UCF STIG Viewer Logo

An IIS Server configured to be a SMTP relay must require authentication.


Overview

Finding ID Version Rule ID IA Controls Severity
V-228572 IIST-SV-000160 SV-228572r561041_rule Medium
Description
Anonymous SMTP relays are strictly prohibited. An anonymous SMTP relay can be a vector for many types of malicious activity not limited to server exploitation for the sending of SPAM mail, access to emails, phishing, DoS attacks, etc. Enabling TLS, authentication, and strictly assigning IP addresses that can communicate with the relay greatly reduce the risk of the implementation.
STIG Date
Microsoft IIS 10.0 Server Security Technical Implementation Guide 2022-09-21

Details

Check Text ( C-30804r505288_chk )
Interview the System Administrator about the role of the IIS 10.0 web server.

If the IIS 10.0 web server is running SMTP relay services, have the SA provide supporting documentation on how the server is hardened. A DoD-issued certificate, and specific allowed IP address should be configured.

If the IIS web server is not running SMTP relay services, this is Not Applicable.

If the IIS web server running SMTP relay services without TLS enabled, this is a finding.

If the IIS web server running SMTP relay services is not configured to only allow a specific IP address, from the same network as the relay, this is a finding.
Fix Text (F-30783r505289_fix)
Configure the relay server with a specific allowed IP address, from the same network as the relay, and implement TLS.