I've got Authenticated relaying enabled. Any IP I put in Block hosts still gets through and I get warning mails about failed authentication. What to do?
Is anyone else using backend auth and experiencing Active Directory account lockouts as a result?
Not strictly related to the topic, but my opinion is that using AD recipient verification for SMTP on UTM is not a good idea.
Even a small break in network communication between UTM and DC can lead to denied email message to the sender, not to mention greater outages where SMTP as a protocol is very flexible (Retry) if no AUTH is involved.
EDIT: With callout is not supported by Microsoft Exchange without third party software.
The final nail in the coffin is that SMTP Auth must happen before the AD group membership lookup. I had set Relaying to be allowed only for folks in a "mailuser" group. There was one user in particular whose account kept getting locked so I removed her from the group, and then it got locked again anyway.
The reason I had gone with SMTP relay in the first place was because I was having trouble setting up the UTM to proxy Exchange-type connections (autodiscover, offline address book, outlook web access). I've got it working now, though not perfectly, so I plan to have mobile phone users reconfigure their settings. Once done I will disable SMTP relay ASAP.
Guys, I set up a DNAT on 9.310 to route traffic directly to a mail server. The traffic went via the DNAT and was not seen by the SMTP Proxy. Here's the top of the headers on an email I sent to myself from my gmail account:
Received: from mail-oi0-f46.google.com ([209.85.218.46]) by ourdomain.com with Microsoft SMTPSVC(6.0.3790.4675);
doing some more tests on that blackhole dnat topic cause my site (with relay smtp auth needed) is permanently attacked..
dnat blackhole is running for me now, and the packets are not going into the smtp-proxy so no smtp auth is initiated.. (so no more dictionary attack)
what i did:
nothing special, 3 dnat rules (for our 3 public IPs) no automatic firewall ruie in the dnats, a firewall rule at first position which fetches the natted blackhole traffic and drops it.
it works now.. no more failed logins in user authentication daemon.. so no more packets to the smtp-proxy from the unwanted hosts
and in firewall log the nat rule and the packet filter rule appears which drops packet :-)
@Bob i need that cause of the needs of a ceo... complicated to explain.. wanna mail with all his equipment without the need of establish vpn tunnel or doing "complicated" things before... you know.. old man no plan from anything, special security holes, but all must work... to get that all together an smtp user auth was the last chance to get it working..
Thank you so much sir schieren for the steps you gave, a dnat rule for our public ip, no automatic firewall rule in the dnat, a firewall rule at first position which fetches the natted blackhole traffic and drops it. Tried it using another ip and it prevented me from opening our web server. Again thanks!
