Exchange Internet-facing Receive connectors must offer Transport Layer Security (TLS) before using basic authentication.

From MS Exchange 2013 Edge Transport Server Security Technical Implementation Guide

Associated with: CCI-001184

SV-84439r1_rule Exchange Internet-facing Receive connectors must offer Transport Layer Security (TLS) before using basic authentication.

Vulnerability discussion

Sending unencrypted email over the Internet increases the risk that messages can be intercepted or altered. TLS is designed to protect confidentiality and data integrity by encrypting email messages between servers and thereby reducing the risk of eavesdropping, interception, and alteration. This setting forces Exchange to offer TLS before using basic authentication.

Check content

Open the Exchange Management Shell and enter the following command: Get-ReceiveConnector | Select Name, Identity, AuthMechanism For each Receive connector, if the value of AuthMechanism is not set to Tls, BasicAuth, BasicAuthRequireTLS, this is a finding.

Fix text

Open the Exchange Management Shell and enter the following command: Set-ReceiveConnector -Identity <'IdentityName'> -AuthMechanism 'Tls, BasicAuth, BasicAuthRequireTLS' Note: The value must be in quotes. Example only for the Identity: \Frontend Repeat the procedure for each Receive connector.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.