SMTP AUTH RSS Back to forum
2
@ken:
The username is logged only if you have Verbose log mode enabled:
1. Start the Administration Tool and connect to the local or remote ORF instance.
2. Navigate to the System / Log page using the left-side navigation pane.
3. Switch the log from Short mode to Verbose (Log Mode).
4. Save your settings to apply the changes (Ctrl+S).
ORF 5.1, Exchange 2003 on SBS 2003
according to this page; http://vamsoft.com/support/docs/articles/smtp-auth-relay-attacks
ORF logs the authenticated user on Exchange 2003. I can't seem to find where this is logged. Any tips?
Here is one of the thousands of messages that was authenticated and relayed through our server.
-------------------------------------------------------------------------------
-- EVENT SUMMARY --
Time: 10/30/2013 10:13:53 AM GMT-0400 Eastern Daylight Time
Sender Email:
Recipient Emails:
Related IP: 209.239.228.34
Action: (not available)
Email Subject: Your Unclaimed Funds
-- EVENT MESSAGE --
Authenticated session.
-- EVENT DETAILS --
Filtering Point: On Arrival
Event Class: Whitelist
Severity: Information
Server: buzz.bernard-merrill.com
Event Source: SMTPSVC-1
HELO Domain: (not available)
Message ID: <>
Log Mode: Short
ORF Version: 5.1 REGISTERED
-------------------------------------------------------------------------------