as a virtual machine if you have VM software. It may give you a more robust defence for your exchange server.