Securing Exchange Internet Mail

[mikes]

Hi, I have come back from the summer holidays to find that one of our exchange users passwords was compromised, and that the user was sending vast amounts of spam over the summer through Internet Mail... does anyone have any advice on securing MS exchange? the users password was bruted... the OSS mailservers I have used in the past had connection limits to hinder bruiting, but I can't see anything like that in Exchange... also is there a way of limiting a users maximum e-mails per week? sendmail had that but I can't find it in exchange?

 

thanks; I am going through the users mailbox now and a number of people have e-mailed back having a go

[pcstru]

Set throttling so any user can only send so many emails in any given period. That will limit spammers should they get in. We also set limits on the number of attempts that can be made to login before logins are blocked. That limits the ability of hackers to brute force their way in.

[Davit2005]

Accounts should allways lockout after a certain amount of attempts, lesson learned. Helps if users can only access via webmail externally, something I had to do at my last place when a generic account got compromised.

 

Could of been worse, you could of been blacklisted.

[pcstru]

I had to do at my last place when a generic account got compromised.

Another suggestion is not to allow generic logins for generic email accounts (the logins lack the accountability you need) - the enquiries@ etc. Give permissions to those who need to access them and use Outlook or OWA to give access to that mailbox.

[Duke5A]

Same thing happened to us and we already have a lockout policy, so the user's credentials must have been skimmed somewhere. You can set throttling policies via Power Shell: Limit the number of Internet messages a user can send

 

We actually were blacklisted. I'm still fighting with MS after two months to stop rate limiting us.