Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 33 replies
  • Answers 3 answers
  • Subscribers 7 subscribers
  • Views 58408 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SMTP Authentication (Sophos as smtp relay to internal Exchange server)

The Bee

Hi,

 

we have Sophos as SMTP relay to our internal Exchange server. SMTP authentication is not yet enabled on the Exchange.

So the Sophos will relay the emails to the Exchange.

Right now is possible to send emails using SMTP port (25) from one or our domain's user accounts to any another of our domain's user accounts without authentication. Which is, of course to me, a very big security vulnerability. (I tested it with telnet from outside of our networks... like if I were an attacker).

 

So the questions are:

 

1) Right now (when SMTP authentication is not enabled in the Exchange server),  is there a way to stop that behavior?

 

2) Once we enable SMTP authentication in the Exchange server, the sophos will still be whitelisted as the Exchange server needs to "rely" on the Sophos. How can we stop that behavior then?

 

 



This thread was automatically locked due to age.
  • 0 in reply to The Bee

    Hi all

    If you use the logic of "Authenticated Users" and read about it , it should be easy

    If checked, users in the list can use UTM as smarthost directly, no need for exchange.

    If not checked, UTM will not allow emails from users but only from mail-servers

  • 0 in reply to The Bee

    Hey Bee.

    I just tested, and if you have a top level domain mapped to an IP address it will in fact disrupt DNS queries. So you do need to disable them ir order to have correct DNS resolution. A more elegant solution might be a local DNS server to which you can point those VPN clients to.

     Example:

     

    Regards,

    Giovani

  • 0 in reply to giomoda

    Hi Giovani,

     

    the problem is that for internal users I need a different IP assignment than for VPN users, I will just remove the "example.com" domain and leave "www.example.com", that will do it (and tell VPN users to hard code their host file..)

     

    Regards

Unfiltered HTML