Title

E-mail user mailboxes do not have Storage Quota Limitations. (Cat III impact)

Discussion

E-mail system availability depends in part on best practices strategies for setting tuning configurations. These settings control the maximum sizes of a user’s mailbox and the system’s response if these limits are exceeded. Mailbox data that is not monitored against a quota increases the risk of mail loss due to filled disk space, which can also render the system unavailable. There are three controls, which supply graduated levels of opportunity to respond before risking data loss. The first control sends an E-mail warning to users stating that they have exceeded their mailbox quota. The second level sends the warning, and causes users to receive, but not send, mail. The third level sends a warning message, and causes users to neither receive nor send mail. Quota limits should be set as multiples of “Maximum Message Size” to ensure no level is skipped. As a practical matter, levels 1 and 2 serve the purpose of prompting users to manage their E-mail. Level 3 impedes users in their ability to work, and is not required as mail interruption is not acceptable. User Mailbox Quota limitations are not a substitute for overall disk space monitoring.

Check Content

First, make a note of the configured SMTP Virtual Server message size (example, the default is 10,240 KB). Exchange System Manager >> Administrative Groups >> [administrative group] >> Servers >> [server name] >> Protocols >> SMTP >> [Specific SMTP Virtual Server] >> Properties >> Messages Tab >>Limit message size to: (KB) Use the SMTP Virtual Server Message Size to configure the Mail Store Quota values. Progression of configured values should be 'equal to' or 'greater than' one message size value to prevent an alert being skipped due to one message. Procedure: Exchange System Manager >> administrative groups >> [administrative group] >> servers >> [server name] >> [storage group] >> Mailbox store [server name] >> properties >> Limits tab “Issue warning at (KB)” should be selected and have a value. “Prohibit send at (KB)” should be selected and have a value. "Prohibit send and receive at (KB)" should not be selected. Criteria: If “Issue warning at (KB)” and “Prohibit send at (KB)” are selected, and have assigned values, with "Prohibit send and receive at (KB)" not selected, this is not a finding.

Fix Text

Make a note of SMTP Virtual Server Message size limitation. Administrative Groups >> [administrative group] >> Servers >> [server name] >> Protocols >> SMTP ? [Specific SMTP Virtual Server] >> Properties >> Messages Tab >>Limit message size to: (KB) Use the message size value to configure Mail Store Quota values. Limits should be at least as big as SMTP message size. Procedure: Exchange System Manager >> Administrative Groups >> [administrative group] >> Servers >> [server name] >> [storage group] >> Mailbox store [server name] >> Properties >> Limits tab Select “Issue warning at (KB)” and enter a quota value. Select “Prohibit send at (KB)" and enter a quota value at least as large as "Issue warning at (KB) plus the value of SMTP Virtual Server message size. Do not Select "Prohibit send and Receive at (KB)" Note: Progression of configured actions should be equal to or greater than one message size to prevent an alert being skipped due to one message.

Additional Identifiers

Rule ID: SV-20218r1_rule

Vulnerability ID: V-18643

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.