Resolving IIS WMSVC Underlying Connection Was Closed

 IIS, Windows Server 2008, Windows Server 2012  Comments Off on Resolving IIS WMSVC Underlying Connection Was Closed
Dec 082018
 

IIS Manager Remote Administration is a handy tool for for a web server administrator when you have multiple servers to manage. This feature will save you the trouble of having to Remote Desktop into each server every time you need to touch IIS. With IIS Manager Remote Administration you can login to one server for example and then configure IIS Manager with connections to other servers that you manage.  Or depending on the security of your enterprise you could even configure IIS Manager on your workstation and connect to the other servers from there. This becomes especially helpful if your enterprise has extra layers of security such as two factor authentication to lock down Remote Desktop access.

 

The underlying connection was closed: An unexpected error occurred on a send

Usually it works great. However, sometimes you may encounter connection problems while attempting to connect to your other severs.  I recently experienced one such error as shown below. It was occurring at nearly the final step of the remote management wizard after authenticating with my admin credentials.   It indicated that The underlying connection was closed: An unexpected error occurred on a send.   I have used IIS Manager Remote Administration for many years and this was the first time I had ever seen this particular error.  I went through the usual trouble shooting steps of ensuring port 8172 wasn’t blocked at the local firewall on either end. So then I decided to try reproducing the error on some other servers that I support and sure enough each server had this same issue.

image

 

I work for a large corporation that follows the practice of Separation of Duties which simply means that several different departments are involved with installing, configuring, and deploying our Windows servers.  In my role as an IIS web server administrator I know that many hands have touched the servers that I manage before the server is ever released to my team.

Checking the Management Service Certificate

Another place I checked was the Management Service itself. From here I could see that the WMSVC certificate was correctly assigned.  I was beginning to feel a bit flummoxed at this point. Everything I had checked so far appeared to be configured correctly.

image

 

Checking Port 8172 Certificate Binding

At a loss for a clear explanation of why I was getting the error above I decided to check online to see if anyone else had ever experienced it.  Searching for the error online I saw a suggestion to check the certificate binding on port 8172 using NetshNetsh is a command line utility that allows one to modify or display numerous settings of a server’s network configuration. To check a server’s certificate bindings  you just execute the following command.

image

 

Scrolling through the output I arrived at the settings for port 8172 and I could see the Certificate Hash of the certificate being used for this port. Next I went back to IIS Manager to double check the certificates that were installed on the server.  In addition to the certificates of several applications hosted on the server I saw the WMSVC certificate.  This is the default certificate used to secure the remote management communication between servers.  At this point a light bulb went off in my head because I could clearly see the Certificate Hash of the WMSVC certificate was different than the Certificate Hash of the certificate bound to port 8172. In fact the certificate bound to port 8172 wasn’t even installed on the server.

image

 

Changing Port 8172 Certificate Binding

My conundrum was over. The next steps were pretty clear. I had to delete the existing certificate binding on port 8172 and then configure port 8172 to use the WMSC certificate. Here is the command to delete the existing binding for a port and IP address:

image

Here is the command to bind a new certificate to port 8172. Just replace XX below with the correct thumbrint of your certificate.

 

image

 

Back to the Remote Admin Wizard

After deleting the old certificate and configuring the correct one, I returned to the Remote Administration wizard and tried it again.

image

With the correct certificate configured on port 8172 I was finally able to complete the  Remote Administration wizard.

image

In Summary

IIS Manager Remote Administration is a handy tool for administrators to save time managing IIS without having to always use Remote Desktop to login to another server. If you have issues configuring remote management between servers be sure to double check the certificates that are installed as well as the bindings for port 8172 using Netsh commands. Thanks for reading!

Peter Viola

Creative, customer focused, results oriented, Senior Web Systems Engineer who enjoys providing the highest level of customer service supporting complex Windows hosting solutions. MCITP, MCSA, MCTS

More Posts - Website

Securing SmarterMail in 10 Steps

 Email  Comments Off on Securing SmarterMail in 10 Steps
Dec 012018
 

You may not be familiar with SmarterMail from Smatertools.com but it is an enterprise class Windows based mail server. It has a powerful web based management GUI and the company regularly releases version updates containing bug fixes and new features.  However, in my opinion one of the most compelling reasons to try SmarterMail is that they offer a full featured version free for one domain.

You may think configuring an enterprise mail server application could be a challenge but fortunately SmarterMail’s administration interface is organized in an intuitive way and the Smartermail Help manual is always available online. In this blog post I will cover a few key features that you want to configure to ensure your installation of SmarterMail is locked down. Some settings will depend on the volume of your mail server so adjust accordingly and double check often.

Change the admin password

If you’ve just installed SmarterMail the next step you will encounter after the install wizard completes is a prompt to set the admin password. Following Best Practices You should be changing it on a regular basis. This can be performed from the Settings menu by clicking on System Administrators as shown below.

image

However, there may come a time when you are not able to login to SmarterMail to change the admin password. To manually reset it without logging in you just need to edit mailconfig.xml which is usually located in C:\Program Files (x86)\SmarterTools\SmarterMail\Service. As noted within the file, you just need to delete the <sysAdminUserName> and <sysAdminPasswordHash> lines and then restart the SmarterMail service.

image

Change SMTP Relay and Authentication

On the Settings menu click on Protocol Settings and then click the SMTP In tab.  Only authenticated users should be allowed to relay mail. From the Allow Relay pulldown Select Nobody and then on the Require Auth Match pulldown menu select Email Address. Next in the options at the bottom of the list check the box Allow relay for authenticated users. These settings will only allow local accounts that have successfully authenticated to send mail off the server i.e relay and in order to authenticate the users are required to provide the complete email address. SmarterMail wisely recognizes how these settings could be cause issues and have highlighted a warning at the top of the page.

image

Limit IP Addresses and Ports

On the Settings menu select Bindings and then click on IP Addresses. Ensure other IP addresses on the server are not enabled for mail services.

image

Then click on each IP address and ensure only the necessary ports are enabled.

image

For even greater security you should also configure SSL / TLS for your services.

