PDA

View Full Version : Exchange 5.0 being used to relay - HELP!



06-11-2001, 05:46 PM
Our school's Exchange 5.0 server has been highjacked and we have sent around 50000 spam e-mails across the the Net. How do we stop this happening? (We've shut the server down in the meantime.) I can't find any settings in Exchange Administrator that prevent relaying.

People are getting rather (understandably) annoyed with us...

06-11-2001, 06:58 PM
hi Perry
I hope you didn't install the server...

When you close the open relay you will only be able to use MAPI and IMAP clients to read and send mail.

Here is a link to instructions on closing the open relay:

http://www.sans.org/infosecFAQ/email/open_relay.htm

Good luck!!

06-11-2001, 07:04 PM
hi Perry,

further to my other post, perhaps you should have a look at the bigger picture...

Is your exchange server hanging directly out on the internet? Or are you behind a NAT or firewall device with a pinhole on port 25?
If you have your exchange server with it's tail hanging out, are you running port restrictions on the external interface?

If you are behind a firewall and it acts as a relay then it's likly to be at fault here...