Spammers using our server to send spam

[MDSha]

Dears,

We have Fortinet firewall and exchange 2010 environment with exchange oniline protection setup.

spammers connect to our exchange via telnet send spams,i can see lot of emails sent in protocol logging.

Users receive 1000s of non delivery reports.

Once i reset the password of the affected user ndr stops in some time, so it means users having weak passwords becoming target and still i can see in event viewer and protocol logging with authentication failure for password resetted users,

 How to stop attackers connecting to exchange server via telnet smtp.  In firewall HTTP, HTTPS, SMTP, SMTPS and IMAP is open for exchange servers, is it ok or i need to remove anything.

please look below telnet session log from smtp logging 

EHLO ylmf-pc,
>,250-mail.********* Hello [********],
>,250-SIZE,
>,250-PIPELINING,
>,250-DSN,
>,250-ENHANCEDSTATUSCODES,
>,250-STARTTLS,
>,250-AUTH NTLM,
>,250-8BITMIME,
>,250-BINARYMIME,
>,250 CHUNKING,
<,AUTH LOGIN,
*,Tarpit for '0.00:00:05',
>,504 5.7.4 Unrecognized authentication type,
,,

How to stop this attacks.. pls help

[Marco]

Hello

check your smtp policy (wan-to-lan). I think you have enabled NAT on this policy and allow the internal ip of the fortinet (or internal subnet?) to relay through your Exchange server? NAT isn't needed with 'Virtual IPs' in this case.

it's also a good idea to limit the smtp source in the policy. Only allow the exchange online protection servers to connect with smtp to your exchange. Look at: https://technet.microsoft.com/en-us/library/dn163583(v=exchg.150).aspx. Maybe you can use the 'Internet Service Database' from the FortiGate. Try the "Microsoft-SMTP(S)" entry.

[MichaelBazy]

Well my recommendation would be for you to get a FortiMail, and to use it to send and receive SMTP traffic rather that an unsecure "do-everything" windows. Essentially "do everything" includes too many things in terms of security.

If you don't have that luxury, maybe you need to consider who and from where exactly needs access to this exchange server.

When you have this information, then maybe you can consider create some specific IPS signatures to block messages spoofing your domain for users from outside the network.

Something else to consider : maybe you have an infected host that asks specifically your server to send some emails?

Good luck anyway.