10 + 1 Best Practises for Implementing an SMTP server

I will share with you some experiences from implementing a good SMTP engine to avoid being spammed, being categorized as spam etc. This article is product independent therefore if you run Exchange, Windows SMTP, ScanMail, Notes or whatever, this is something good to consider.

This guide specifically focuses on larger organizations, but of course, large/small is just a definition based on the number of users but you may apply them if you so wish.

1. Always put a dedicated SMTP box in a DMZ or internal network. SMTP is relatively a simple and fast protocol so it doesn't really require a super end machine. Have redundancy if needed by simply doing an internal DNS MX with weights without the need of expensive load balancing hardware. Or, if you run Windows, use NLB.

2. Put Anti-malware and Antispam scanning on both the SMTP gateway and your internal email server. Disable NDRs if possible. Do not cross scan between your host based antimalware engine and your protocol based antimalware engine. This can slow down it's performance tremendeously.

3. Register all your email servers that eventually send emails out with a reverse lookup DNS. Do not send emails out directly from internal email servers unless they are equally protected like your SMTP engine or using these tips.

4. All SMTP talkers (this could be your email server or even your client if they send emails out directly using the SMTP protocol) should use RFC1918 addresses not Live IPs for all internal hosts. This because all SMTP chatter will stamp addresses in their headers and if you use a non RFC1918 number, there's a chance the emails will get checked by your recipient's host email server and perform a reverse lookup and of course, you won't be the owner of that Live IP and you can be categorized as spam.

5. Place email send and receive limits. The last thing you need is an email server retrieving 100MB of attachments. There's always secure file shares for that.

6. Verify internal users sending email using your SMTP with your LDAP or similar. Some form of authentication is a good start. As for external users sending you emails, you cant authenticate ..too bad. If possible disable NDR for non-existent recipients. The NDR should be generated by the sender's email server, not yours!

7. Do not run SMTP engines/filtering on your firewall!. Firewalls do not need this unnecessary burden because your SMTP engine is suppose to clean up messages.

8. Do not use your internal mail server as your secondary MX, you are better of not having a secondary MX. Internal mail servers are where all the "juices" are, so if you get whacked, your data is at risk. Spammers have known this trick and sometimes send emails to secondary MX servers in hopes that there's no antispam/antimalware engine installed on them.

9. Create a SPF record on your DNS. Sender Privacy Framework is very easy to setup and can be implemented in mere minutes.

10. Disable relay on all email servers, both internal, external etc.

11. Test all your SMTP server's implementation by running auditing tools such as Nessus - SMTP/product TCP/IP based auditing, www.dnsreport.com - DNS configuration test, abuse.net/relay.html- relay test,

Any of those terms you don't know or want more info, you can write me or simply Google it up.

Happy hosting!

How to automatically disable/enable your proxy settings

Tired of turning off your proxy settings when outside the office? Well, yea, me too. For a long time now there's a simple and effective way to do this by using a PAC file or Proxy Automatic Configuration file. This PAC file is a simple text document stored inside your computer and is referred by your browser before connecting to the internet.

The PAC uses javascript language to simply do a IF and THEN and ELSE condition. Here's the script of my file i am using, its named proxy.pac

---code start:don't copy this line---

function FindProxyForURL(url, host)
{ if (isInNet(myIpAddress(), "10.10.0.0", "255.255.0.0"))
return "PROXY proxy.mcsb.com:8080";
else
return "DIRECT";
}

---code end:don't copy this line---

Now, create a file, say, proxy.pac using notepad.exe, copy the above code into the file you just created, then save it.

Next, you will have to "tell" your browser to use this auto configuraiton file. Here's how.

For Internet Explorer Only (will update how-to in Firefox soon, doesn't seem to work with it)
Go to Tools >> Interent Options >> Connections Click on LAN Connections, check the box, "Use automatic configuration script", then place this line into the empty box therein.

file://c:/proxy.pac

The above is true provided you are accessing this file from a local PC, you could also place this file into a server etc (web server).

