• RSS
  • Twitter
  • FaceBook

Exchange Server Forums

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

HELP! I'm being attacked by SPAM!

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [Microsoft Exchange 5.5] >> General >> HELP! I'm being attacked by SPAM! Page: [1]
Login
Message << Older Topic   Newer Topic >>
HELP! I'm being attacked by SPAM! - 5.Jun.2000 5:17:00 PM   
LenB

 

Posts: 2
Joined: 5.Jun.2000
From: Naperville, IL USA
Status: offline
I'm running Exchange 5.5 sp3 with relay restrictions set in the IMS.
However, my server is being used as a relay by a spammer (confirmed by MAPS).
What am I missing? I know that there was a post sp2 hotfix for encapsulated SMTP security hole. Wasn't this hotfix included in sp3?
Post #: 1
RE: HELP! I'm being attacked by SPAM! - 7.Jun.2000 1:13:00 AM   
jredd

 

Posts: 30
Joined: 7.Jun.2000
From: sydney, australia
Status: offline
Microsoft does a terrible job of documenting how to properly configure Exchange to prevent it from being used as a relay. There are 4 KB articles which are vague, and one very good Technet article. The URL for the Technet article is http://www.microsoft.com/technet/exchange/relay.asp.

Any questions, give me a holler at reddjohn@yahoo.com

John


(in reply to LenB)
Post #: 2
RE: HELP! I'm being attacked by SPAM! - 3.Jul.2000 9:43:00 AM   
StephenCB

 

Posts: 71
Joined: 5.Jun.2000
From: Location
Status: offline
SPAM is a very big problem and many companies have recognised this. GFi is one of them, they have a product called Mail Essentials for Exchange which tackles SPAM, Viruses, and other email security issues, it also adds encryption to your emails and auto responses is another great feature. I truly suggest that you check it out.

Mail Essentials is also free to download for 5 users which is great if you want to test the product as you have no restrictions. The Mail Essentials website is http://www.gficomms.com/me/exchangefaqmes.shtml

[This message has been edited by StephenCB (edited 07-03-2000).]


(in reply to LenB)
Post #: 3
RE: HELP! I'm being attacked by SPAM! - 6.Jul.2000 1:10:00 PM   
gdh

 

Posts: 159
Joined: 6.Jul.2000
From: Tampa Bay, Florida
Status: offline
Ahh yes... you gotta turn off that relay.

Ok, go to your IMC routing tab. Go to the Routing Restrictions. Check the box for "Hosts and clients with these IP addresses" but don't specify any.

You'll need to stop and start the Internet Mail service for changes to take. For the details check out:
http://www.microsoft.com/technet/exchange/relay.asp

Note that you will need to specify any addresses that really do need to relay via your Exchange server such as a What's Up box that needs to email out notifications. You can just pop in that address and subnet or a range of all your internal adresses and the appropriate subnet.

Hope this helps!


(in reply to LenB)
Post #: 4
RE: HELP! I'm being attacked by SPAM! - 12.Dec.2000 6:08:00 PM   
Guest
This information is really great, but unfortunately, it doesn't seem to work for my environment.

Some of the KB articles mentioned above no longer exist, and whenever I do anything like restricting relaying, I can't send to the addresses in that domain anymore.

Any ideas on where else I can look?


(in reply to LenB)
  Post #: 5
RE: HELP! I'm being attacked by SPAM! - 30.Apr.2002 8:03:00 PM   
akak1701

 

Posts: 5
Joined: 27.Jun.2001
From: Indianapolis, IN
Status: offline
I followed the article here:

http://www.msexchange.org/authors/derbyshire/tutorials/preventing_third_party_relaying.htm

and I STILL have problems. the originator shows as a <> in the details. It's slowing down our t-1 drastically.

Anything else I am missing? I have sp4 installed.

Greg

(in reply to LenB)
Post #: 6
RE: HELP! I'm being attacked by SPAM! - 10.May2002 2:11:00 AM   
ICU-EStar

 

Posts: 79
Joined: 25.Jan.2001
From: NYC
Status: offline
Guys,
Im sure that im not the only one here with the same problem but all these ways of preventing 3rd party users from sending SPAM through the IMC is good but however it does not meet the requirments if our server is setup for pop3.

I need my users to be able to send and recieve mail using pop3 but I cannot also use the option called "Auth before sending mail" or Add IP address to the allow list.

Almost all pop3 clients even mac users dont have that option to Auth to the server when sending mail. also if I have several hundred users on pop3 that would be crazy to add all those in if their on dial up....

IS their anything else to stop SPAMing but allow pop3 users to send mail too ?

(in reply to LenB)
Post #: 7
RE: HELP! I'm being attacked by SPAM! - 10.May2002 2:43:00 AM   
ICU-EStar

 

Posts: 79
Joined: 25.Jan.2001
From: NYC
Status: offline
I just heard of something called
reverse look up in the from field..

Were does this get turned on from?

im using 5.5 on 2k o/s and its role is pop3 for my users.

