問題﹗問題﹗問題﹗

sword

為什么我從事件日志里看到了如下內容﹕<br>
SMTP Authentication was performed successfully with client <font color="red">"wrewe". </font>The authentication method was "LOGIN" and the username was "HIGH-TEK\shuxia". <br>
SMTP Authentication was performed successfully with client <font color="red">"wrewe". </font>The authentication method was "LOGIN" and the username was "HIGH-TEK\miao". <br>
SMTP Authentication was performed successfully with client <font color="red">"wrewe". </font>The authentication method was "LOGIN" and the username was "HIGH-TEK\knight". <br>
SMTP Authentication was performed successfully with client <font color="red">"microsof-9dlveu". </font> The authentication method was "LOGIN" and the username was "HIGH-TEK\knight". <br>
其中"wrewe". "wrewe". "microsof-9dlveu". 不是我公司內部的電腦﹐是不是我們被中繼了?但我把轉發功能關掉了的哦。

sword

我在scanmail的scan monitor里看到有很多的"message from administrator found at smtp router mailbox"的掃描記錄,不知是不是scanmail6.2的版本問題,因為我之前用6.1的時時候就會提示administrator發往外部郵箱的記錄,所以當我的服務器老往几個特定地址發送郵件時,我就很容易叛斷我的服務器在發送垃圾郵件,但我現在就發現不了.

lcc_lin

"HIGH-TEK\shuxia" ,HIGH-TEK\miao", "HIGH-TEK\knight","HIGH-TEK\knight". 这几个帐号的密码换换试试看...

sword

還是不可以﹐為什么我的exchange的安全性這么差?

good2000zc

1：更改所有用户密码，使用复杂强密码（11位以上，字母、数字、特殊字符组和，比如：chengyuanhai#59845）。这是关键。因为你的用户密码被人破解或猜中,使用你的被破解的用户名,就可以拿你的服务器做中继。教育你的用户保护好自己的密码。密码定期更改。<br>
2：安装NORTON FOR EXCHANGE 4.0以上版本.每天自动升级病毒定义码。<br>
3:安装所有系统补丁以及EXCHANGE牟苟　?br> 4：使用安全审核，记录分析帐号登录等事件，比如半夜还在登录的可疑帐号。自动锁定多次登录失败的帐号。<br>
5：查看SMTP的日志，拒绝可疑的IP地址。......<br>

sword

謝謝了﹗