Microsoft Exchange 2010 Hub Transport Server Role

Overview

Version	Date	Finding Count (19)			Downloads
1	2012-05-31	CAT I (High): 0	CAT II (Med): 9	CAT III (Low): 10	Excel	JSON	XML

STIG Description
The Microsoft Exchange Server 2010 STIGs cover four of the five roles available with Microsoft Exchange Server 2010, plus core Exchange Server 2010 global requirements. The Email Services Policy STIG must also be reviewed for each site hosting email services. The core Exchange Server guidance must be reviewed on each server role prior to the role-specific guidance. Also, for the Client Access server, the IIS guidance must be reviewed prior to the OWA checks.

STIG Description

The Microsoft Exchange Server 2010 STIGs cover four of the five roles available with Microsoft Exchange Server 2010, plus core Exchange Server 2010 global requirements. The Email Services Policy STIG must also be reviewed for each site hosting email services. The core Exchange Server guidance must be reviewed on each server role prior to the role-specific guidance. Also, for the Client Access server, the IIS guidance must be reviewed prior to the OWA checks.

Available Profiles

Classified	Public	Sensitive
I - Mission Critical Classified	I - Mission Critical Public	I - Mission Critical Sensitive	II - Mission Support Classified	II - Mission Support Public	II - Mission Support Sensitive	III - Administrative Classified	III - Administrative Public	III - Administrative Sensitive

Findings (MAC III - Administrative Sensitive)

Finding ID	Severity	Title	Description
Exch-HB-205	Medium	Receive Connector connection must be encrypted.	The Simple Mail Transfer Protocol (SMTP) Receive Connector is used by Exchange to send and receive messages from server to server using SMTP protocol. This setting controls the encryption...
Exch-HB-204	Medium	Receive Connector must restrict relay access.	This control is used to limit the servers that may use this server as a relay. If an Simple Mail Transport Protocol (SMTP) sender does not have a direct connection to the Internet (for example,...
EXCH-HB-322	Medium	Send Connectors must use a Smart Hosts.	In the case of identifying a 'Smart Host' for the email environment, the connector level is the preferred location for this configuration because flow control in this routing group will be...
Exch-HB-213	Medium	Send Connector message size must be controlled.	This setting can be used to limit the total size of messages at the connector level. This includes the message header, the message body, and any attachments. For internal message flow, Exchange...
Exch-HB-206	Medium	Receive Connectors must use Domain Security (Mutual Authentication TLS).	The Simple Mail Transfer Protocol (SMTP) connector is used by Exchange to send and receive messages from server to server. There are several controls that work together to provide security between...
Exch-HB-216	Medium	Send Connectors must use Domain Security (Mutual Authentication TLS).	The Simple Mail Transfer Protocol (SMTP) connector is used by Exchange to send and receive messages from server to server. There are several controls that work together to provide security between...
Exch-HB-217	Medium	Send Connectors must be encrypted.	The Simple Mail Transfer Protocol (SMTP) connector is used by Exchange to send and receive messages from server to server. There are several controls that work together to provide security between...
Exch-HB-218	Medium	Email application directory permissions must be restricted.	Default product installations may provide more generous permissions than are necessary to run the application. By examining and tailoring permissions to more closely provide the least amount of...
Exch-HB-219	Medium	Connectivity logging must be enabled.	A connectivity log is a record of the SMTP connection activity of the outbound message delivery queues to the destination Mailbox server, smart host, or domain. Connectivity logging is available...
Exch-HB-203	Low	Receive Connector timeout must be limited.	Email system availability depends in part on best practices strategies for setting tuning. This configuration controls the number of idle minutes before the connection is dropped. It works in...
Exch-HB-202	Low	Receive Connector connections count must be controlled.	Email system availability depends in part on best practices strategies for setting tuning. This configuration controls the maximum number of simultaneous inbound connections allowed to the server....
Exch-HB-201	Low	Receive Connector message size must be controlled.	This setting can be used to limit the total size of messages at the connector level. This includes the message header, the message body, and any attachments. For internal message flow, Exchange...
Exch-HB-210	Low	Receive Connectors must be clearly named.	For Receive Connectors, unclear naming as to direction and purpose increases risk that messages may not flow as intended, troubleshooting efforts may be impaired, or incorrect assumptions made...
Exch-HB-211	Low	Send Connectors must be clearly named.	For Send Connectors, unclear naming as to direction and purpose increases risk that messages may not flow as intended, troubleshooting efforts may be impaired, or incorrect assumptions made about...
Exch-HB-214	Low	Send Connector connections count must be limited.	This setting controls the maximum number of simultaneous outbound connections allowed for a given SMTP Connector, and can be used to throttle the SMTP service if resource constraints warrant it. ...
Exch-HB-209	Low	Receive Connectors must control the number of recipients 'chunked' on a single message.	Email system availability depends in part on best practices strategies for setting tuning configurations. This setting is used when two Exchange servers send or receive email. The chunking setting...
Exch-HB-208	Low	Receive Connectors must control the message count per inbound session.	Email system availability depends in part on best practices strategies for setting tuning configurations. This setting controls the maximum number of messages allowed in a single SMTP session by...
Exch-HB-212	Low	Send Connector delivery retries must be controlled.	This setting controls the rate at which delivery attempts from the home domain are retried, user notification is issued, and expiration timeout when the message will be discarded. If delivery...
Exch-HB-215	Low	Send connections per domain must be set.	This configuration controls the maximum number of simultaneous outbound connections to a domain, and works in conjunction with the Maximum Outbound Connections Count setting as a delivery tuning...