Exchange Internet-facing Receive connectors must offer Transport Layer Security (TLS) before using basic authentication.

Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Exchange Internet-facing Receive connectors must offer Transport Layer Security (TLS) before using basic authentication.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-221219	EX16-ED-000180	SV-221219r612603_rule		Medium

Description
Sending unencrypted email over the Internet increases the risk that messages can be intercepted or altered. TLS is designed to protect confidentiality and data integrity by encrypting email messages between servers and thereby reducing the risk of eavesdropping, interception, and alteration. This setting forces Exchange to offer TLS before using basic authentication.

STIG	Date
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide	2020-12-10

Details

Check Text ( C-22934r411783_chk )
Open the Exchange Management Shell and enter the following command: Get-ReceiveConnector \| Select Name, Identity, AuthMechanism For each receive connector, if the value of "AuthMechanism" is not set to "Tls, BasicAuth, BasicAuthRequireTLS", this is a finding.

Fix Text (F-22923r411784_fix)
Open the Exchange Management Shell and enter the following command: Set-ReceiveConnector -Identity <'IdentityName'> -AuthMechanism 'Tls, BasicAuth, BasicAuthRequireTLS' Note: The value must be in single quotes. Example only for the Identity: \Frontend Repeat the procedure for each receive connector.