SMTP Connectors perform outbound anonymous connections.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18784	EMG2-743 Exch2K3	SV-20495r1_rule	ECCT-1	High

Description
Identification and Authentication provide the foundation for access control. The key to preventing SPAM insertion into the SMTP message transfer path is to require authentication at each ‘hop’ of the journey from sender to receiver. Failure to authenticate increases risk that an attacker can insert unauthenticated mail messages, a form of internally SPOOFED SPAM that can be difficult to trace. Encryption ensures confidentiality of data in motion as it traverses network connections. Failure to specify TLS encryption causes message transfer to be sent unencrypted, (including the authentication password), which makes it susceptible to eavesdropping. This setting controls the authentication and encryption algorithms used for outbound connections using this connector. (That is, the authentication used when delivering outbound mail to another SMTP Virtual Server.) When the SMTP connectors send messages from a locally controlled (internal to the organization) connector, Basic authentication and TLS should be used by the initiating end of the connection. Because no Exchange 2003 servers should directly send to remote SMTP virtual servers, all SMTP outbound connectors should be secured in this way, including the outermost connectors, which should ideally be sending to an Edge Transport Server Role (E-mail Secure Gateway) at the enclave perimeter.

Description

Identification and Authentication provide the foundation for access control. The key to preventing SPAM insertion into the SMTP message transfer path is to require authentication at each ‘hop’ of the journey from sender to receiver. Failure to authenticate increases risk that an attacker can insert unauthenticated mail messages, a form of internally SPOOFED SPAM that can be difficult to trace. Encryption ensures confidentiality of data in motion as it traverses network connections. Failure to specify TLS encryption causes message transfer to be sent unencrypted, (including the authentication password), which makes it susceptible to eavesdropping. This setting controls the authentication and encryption algorithms used for outbound connections using this connector. (That is, the authentication used when delivering outbound mail to another SMTP Virtual Server.) When the SMTP connectors send messages from a locally controlled (internal to the organization) connector, Basic authentication and TLS should be used by the initiating end of the connection. Because no Exchange 2003 servers should directly send to remote SMTP virtual servers, all SMTP outbound connectors should be secured in this way, including the outermost connectors, which should ideally be sending to an Edge Transport Server Role (E-mail Secure Gateway) at the enclave perimeter.

STIG	Date
Microsoft Exchange Server 2003	2014-08-19

Details

Check Text ( C-22495r1_chk )
Validate outbound connector security on Exchange servers. Procedure: Exchange System Manager>>Administrative Groups>> [Administrative Group]>>Routing Groups>> [routing group]>>Connectors>> [SMTP connector]>> >>Properties >> Advanced tab >> Outbound Security button The “Basic Authentication” and “TLS” choices should be selected. Criteria: If “Basic Authentication” and “TLS” are selected, this is not a finding.

Check Text ( C-22495r1_chk )

Validate outbound connector security on Exchange servers.

Procedure: Exchange System Manager>>Administrative Groups>> [Administrative Group]>>Routing Groups>> [routing group]>>Connectors>> [SMTP connector]>> >>Properties >> Advanced tab >> Outbound Security button

The “Basic Authentication” and “TLS” choices should be selected.

Criteria: If “Basic Authentication” and “TLS” are selected, this is not a finding.

Fix Text (F-19439r1_fix)
Implement perimeter protection in the form of an Edge Transport Role Server (E-mail Secure Gateway) that performs, among other protections, the ability to perform Anonymous connections to remote E-mail domains. Configure outbound SMTP connectors. Procedure: Exchange System Manager>>Administrative Groups>> [Administrative Group]>>Routing Groups>> [routing group]>>Connectors>> [SMTP connector]>> >>Properties >> Advanced tab>>Outbound Security button For each connector, select “Basic Authentication” and “TLS”

Fix Text (F-19439r1_fix)

Implement perimeter protection in the form of an Edge Transport Role Server (E-mail Secure Gateway) that performs, among other protections, the ability to perform Anonymous connections to remote E-mail domains.

Configure outbound SMTP connectors.

Procedure: Exchange System Manager>>Administrative Groups>> [Administrative Group]>>Routing Groups>> [routing group]>>Connectors>> [SMTP connector]>> >>Properties >> Advanced tab>>Outbound Security button

For each connector, select “Basic Authentication” and “TLS”