Saturday, February 25, 2006

Exchange tarpit options

Hi,

This is a useful little tip for those of you who enable Exchange to only accept messages to users in the directory. If this is done, it is possible for spammers to harvest your directory and thus get a list of all addresses which are real!

To prevent this see below:

When you turn on recipient filtering's "Filter recipients who are not in the directory," you also need to safeguard against a directory harvest attack once this is enabled. It is imperative to set the tar pit feature introduced prior to Exchange's 2003 SP1 (via hotfix) to any outside facing server. Configure the registry to use the tar pit feature. (Warning: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.)

To enable the tar pit feature, you must add the TarpitTime registry entry to the registry and then configure the delay time value. To do this, follow these steps:

(Note: If the TarpitTime registry entry does not exist, Exchange Server behaves as if the value of this registry entry were set to 0. When the TarpitTime registry entry has a value of 0, there is no delay when the SMTP address verification responses are sent.)

Click Start -> click Run -> type regedit in the Open box -> click OK.
Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\...
SMTPSVC\Parameters
On the Edit menu, point to New, and then click DWORD Value.
Type TarpitTime as the registry entry name, and then press ENTER.
On the Edit menu, click Modify.
Click Decimal.
In the Value data box, type the number of seconds that you want to delay SMTP address verification responses for each address that does not exist, and then click OK. (For example, type 5, and then click OK. This setting will delay SMTP address verification responses for five seconds.)
Quit Registry Editor.
Restart the computer.

0 Comments:

Post a Comment

Links to this post:

Create a Link

<< Home