HIDS 3302
| Rule 3301 | |
|---|---|
| Status | Active |
| Alert Message | Attempt to use mail server as relay (client host rejected). |
Contents |
Description
ASL does not cause this event and does not cause any blocks associated with this event. ASL simply reports when your mail server blocks an attempt because your mailserver has been configured to block it. ASL has no control over your mail server.
This rule reports when your systems mail server has rejected a connection request because the mailservers access list has been configured to block it.
ASL does not control or configure this behavior in your mail server, it merely reports when this occurs. Therefore, if your mail server is rejecting mail from one of your users you will need to configure your mail server to access from the user. Please contact your mail server vendor for assistance with configuring your mail server to do this.
Disabling this rule will not allow your users to access your mail serber. It will simply "silence" the alert in ASL, however the mail will still be rejected by your mail server.
Troubleshooting
False Positives
None.
Tuning Guidance
If you wish to block these connections, just enable Active Response in the ASL rule manager for this rule.
Additional Information
Similar Rules
None.
Knowledge Base Articles
None.
Outside References
None.
