SMTP AUTH - ORF Forums

SMTP AUTH RSS Back to forum

1

ORF 5.1, Exchange 2003 on SBS 2003

according to this page; http://vamsoft.com/support/docs/articles/smtp-auth-relay-attacks
ORF logs the authenticated user on Exchange 2003. I can't seem to find where this is logged. Any tips?

Here is one of the thousands of messages that was authenticated and relayed through our server.
-------------------------------------------------------------------------------

-- EVENT SUMMARY --
Time: 10/30/2013 10:13:53 AM GMT-0400 Eastern Daylight Time
Sender Email:
Recipient Emails:



Related IP: 209.239.228.34
Action: (not available)
Email Subject: Your Unclaimed Funds

-- EVENT MESSAGE --
Authenticated session.

-- EVENT DETAILS --
Filtering Point: On Arrival
Event Class: Whitelist
Severity: Information
Server: buzz.bernard-merrill.com
Event Source: SMTPSVC-1
HELO Domain: (not available)
Message ID:
Log Mode: Short
ORF Version: 5.1 REGISTERED

-------------------------------------------------------------------------------

by ken 5 years ago
2

@ken: The username is logged only if you have Verbose log mode enabled:

1. Start the Administration Tool and connect to the local or remote ORF instance.
2. Navigate to the System / Log page using the left-side navigation pane.
3. Switch the log from Short mode to Verbose (Log Mode).
4. Save your settings to apply the changes (Ctrl+S).

by Krisztián Fekete (Vamsoft) 5 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2