Title

SMTP Virtual Server Auditing is not active. (Cat II impact)

Discussion

Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. This setting controls the creation and format of log files used to monitor the interaction between this SMTP Virtual Server and other SMTP hosts.

Check Content

Ensure that SMTP Virtual Server Auditing is active. Procedure: Exchange System Manger >> Administrative Groups >> [administrative group}>> Servers >> [server] >> Protocols >> SMTP >> [specific SMTP server] >> properties >> General tab The “Enable Logging” checkbox should be checked. Criteria: If the “Enable Logging” checkbox is checked, this is not a finding.

Fix Text

Configure SMTP Virtual Server auditing. Procedure: Exchange System Manger >> Administrative Groups >> [administrative group}>> Servers >> [server] >> Protocols >> SMTP >> [specific SMTP server] >> properties >> General tab Select the “Enable Logging” checkbox.

Additional Identifiers

Rule ID: SV-20470r1_rule

Vulnerability ID: V-18770

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.