UCF STIG Viewer Logo

Internet Receive Connectors must offer TLS before using basic authentication.


Overview

Finding ID Version Rule ID IA Controls Severity
Exch-ED-207 Exch-ED-207 Exch-ED-207_rule Medium
Description
Sending unencrypted email over the Internet increases the risk that messages can be intercepted or altered. Transport Layer Security (TLS) is designed to protect confidentiality and data integrity by encrypting email messages between servers and thereby reducing the risk of eavesdropping, interception, and alteration. This setting forces Exchange to offer TLS before using basic authentication.
STIG Date
Microsoft Exchange 2010 Edge Transport Server Role 2012-05-31

Details

Check Text ( C-_chk )
Open the Exchange Management Shell and enter the following command.

Get-ReceiveConnector -Identity <'ServerUnderReview\ReceiveConnector'> | Select AuthMechanism

If the value of "AuthMechanism" is not set to "Tls, BasicAuth, BasicAuthRequire TLS", this is a finding.
Fix Text (F-_fix)
Open the Exchange Management Shell and enter the following command.

Set-ReceiveConnector -Identity <'ReceiveConnector'> -AuthMechanism 'Tls, BasicAuth, BasicAuthRequire TLS'