Hi, I just setup a SMTP virtual server which is meant to forward any emails
to a external Smart Host. The IIS apps is suppose to use CDONTS to send the
email.

The server was hardened before by a former colleague, but I still proceed to
do a quick test to check out if the server is able to send a simple SMTP
email to our domain. After running a simple ASP script which is meant to sen
d
a simple SMTP email, I hit this error : "Page could not be found". The
sending of the email just failed.

Using the same script, I test it into a test IIS 5.0 server, it is able to
send without any problem. I was wondering if there is any security hardening
technique that can prevent us from sending SMTP emails using CDONTS?

Appreciate any help.

Thanks.

[ Post a follow-up to this message ]

Hello,

"Page could not be found" means that the page could not be found. This means
that it did not even get to the SMTP server, and the problem cannot be SMTP.

Is URLScan or other security tools installed on this server? Is it possible
that the asp extension is blocked?

--
Regards,
Kristofer Gafvert
http://www.ilopia.com


"Philip Wang" <Philip Wang@discussions.microsoft.com> wrote in message
news:04A7748D-4886-4395-8008-042CDD9EE1B0@microsoft.com...
> Hi, I just setup a SMTP virtual server which is meant to forward any
emails
> to a external Smart Host. The IIS apps is suppose to use CDONTS to send
the
> email.
>
> The server was hardened before by a former colleague, but I still proceed
to
> do a quick test to check out if the server is able to send a simple SMTP
> email to our domain. After running a simple ASP script which is meant to
send
> a simple SMTP email, I hit this error : "Page could not be found". The
> sending of the email just failed.
>
> Using the same script, I test it into a test IIS 5.0 server, it is able to
> send without any problem. I was wondering if there is any security
hardening
> technique that can prevent us from sending SMTP emails using CDONTS?
>
> Appreciate any help.
>
> Thanks.

[ Post a follow-up to this message ]

Hi Gafvert,

Yes. IISLockdown was previously used to tighten the security of this IIS
server as well. I have uninstalled URLScan and rerun IISLockdown to restore
back the meta data, previous configurations, etc. But the problem still
occurs. Since then I have not installed IISLockdown on this server.

On the test server, I tried to run the IISLockdown and realise that if I
remove WebDav, I will also experience the same "Page cannot be found error".

You mentioned about ASP extension is blocked, but I am still able to run
some ASP web based applications developed by my vendor on the server.. is
there anyway to check if ASP is still blocked? could there be something else
?

Thanks.

"Kristofer Gafvert" wrote:

> Hello,
>
> "Page could not be found" means that the page could not be found. This mea
ns
> that it did not even get to the SMTP server, and the problem cannot be SMT
P.
>
> Is URLScan or other security tools installed on this server? Is it possibl
e
> that the asp extension is blocked?
>
> --
> Regards,
> Kristofer Gafvert
> http://www.ilopia.com
>
>
> "Philip Wang" <Philip Wang@discussions.microsoft.com> wrote in message
> news:04A7748D-4886-4395-8008-042CDD9EE1B0@microsoft.com... 
> emails 
> the 
> to 
> send 
> hardening 
>
>
>

[ Post a follow-up to this message ]

It doesn't seem like asp extensions are blocked in your case. What is the
file name that generates "Page cannot be found"? Maybe it has another
extension. It is possible to have a page that posts to another page, and
this other page do the actual email handling.

Can you please also disable "Show Friednly HTTP Errors" in your browser.

--
Regards,
Kristofer Gafvert
http://www.ilopia.com


"Philip Wang" <PhilipWang@discussions.microsoft.com> wrote in message
news:A671E637-7F7D-4C6B-9C3E-D1866013B6A1@microsoft.com...
> Hi Gafvert,
>
> Yes. IISLockdown was previously used to tighten the security of this IIS
> server as well. I have uninstalled URLScan and rerun IISLockdown to
restore
> back the meta data, previous configurations, etc. But the problem still
> occurs. Since then I have not installed IISLockdown on this server.
>
> On the test server, I tried to run the IISLockdown and realise that if I
> remove WebDav, I will also experience the same "Page cannot be found
error".
>
> You mentioned about ASP extension is blocked, but I am still able to run
> some ASP web based applications developed by my vendor on the server.. is
> there anyway to check if ASP is still blocked? could there be something
else?[vbcol=seagreen]
>
> Thanks.
>
> "Kristofer Gafvert" wrote:
> 
means[vbcol=seagreen] 
SMTP.[vbcol=seagreen] 
possible[vbcol=seagreen] 
send[vbcol=seagreen] 
proceed[vbcol=seagreen] 
SMTP[vbcol=seagreen] 
to[vbcol=seagreen] 
able to[vbcol=seagreen] 

