Title

The SMTP connectors do not specify use of a “Smart Host”. (Cat II impact)

Discussion

E-mail system availability depends in part on best practices strategies for setting tuning configurations. In the case of identifying a ‘Smart Host’ for the E-Mail environment, the connector level is the preferred location for this configuration because flow control in this routing group will be retained even if future changes occur at the virtual server level. A ‘Smart Host’ (Edge Transport Server) Role acts as an Internet Facing Concentrator for other E-mail servers. Appropriate hardening can be applied to the Edge Transport Server (E-Mail Secure Gateway) role rather than at multiple locations throughout the enterprise. The ‘Smart Host’ performs all Domain Name Service (DNS) lookups to determine mail routing and offers some proxy-type benefits. Failure to identify a ‘Smart Host’ could default to each E-mail server performing its own lookups (potentially through protective firewalls). Exchange 2003 servers should not be Internet facing, and should therefore not perform any ‘Smart Host’ functions. They must, however, be configured to identify the server that is performing the “Smart Host” function.

Check Content

Review the connector configuration. Procedure: Exchange System Manager>>Administrative Groups>> [Administrative Group]>>Routing Groups>> [routing group]>>Connectors>> [SMTP connector]>> >>Properties >> General tab>>Radio Group “Smart-Host” should be selected, and the "Smart Host" identified be an Edge Transport Role server (E-mail Secure Gateway). Criteria: If “Smart-Host” is selected, and the "Smart Host" named is the Edge Transport Role (E-mail Secure Gateway), this is not a finding.

Fix Text

Configure the “Smart-Host” on the SMTP connector. Procedure: Exchange System Manager>>Administrative Groups>> [Administrative Group]>>Routing Groups>> [routing group]>>Connectors>> [SMTP connector]>> >>Properties >> General tab>>Radio Group Select “Smart-Host” and specify the name of the E-mail Edge Transport Role Server (E-mail Secure Gateway) that performs the “Smart-Host” function.

Additional Identifiers

Rule ID: SV-20336r1_rule

Vulnerability ID: V-18698

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.