Subscribe to Windows IT Pro
October 25, 2004 12:00 AM

Exchange Relay Review

Protect your relay-capable servers from attack
Windows IT Pro
InstantDoc ID #44183
Rating: (3)

If you want even tighter control over who can access the relay virtual server—although in most environments, such control is probably unnecessary—you can use IP restrictions to limit which systems can open a connection. For example, if you have a subnet that remote-access or VPN-connected machines use and only these systems need to relay, you can limit SMTP Relay Virtual Server access to the machines on this subnet. You might also use IP restrictions to prevent connections to the virtual server if the physical server is IP accessible from a network beyond which you have direct control—for example, the Internet (ideally, you're protected by a firewall) or a subnet that another division or business unit uses. To configure access, click the Connection button on the SMTP Relay Virtual Server's Access tab. In the Connection dialog box, you can add individual IP addresses, a subnet (group of computers), or domain definitions, using the conventions and considerations that Table 1 provides. The difference between these settings and the relay-restricting settings is that these definitions control which systems can open an SMTP connection to the virtual server on port 25 and have no real impact on a client's ability to relay.

Finally, select the Delivery tab and click Advanced. In the Masquerade domain field, enter the DNS name (e.g., smtp-relay.neulan.net) that you assigned to the virtual server's IP address. The Masquerade domain setting controls the name of the server returned in the connection banner when an SMTP connection is opened. If you don't set the Masquerade domain setting, the connection banner will have the name of the physical server that hosts the SMTP virtual server. Click OK twice to close the virtual server's Properties pages. Right-click the virtual server in ESM, select Stop, then click Start to restart the virtual server and put the configuration settings into effect.

Confirming the Configuration
If you want to confirm that your server is rejecting relays but still accepting mail for your local recipients, you should try to relay mail through the two virtual servers. Test with accounts that are in the SMTP-APPROVED list and a few that aren't. If you elected to configure connection filtering, try connecting from authorized and unauthorized IP ranges. You should find that the original virtual server won't relay mail and that the new SMTP-relay virtual server will relay only when authenticated via credentials or identified via IP address. You'll probably want to use a client such as Outlook Express, but you can also use Telnet to open an SMTP session. I prefer the Telnet approach because I can test the connection fairly easily from just about any system without the hassle of loading or configuring a full mail client. In my next article, I'll describe how to use Telnet to test authenticated relaying.

Best practice mandates that you take steps to ensure that no Exchange server capable of hosting SMTP connections can be overtaken by others who want to use the server to relay email—particularly spam or a virus. You now know how to provide relay capabilities to clients while also protecting your servers against illegal relays.

TABLE 1: IP Relay Considerations
Type Consideration
IP Address This option lets you specify the IP address of one host that's allowed to relay. You'd use this option when another server or system needs to be able to send SMTP mail, often from an automated process—for example, a Web server sending registration confirmation. When you specify an IP address, you should be sure that you're specifying a system that has a fixed IP address and that you aren't specifying an IP address that's assigned through DHCP. If you specified an address assigned through DHCP, you could inadvertently grant the wrong computer the ability to relay.
Group of Computers This option lets you specify a range of IP addresses that are allowed to relay. You'd use this option when you have a group of computers within a fixed range of IP addresses that needs to relay. For example, if you have a group of servers in a Web farm that's assigned a contiguous block of IP addresses, you could specify a subnet definition instead of specifying each server. Make sure you know who will be able to obtain an IP address on the subnet, and monitor your servers for signs of relay abuse—particularly if DHCP is used on the subnet for address allocation.
Domain When you grant access by domain, the SMTP server performs a reverse DNS lookup by using the IP address of the connecting host and resolves that to a domain name. To implement this option, you must have a reverse lookup zone populated with pointer (PTR) records (DNS records that "point" IP addresses back to host names) for each system that needs to relay mail. If the IP-to-domain-name lookup matches a host name in the relay list, the relay is permitted. You'd use this option when you want to specify that a particular system be allowed to relay, but the IP address of that system changes. For example, you might enter a name of laptop6247 in the domain list when you have a laptop that's used both in the office and through a dial-up RAS connection. The laptop will have one IP address when connected to the in-office LAN and a different address during the dial-up session. This option also assumes that you're using dynamic DNS (DDNS) with dynamically created PTR records.

Related Content:

ARTICLE TOOLS

Comments
  • Alberto
    4 years ago
    Feb 15, 2008

    good

  • Andrew
    8 years ago
    Dec 05, 2004

    Very informative.

  • JOHN
    8 years ago
    Nov 23, 2004

    Great job.
    Looking forward to your next article.

You must log on before posting a comment.

Are you a new visitor? Register Here

advertisement

advertisement

Windows is a trademark of the Microsoft group of companies. Windows IT Pro is used by Penton Media Inc. under license from owner.