[ Post a follow-up to this message ]

On Mon, 18 Oct 2004 08:39:05 -0700, "Philip Wang"
<PhilipWang@discussions.microsoft.com> wrote:
[vbcol=seagreen]
>Hi Gafvert,
>
>Yes. IISLockdown was previously used to tighten the security of this IIS
>server as well. I have uninstalled URLScan and rerun IISLockdown to restore
>back the meta data, previous configurations, etc. But the problem still
>occurs. Since then I have not installed IISLockdown on this server.
>
>On the test server, I tried to run the IISLockdown and realise that if I
>remove WebDav, I will also experience the same "Page cannot be found error"
.
>
>You mentioned about ASP extension is blocked, but I am still able to run
>some ASP web based applications developed by my vendor on the server.. is
>there anyway to check if ASP is still blocked? could there be something else?[/vbco
l]

If ASP is working for some, then it works for all.  Though the Page
Not Found could be an issue with the code in the page, the location of
the page, or simply the response page *after* the mail is sent, so I'm
not sure it really means your problem is there.  You'll need to look
at the IIS logs to see what specific page wasn't found.

There are many things that can be wrong, but to verify your SMTP
settings see:

HOW TO: Test Windows 2000 IIS SMTP Services Manually
http://support.microsoft.com/defaul...kb;en-us;286421

For other errors, you'll need to debug the code.  Try posting the code
to an ASP group for help there.

Jeff
[vbcol=seagreen]
>"Kristofer Gafvert" wrote:
> 

[ Post a follow-up to this message ]

Hi Jeff & Gafvert,

Thanks. Something interesting: Using CDO ASP script does send out SMTP email
s!

I managed to solve the problem after a long day of testing.

Apparently, there are 4 components that impacted the SMTP and IIS :
1) IISLockdown
2) URLScan Tool
3) WebDav in IISLockDown
4) IIS SSI #Exec

If you enable any of the above to harden your server, you will hit the error
message in IIS when you try to run a CDONTS ASP script : Page cannot be
displayed. HTTP 500 Server error.

I have removed the hardening of IIS and will be doing a cautious hardening
again to ensure that it will cause anymore of this CDONTS SMTP issue.

Thanks so much for your advise.

"Kristofer Gafvert" wrote:

> It doesn't seem like asp extensions are blocked in your case. What is the
> file name that generates "Page cannot be found"? Maybe it has another
> extension. It is possible to have a page that posts to another page, and
> this other page do the actual email handling.
>
> Can you please also disable "Show Friednly HTTP Errors" in your browser.
>
> --
> Regards,
> Kristofer Gafvert
> http://www.ilopia.com
>
>
> "Philip Wang" <PhilipWang@discussions.microsoft.com> wrote in message
> news:A671E637-7F7D-4C6B-9C3E-D1866013B6A1@microsoft.com... 
> restore 
> error". 
> else? 
> means 
> SMTP. 
> possible 
> send 
> proceed 
> SMTP 
> to 
> able to 
>
>
>

[ Post a follow-up to this message ]

On Tue, 19 Oct 2004 01:11:02 -0700, "Philip Wang"
<PhilipWang@discussions.microsoft.com> wrote:

>Hi Jeff & Gafvert,
>
>Thanks. Something interesting: Using CDO ASP script does send out SMTP emai
ls!
>
>I managed to solve the problem after a long day of testing.
>
>Apparently, there are 4 components that impacted the SMTP and IIS :
>1) IISLockdown
>2) URLScan Tool
>3) WebDav in IISLockDown
>4) IIS SSI #Exec

None of those will affect SMTP (URLScan isn't related to SMTP) and
these all point to your code being at issue or blocked.  Which is why
new code worked.

>If you enable any of the above to harden your server, you will hit the erro
r
>message in IIS when you try to run a CDONTS ASP script : Page cannot be
>displayed. HTTP 500 Server error.

Might help to tell us an Error 500 next time.  And see:

Why do I get a 500 Internal Server error for all ASP errors?
http://www.aspfaq.com/show.asp?id=2109

>I have removed the hardening of IIS and will be doing a cautious hardening
>again to ensure that it will cause anymore of this CDONTS SMTP issue.

Don't go back to CDONTS.  It's deprecated and you really want to use
CDO.SYS, which you had working anyway.

Jeff

[vbcol=seagreen]
>Thanks so much for your advise.
>
>"Kristofer Gafvert" wrote:
> 

[ Post a follow-up to this message ]