E-mail user mailboxes do not have Storage Quota Limitations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18643	EMG2-136 Exch2K3	SV-20218r1_rule	ECSC-1	Low

Description
E-mail system availability depends in part on best practices strategies for setting tuning configurations. These settings control the maximum sizes of a user’s mailbox and the system’s response if these limits are exceeded. Mailbox data that is not monitored against a quota increases the risk of mail loss due to filled disk space, which can also render the system unavailable. There are three controls, which supply graduated levels of opportunity to respond before risking data loss. The first control sends an E-mail warning to users stating that they have exceeded their mailbox quota. The second level sends the warning, and causes users to receive, but not send, mail. The third level sends a warning message, and causes users to neither receive nor send mail. Quota limits should be set as multiples of “Maximum Message Size” to ensure no level is skipped. As a practical matter, levels 1 and 2 serve the purpose of prompting users to manage their E-mail. Level 3 impedes users in their ability to work, and is not required as mail interruption is not acceptable. User Mailbox Quota limitations are not a substitute for overall disk space monitoring.

Description

E-mail system availability depends in part on best practices strategies for setting tuning configurations. These settings control the maximum sizes of a user’s mailbox and the system’s response if these limits are exceeded. Mailbox data that is not monitored against a quota increases the risk of mail loss due to filled disk space, which can also render the system unavailable. There are three controls, which supply graduated levels of opportunity to respond before risking data loss. The first control sends an E-mail warning to users stating that they have exceeded their mailbox quota. The second level sends the warning, and causes users to receive, but not send, mail. The third level sends a warning message, and causes users to neither receive nor send mail. Quota limits should be set as multiples of “Maximum Message Size” to ensure no level is skipped. As a practical matter, levels 1 and 2 serve the purpose of prompting users to manage their E-mail. Level 3 impedes users in their ability to work, and is not required as mail interruption is not acceptable. User Mailbox Quota limitations are not a substitute for overall disk space monitoring.

STIG	Date
Microsoft Exchange Server 2003	2014-08-19

Details

Check Text ( C-22342r1_chk )
First, make a note of the configured SMTP Virtual Server message size (example, the default is 10,240 KB). Exchange System Manager >> Administrative Groups >> [administrative group] >> Servers >> [server name] >> Protocols >> SMTP >> [Specific SMTP Virtual Server] >> Properties >> Messages Tab >>Limit message size to: (KB) Use the SMTP Virtual Server Message Size to configure the Mail Store Quota values. Progression of configured values should be 'equal to' or 'greater than' one message size value to prevent an alert being skipped due to one message. Procedure: Exchange System Manager >> administrative groups >> [administrative group] >> servers >> [server name] >> [storage group] >> Mailbox store [server name] >> properties >> Limits tab “Issue warning at (KB)” should be selected and have a value. “Prohibit send at (KB)” should be selected and have a value. "Prohibit send and receive at (KB)" should not be selected. Criteria: If “Issue warning at (KB)” and “Prohibit send at (KB)” are selected, and have assigned values, with "Prohibit send and receive at (KB)" not selected, this is not a finding.

Check Text ( C-22342r1_chk )

First, make a note of the configured SMTP Virtual Server message size (example, the default is 10,240 KB).

Exchange System Manager >> Administrative Groups >> [administrative group] >> Servers >> [server name] >> Protocols >> SMTP >> [Specific SMTP Virtual Server] >> Properties >> Messages Tab >>Limit message size to: (KB)

Use the SMTP Virtual Server Message Size to configure the Mail Store Quota values. Progression of configured values should be 'equal to' or 'greater than' one message size value to prevent an alert being skipped due to one message.

Procedure: Exchange System Manager >> administrative groups >> [administrative group] >> servers >> [server name] >> [storage group] >> Mailbox store [server name] >> properties >> Limits tab

“Issue warning at (KB)” should be selected and have a value.

“Prohibit send at (KB)” should be selected and have a value.

"Prohibit send and receive at (KB)" should not be selected.

Criteria: If “Issue warning at (KB)” and “Prohibit send at (KB)” are selected, and have assigned values, with "Prohibit send and receive at (KB)" not selected, this is not a finding.

Fix Text (F-19275r1_fix)
Make a note of SMTP Virtual Server Message size limitation. Administrative Groups >> [administrative group] >> Servers >> [server name] >> Protocols >> SMTP ? [Specific SMTP Virtual Server] >> Properties >> Messages Tab >>Limit message size to: (KB) Use the message size value to configure Mail Store Quota values. Limits should be at least as big as SMTP message size. Procedure: Exchange System Manager >> Administrative Groups >> [administrative group] >> Servers >> [server name] >> [storage group] >> Mailbox store [server name] >> Properties >> Limits tab Select “Issue warning at (KB)” and enter a quota value. Select “Prohibit send at (KB)" and enter a quota value at least as large as "Issue warning at (KB) plus the value of SMTP Virtual Server message size. Do not Select "Prohibit send and Receive at (KB)" Note: Progression of configured actions should be equal to or greater than one message size to prevent an alert being skipped due to one message.

Fix Text (F-19275r1_fix)

Make a note of SMTP Virtual Server Message size limitation.

Administrative Groups >> [administrative group] >> Servers >> [server name] >> Protocols >> SMTP ? [Specific SMTP Virtual Server] >> Properties >> Messages Tab >>Limit message size to: (KB)

Use the message size value to configure Mail Store Quota values. Limits should be at least as big as SMTP message size.

Procedure: Exchange System Manager >> Administrative Groups >> [administrative group] >> Servers >> [server name] >> [storage group] >> Mailbox store [server name] >> Properties >> Limits tab

Select “Issue warning at (KB)” and enter a quota value.

Select “Prohibit send at (KB)" and enter a quota value at least as large as "Issue warning at (KB) plus the value of SMTP Virtual Server message size.

Do not Select "Prohibit send and Receive at (KB)"

Note: Progression of configured actions should be equal to or greater than one message size to prevent an alert being skipped due to one message.