Internal Spammer Notification

This is a setting that ultimately depends on the volume of your mail server. It is located under the Security menu –> Advanced Settings –> Abuse Detection. This feature will send a notification to a designated mailbox when message volume exceeds a preset threshold. The recipient could be the mail admin or a group mailbox. Regardless who receives this notification they needs to be able to leap into action and potentially lock down an account that has been exploited and is sending spam.

image

Without the Internal Spammer Notification enabled you will have to rely on the System Summary – Message Traffic Report to quickly identify which domain on your mail server is sending spam. Change the date filter to today and depending on the usual message volume on your server it should be obvious which domain is sending the spam. Next click on the domain in question and then you’ll see which mailboxes within that domain have the highest message count. That is the mailbox that has been exploited.  You will need to temporarily reset the password of the mailbox in question to stop the spam from being sent.

image

Continuing with this example after resetting the password of the mailbox sending out the spam you’ll want to use a program such as GrepWin to purge the messages from the SmarterMail spool. If you don’t immediately delete that mail from the spool, SmarterMail continue to attempt to send it out which will most likely result in your mail sever being quickly being blacklisted.

image

Enable Greylisting

Greylisting is a great tool to leverage against spammers. It deliberately slows mail service by a preset amount of time using SMTP 4XX reply codes which tell the sender’s mail server to queue the message and try again shortly.  Legitimate SMTP servers sending mail will be whitelisted for a lengthy period of time and then will be able to deliver mail as usual without repeat delays.  SMTP servers used by Spammers that are not configured for 4XX queue timeouts will not reattempt to resend their junk mail there by preventing it from getting delivered. And even if spammers do configure their servers accommodate greylisting they will still most likely get blocked by Real-Time Blackhole Lists (RBL).

image

Configure Real-Time Blackhole Lists (RBL)

The Antispam Administration settings for SmarterMail are comprehensive. Many of these settings will need to tested and evaluated over time. The security settings are easy to reach from the navigation menu. The Spam Checks tab controls weighted numeric scores that are assigned to the incoming mail as it gets processed. The higher the numeric score the greater the likelihood that the message is spam. RBL servers are 3rd party resources that maintain extensive lists of mail server IP addresses where the servers in question have been identified as sending spam. RBL server checks should have a high weighted score so any IP address that is matched to an address already on an RBL is immediately blocked.

image

Configure Spam Filtering Thresholds

On Filtering tab of the Antispam Administration page you will adjust the Weight Threshold actions.  So in the example below a message with a total score of 5 is considered normal mail and will delivered into a users inbox. A message with score of 12-17 is probably spam but the user can still review it in their inbox’s Junk E-Mail folder. Anything over 17 should be deleted and not delivered to the users. These values are globally set for all mailboxes by default. However, you can allow users to change the weight thresholds for their own mail in their domain’s settings.  The other tabs on the Antispam Administration page are straight forward to configure.

image

SMTP Authentication Bypass

The SMTP Authentication Bypass settings should be used with caution and reviewed frequently. Adding an IP address to this list as the name implies will allow mail being sent from that IP to skip the authentication procedures configured above. One might do this for an internal web server so that sites hosted on that server can conveniently send mail outside the network. However, it can quickly lead to trouble because if any of the web sites happen to have poor design security a simple contact form could be leveraged for spamming. In this situation because the IP address the of web server hosting the site is present on this page the bypass rule will let the spam flow out unimpeded. This simple oversight could quickly cause your mail server to be blacklisted before anyone even realizes it.

Abuse Detection

As mentioned above the Abuse Detection settings are under the Security menu and then click on Advanced Settings. These are all threshold settings that will notify a system administrator when the specific metric has been exceeded. The settings will need to be modified based on the volume of your mail server.

image

Password Complexity

The SmarterMail mailbox Password Requirement rules are globally applied to all mailboxes on the server. Best Practices dictate that you should require all users to have complex passwords using mixed case and at least numbers if not special characters too.  As with many of the other settings these will need to be adjusted according to the number of mailboxes you have on your server. I have supported large enterprise deployments of SmarterMail with 4000+ mailboxes. If you are only managing a fraction of that size you may be able to have less stringent requirements. However, it’s always better to be more cautious than less cautious.

image

A handy complement to the Password Complexity requirements is the Password Policy Compliance report that can be accessed on the Manage menu. It identifies all the mailboxes on the server that do not meet the configured required settings. It is a helpful report that quickly shows which mailboxes need to be corrected.

image

In Summary

SmarterMail by Smatertools.com is an enterprise Windows mail server with a powerful administration interface. I have highlighted 10 areas that should be configured to ensure your SmarterMail server is locked down and secured minimizing the chances of mailboxes being exploited by spammers. Thanks for reading!

Peter Viola

Creative, customer focused, results oriented, Senior Web Systems Engineer who enjoys providing the highest level of customer service supporting complex Windows hosting solutions. MCITP, MCSA, MCTS

More Posts - Website