Detections
Analytics

EX16-ED-000180 - Exchange Internet-facing Receive connectors must offer Transport Layer Security (TLS) before using basic authentication.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Sending unencrypted email over the Internet increases the risk that messages can be intercepted or altered. TLS is designed to protect confidentiality and data integrity by encrypting email messages between servers and thereby reducing the risk of eavesdropping, interception, and alteration. This setting forces Exchange to offer TLS before using basic authentication.

Solution

Open the Exchange Management Shell and enter the following command:

Set-ReceiveConnector -Identity <'IdentityName'> -AuthMechanism 'Tls, BasicAuth, BasicAuthRequireTLS'

Note: The <IdentityName> value must be in single quotes.

Example only for the Identity: <ServerName>\Frontend <ServerName>

Repeat the procedure for each receive connector.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Exchange_2016_Y22M07_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001184, Rule-ID|SV-221219r612603_rule, STIG-ID|EX16-ED-000180, STIG-Legacy|SV-95229, STIG-Legacy|V-80519, Vuln-ID|V-221219

Plugin: Windows

Control ID: 1eb131279cb41d241f1713a0260db95fb8e7a0f8cf73d54c39b13ca80631c994