Exchange internal Receive connectors must not allow anonymous connections.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-221245 | EX16-ED-000490 | SV-221245r961161_rule | CCI-001308 | medium |
| Description | ||||
| This control is used to limit the servers that may use this server as a relay. If a Simple Mail Transport Protocol (SMTP) sender does not have a direct connection to the Internet (for example, an application that produces reports to be emailed), it will need to use an SMTP Receive connector that does have a path to the Internet (for example, a local email server) as a relay. SMTP relay functions must be protected so third parties are not able to hijack a relay service for their own purposes. Most commonly, relay hijacking is done by spammers to disguise the source of their messages and may also be used to cover the source of more destructive attacks. Relays can be restricted in one of three ways: by blocking relays (restrict to a blank list of servers); by restricting use to lists of valid servers; or by restricting use to servers that can authenticate. Because authenticated connections are the most secure for SMTP Receive connectors, it is recommended that relays allow only servers that can authenticate. | ||||
| STIG | Date | |||
| Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide | 2024-12-06 | |||
Related Frameworks
1 mapping across 3 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
CCI1 mapping
CCI-001308
1.00
- DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
Details
Check Text (C-221245r961161_chk)
Open the Exchange Management Shell and enter the following command:
Get-ReceiveConnector | Select Name, Identity, PermissionGroups
For each Receive connector, if the value of "PermissionGroups" is "AnonymousUsers" for any non-Internet connector, this is a finding.
Fix Text (F-22949r411862_fix)
Open the Exchange Management Shell and enter the following command:
Set-ReceiveConnector -Identity <'IdentityName'> -PermissionGroups 'valid user group(s)'
Note: The <IdentityName> value and user group(s) must be in single quotes.
Example for user groups only: 'ExchangeServers, ExchangeUsers'
Repeat the procedures for each Receive connector.
This is an Example only: Set-ReceiveConnector -Identity <'IdentityName'> -PermissionGroups 'ExchangeUsers'