(in reply to LenB)
Post #: 8
RE: HELP! I'm being attacked by SPAM! - 14.May2002 4:20:00 AM   
Eric

 

Posts: 91
Joined: 28.Jun.2000
From: Ortigas Ctr., Mandaluyong City, Philippines
Status: offline
on IMC.....routing.....routing restrictions.......choose ...Host and client that successfully authenticate........coupled with.....Host and client with these ip addresses....dont put any ip on the entry list.....this works for our org.....also check your firewall......

(in reply to LenB)
Post #: 9
RE: HELP! I'm being attacked by SPAM! - 14.May2002 2:51:00 PM   
ICU-EStar

 

Posts: 79
Joined: 25.Jan.2001
From: NYC
Status: offline
The idea below I know works well but the thing is our several hundred users are mostly Mac and Netscape users. Their clients dont have options that can be checked off to allow "client that successfully authenticate". Only MS express that I know of has this. Their has to be a way to secure MS Exchange 5.5 pop 3 server but still allow it to be access using any pop3 client.

"on IMC.....routing.....routing restrictions.......choose ...Host and client that successfully authenticate........coupled with.....Host and client with these ip addresses....dont put any ip on the entry list.....this works for our org.....also check your firewall......"

(in reply to LenB)
Post #: 10
RE: HELP! I'm being attacked by SPAM! - 15.May2002 1:50:00 PM   
ICU-EStar

 

Posts: 79
Joined: 25.Jan.2001
From: NYC
Status: offline
So this is it.....
ms exch 5.5 cannot act as a tru pop3 server with out having to accept spam.... [Frown]

anyone have anyideas still?
their has to be something that can be done to not allow outsiders not to use the box as a open relay but still allow our users who are moble on dial ups to send mail.... and doing the Atuh before sending mail option we can do because most of out users are on Macs and netscape witch does not support this option from the client end as MS express does.
[Roll Eyes]

(in reply to LenB)
Post #: 11
RE: HELP! I'm being attacked by SPAM! - 17.May2002 8:57:00 PM   
dlwhittle

 

Posts: 15
Joined: 26.Apr.2002
From: colorado
Status: offline
Are you sure it's using your exchange server to relay? Maybe it's one of those viruses with its own smtp engine?

(in reply to LenB)
Post #: 12
RE: HELP! I'm being attacked by SPAM! - 22.May2002 9:49:00 AM   
Eric

 

Posts: 91
Joined: 28.Jun.2000
From: Ortigas Ctr., Mandaluyong City, Philippines
Status: offline
things I've mentioned above works well on my organization.....I also have Netscape users.

for Netscape to work.....check alias for mailbox....should be the same as the username

(in reply to LenB)
Post #: 13
RE: HELP! I'm being attacked by SPAM! - 22.May2002 4:24:00 PM   
ICU-EStar

 

Posts: 79
Joined: 25.Jan.2001
From: NYC
Status: offline
yes i did the ubove now and it looks good.
for my Mac and netscape users I just had them upgrade them to the new versions and they now have the option to check off Auth setting on outgoing mail.
as for that smtp virus is their a way to check for that.?

(in reply to LenB)
Post #: 14
RE: HELP! I'm being attacked by SPAM! - 23.May2002 11:18:00 AM   
Eric

 

Posts: 91
Joined: 28.Jun.2000
From: Ortigas Ctr., Mandaluyong City, Philippines
Status: offline
we let our NAI Gauntlet Firewall do that job

(in reply to LenB)
Post #: 15
RE: HELP! I'm being attacked by SPAM! - 4.Jun.2002 5:44:00 AM   
mikelef@qwest.net

 

Posts: 1
Joined: 4.Jun.2002
From: Arizona
Status: offline
Messages with "<>" listed as the originator are usually comming from your adminstrator or postmster account and are typically outbound NDR's

(in reply to LenB)
Post #: 16
RE: HELP! I'm being attacked by SPAM! - 5.Jun.2002 8:58:00 AM   
Guest
I try used Exchange5.5 IMC Patch 2655.55 (Post SP4). That stop relay only 2 days.

(in reply to LenB)
  Post #: 17
RE: HELP! I'm being attacked by SPAM! - 17.Jun.2002 6:44:00 PM   
Guest
Anyone have any idea why the routing restrictions button would be greyed on the routing tab of the imc properties page? We're running exc 5.5, SP4. The custom box is not checked. Every aticle I read tells me to click the button, but no one offers any suggestion on what to do If I can't click it. It's there, but grey, and our server is cranking out spam.

If anyone can help, reply or crackpigeon@excite.com
Thanks!

(in reply to LenB)
  Post #: 18
RE: HELP! I'm being attacked by SPAM! - 13.Jan.2003 9:32:00 PM   
Krypto

 

Posts: 1
Joined: 13.Jan.2003
From: USA
Status: offline
Here's a link to get rid of "<>" in the IMS que for exchange 5.5 sp1+ http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B315687

[ January 13, 2003, 09:34 PM: Message edited by: Krypto ]

(in reply to LenB)
Post #: 19

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [Microsoft Exchange 5.5] >> General >> HELP! I'm being attacked by SPAM! Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts


Follow TechGenix on Twitter