<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
The changes to on-campus SMTP outlined earlier this week (see original message below) have been scheduled for
<b>Fri Sep 01 at 1900 PDT</b>.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
If you have any services that connect to the on-campus SMTP servers (e.g., smtp.ucr.edu) that are not in GCP or AWS and have not already notified me with this information, please reply to this email as soon as possible. </div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
If you have any questions regarding these changes, feel free to contact me directly.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Thank you.</div>
<div class="elementToProof">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div></div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);">
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0"></p>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">---</span><br>
<span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Jonathan Ocab |
</span><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt"><a href="mailto:jonathan.ocab@ucr.edu" target="_blank" rel="noopener noreferrer" id="OWAd3a316c5-bbd3-8359-e01f-f056c5b64f2d" class="OWAAutoLink">jonathan.ocab@ucr.edu</a></span></div>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Manager, Information Security Operations</span><br>
<span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Information Security Office</span><br>
</div>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">University of California, Riverside</span></div>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt"><br>
</span></div>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt"><br>
</span></div>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt"><br>
</span></div>
<p style="margin-top:0px; margin-bottom:0px"></p>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Jonathan L Ocab<br>
<b>Sent:</b> Tuesday, August 15, 2023 12:54<br>
<b>To:</b> citl@lists.ucr.edu <citl@lists.ucr.edu><br>
<b>Subject:</b> On-Campus SMTP-AUTH Restrictions</font>
<div> </div>
</div>
<div dir="ltr">
<div class="x_elementToProof x_ContentPasted0" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span class="x_ContentPasted2" style="display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">A few weeks ago, an email with subject line "Removal of SMTP authentication exemption for VPN users" was sent to CITL, announcing the
intent to remove the Exempt-from-SMTP-AUTH rule for campus VPN networks.</span></div>
<div class="x_elementToProof x_ContentPasted0" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="x_elementToProof x_ContentPasted0" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This yet-to-be-executed change has been pulled and modified with expanded scope.</div>
<div class="x_elementToProof x_ContentPasted0" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="x_elementToProof x_ContentPasted0" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The ISO will be requesting ITS Infrastructure make the following changes for the on-campus UCR SMTP servers (smtp.ucr.edu) within the next few weeks:<br>
</div>
<div class="x_elementToProof x_ContentPasted0" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<ol data-editing-info="{"orderedStyleType":1,"unorderedStyleType":1}" data-listchain="__List_Chain_201">
<li style="list-style-type:"1. ""><span>Block all off-campus SMTP-AUTH access, except for explicitly allowed domains (e.g., Google, Outlook, AWS, GCP, etc.)</span></li><li style="list-style-type:"2. ""><span>Block all campus VPN SMTP-AUTH access</span></li></ol>
<div>The first change will affect anyone who is using legacy methods of sending email using their UCR account from home or any other remote location. These users will need to use the O365 or Google Mail SMTP servers, respectively, per established and documented
procedures by UCR ITS and/or O365 or Google. </div>
<div><br>
</div>
<div>Based on historical data, we have identified system/service email from various SaaS solutions, and these will be placed on the allowed list. Also, approximately 15 unique NetIDs have been identified as making an SMTP-AUTH from a remote IP that is not on
an expected domain (e.g., Google). ITS will be reaching out to the identified users to inform them of this change and provide assistance to reconfigure their email clients as applicable.</div>
<div><br>
</div>
<div>The second change above will prevent anyone on the campus VPN from using the on-campus SMTP servers to send mail, with or without authentication. Users on the VPN will need to reconfigure their email clients to use the appropriate SaaS email servers.</div>
<div><br>
</div>
<div>The changes outlined will NOT affect on-campus, non-VPN access to the on-campus SMTP servers.</div>
<div><br>
</div>
<div>These changes are prompted by a need to mitigate misuse of our SMTP servers by external threat actors who have been using the UCR on-campus SMTP servers to attack the UCR community as well as several universities nationwide and internationally. Furthermore,
this change will emphasize the best practice of using the applicable SaaS email platforms (Google Mail / R'Mail or O365) in the supported manners.</div>
<div><br>
</div>
<div>If there are any questions or concerns, send them directly to me. If you have any specific exemptions that you want to ensure are added, you may also send those to me, and I will relay those to the ITS Infrastructure team.</div>
</div>
<div class="x_elementToProof">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_Signature">
<div>
<div></div>
<div></div>
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);">
<p style="margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0">
</p>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">---</span><br>
<span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Jonathan Ocab |
</span><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt"><a href="mailto:jonathan.ocab@ucr.edu" data-loopstyle="linkonly" id="OWA4d2b0067-1125-0201-d8a3-482adec9b0bd" class="x_OWAAutoLink">jonathan.ocab@ucr.edu</a></span></div>
<div><span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Manager, Information Security Operations</span><br>
<span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">Information Security Office</span><br>
<span style="font-family:"Lucida Console",Monaco,monospace; font-size:10pt">University of California, Riverside</span></div>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px">
</p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>