← Back to Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide

V-259595

CAT II (Medium)

Exchange internet-facing receive connectors must offer Transport Layer Security (TLS) before using basic authentication.

Rule ID

SV-259595r1043178_rule

STIG

Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide

Version

V2R2

CCIs

CCI-001184

Discussion

Sending unencrypted email over the internet increases the risk that messages can be intercepted or altered. TLS is designed to protect confidentiality and data integrity by encrypting email messages between servers and thereby reducing the risk of eavesdropping, interception, and alteration. This setting forces Exchange to offer TLS before using basic authentication.

Check Content

Note: This is not applicable for SIPR enclaves.

Open the Exchange Management Shell and enter the following command:

Get-ReceiveConnector | Select-Object -Property Name, Identity, AuthMechanism

For each receive connector, if the value of "AuthMechanism" is not set to "Tls, BasicAuth, BasicAuthRequireTLS", this is a finding.

Fix Text

Open the Exchange Management Shell and enter the following command:

Set-ReceiveConnector -Identity <'IdentityName'> -AuthMechanism 'Tls, BasicAuth, BasicAuthRequireTLS'

Note: The <IdentityName> value must be in quotes.

Example only for the Identity: <ServerName>\Frontend <ServerName>

Repeat the procedure for each receive connector.