Exchange podesavanje anti-spam i anti-malware agenta

I tako instalirao ja Exchange 2013, radilo sve super do nekog momenta I onda se pojavi moja IP adresa na nekoj crnoj listi J.

Gde god da sam gledao, navodno moj Exchange server salje spam poruke. I sta sad?

Evo kratkog uputstva sta treba uraditi nakon instaliranja I konfigurisanja exchange servera

Exchange ima integrisan anti-spam I anti-malware koji po defoltu nisu ukljuceni, tako da je prvo potrebno to ukljuciti ukoliko se ne koristi neka druga aplikacija.

Sve se radi u exchange shell-u

1.     Enejblovanje anti-spam: Install-AntiSpamAgents.ps1

Skripta koju je potrebno pokrenuti kroz exchange shell, na primer:

D:\ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1

Ukoliko prodje bez greske, to je to, potrebno je nakon instalacije restartovati Microsoft Exchange Transport Service I to se radi komandom

Restart-Service MSExchangeTransport

2.     Enejblovanje anti-malware: Update-MalwareFilteringServer.ps1

Isto skripta koja se pokrece kroz exchange shell

D:\ExchangeInstallPath\Scripts\Update-MalwareFilteringServer.ps1 -Identity mail.domain.co.rs

I nakon toga treba podesiti anti-malware policy

U svakom slucaju, ovo moze da se resi uz neka dodatna podesavanja I skriptom koja u mom slucaju izgleda ovako:

D:\ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1

Restart-Service MSExchangeTransport

D:\ExchangeInstallPath\Scripts\Update-MalwareFilteringServer.ps1 -Identity mail.domain.co.rs

Add-IPBlockListProvider -name bl.spamcop.net -lookupdomain bl.spamcop.net

Add-IPBlockListProvider -name zen.spamhaus.org -lookupdomain zen.spamhaus.org

Set-SenderIDConfig -SpoofedDomainAction Delete

Set-SenderReputationConfig -SenderBlockingEnabled $true -SrlBlockThreshold 6 -SenderBlockingPeriod 36

Set-SenderFilterConfig -BlankSenderBlockingEnabled $true

Set-ContentFilterConfig -SCLQuarantineThreshold 6

Set-ContentFilterConfig -SCLDeleteEnabled $true

Set-ContentFilterConfig -SCLQuarantineEnabled $true -QuarantineMailbox nikola.batinica@domain.co.rs

Set-ContentFilterConfig -SCLRejectEnabled $false

Skripta instalira anti-spam agent, restartuje servis I onda instalira anti-malware agent. Nakon toga skripta dodaje provajdere crne liste, ja sam izabrao spamcop I spamhaus. Nakon toga zabranjuje slanje mejlova koji u sebi ne sadrze from polje I na kraju podesava karantin, koji je u ovom slucaju moj mailbox tako da cu znati ukoliko neko salje spam poruke.

Nakon svega toga, pojavio se drugi problem J a to je da sam konstantno dobijao poruke

Delivery of this message to the following recipients or groups is quarantined:
HealthMailboxb194110f43af4e40bab197217e78e76c@domain.co.rs
Subject: Inbound proxy probe
Diagnostic information for administrators:
Generating server: mail.domain.co.rs

 Kad sam pokusao da izvrsim komandu

Get-Mailbox -Monitoring | Get-MailboxStatistics | ft DisplayName,ItemCount,LastLogonTime

Dobio sam izuzetnu kolicinu crvenih redova

WARNING: The object corp.jeanedwards.com/Microsoft Exchange System Objects/Monitoring

Mailboxes/HealthMailbox5080fe21fac14746b352d7de663fdcf9 has been corrupted, and it's in an inconsistent state. The following validation errors happened:

Ovaj problem moze da se resi tako sto ce se u ADSI Edit obrisati mailbox-ovi za sve Health koji imaju problem, ja sam obrisao sve J ali prilikom restartovanja servisa kreirana su tri nova healthmailbox-a I nakon toga sve radi ok.

Ukoliko treba da neku mejl adresu pustite iako se nalazi na blacklist, to se moze uraditi

$list = (Get-ContentFilterConfig).BypassedSenders

$list.add("mail@domain.com")

Set-ContentFilterConfig -BypassedSenders $list