Say OK several times to close the configuration screen. Now reload your Internet Explorer. So, if you are in your corporate network (mine is 10.10.0.0/255.255.0.0) it will use your corporate proxy (mine is proxy.mcsb.com).

So, here are the variables you MUST change to correspond to your own network:

Network: 10.10.0.0 (change to your network)
Subnet Mask: 255.255.o.0 (change to your subnet)
Proxy: proxy.mcsb.com:8080 (change to your proxy IP or name like the example here, after the colon is the port of your proxy server, if it is port 80, you do not need to specify the colon or the port number)

The proxy.pac file can be a real huge monster to do things like high availability for proxy server, support multiple Networks (my example only support 1 network).

More information can be found at: http://en.wikipedia.org/wiki/Proxy_auto-config

Manage your AD - ADManagerPlus

ManageEngine has a product called ADManager plus. ADManager plus runs a self website and can run on your Windows based OS like XP, 2000(3). The free edition is limited to manage a single AD domain in a forest.

Here's the list of features

1. Delegate-able administration - You can give rights to your Help desk and Administrators separately
2. It has a dashboard view of users reports, system reports and other customized reports.
3. You can quickly search objects and edit them right from your browser.
4. Bulk user and group management and operations (e.g. create/edit bulk users etc)
5. Can manage certain Exchange related tasks and terminal services attributes.
6. Reporting - A list of predefined reports and customizable reports
   

This tool simplifies management of AD without the need to program scripts. It is secure and runs on any browser and it does not need to reside on your Domain Controller, just configure the connection and have rights to connect.

You can view the demo here: http://demo.admanagerplus.com or download free or trials at http://www.admanagerplus.com

Happy administrating :)

SHA-1 Is Now Crack-able

Cracking MD5 (Message Digest 5) and now, SHA-1 (Secure Hashing Algorithm), she and her team are a bunch of geniuses. They managed to crack the widely used SHA1 hashing algorithm which supposedly, succeeded MD5 after being scrambled by the same Chinese Associate Prof. Wang Xiaoyun of Tshinghua University and Shangdong University of Technology.

This lines up a series of questions i guess about your current implementation, and of course, what's next. Big software companies should take this seriously. It will be in no time that the reverse engineering techniques are available publicly, till then, scramble for another scrambler.

Source article: http://en.epochtimes.com/tools/printer.asp?id=50336

If you use Windows 2000 DNS (for Active Directory ..etc) use only Secure Updates

Windows 2000 and later gives you the option to configure your DNS as Active Directory Integrated Zone (ADIZ). This mode is required for name and service automatic update and its super crucial to a successful Active Directory (and some of other MS products like Exchange) implementation.

When enabled in this mode, clients or servers can send an update request DNS packet to the DNS service in Windows and this will be updated inside the DNS service or name records.

However, administrators and implementors, do remember that you should enable secure updates only in the automatic update configuration. Why? Cause otherwise, it's very easy to send a change DNS record update packet and change, for instance, the web address of an internal or external (if you configure split headed dns) host and redirect requests to a malicious site.

An example would be to change proxy.company.com to your PC IP!!!. Users are challenged and they provide user name and password pair. Unknowingly, they have successfully submitted these credentials to your internal password repository. There's only the mind that can limit what other crazy stuff you can do with these type of attack.

So, please enable secure updates only in your DNS automatic update settings.

DNSFUN source: http://securitydot.net/xpl/exploits/vulnerabilities/articles/1578/exploit.html

Google Analytics

Google Analytics is a cool free Site Tracking tool from, oh, you guessed it, Google. I use it for my blog sites (this) and other sites that i help manage. The best thing of it is that its free. You would need of course a Google account (e.g. Gmail) to start with.

Try it out: www.google.com/analytics


It works by embedding a tag inside your website pages. Just add these few lines of codes and start to gather interesting information about your visitors. It can produce custom or built-in reports in charts and exportable in XML, Excel etc. Select a range of dates in which you would like to generate these reports and its immediately updated in your browser.

You could also add profiles to administer and generate reports, setup goals to your website.

Large organizations to small people like me, use this tool for fun or to generate useful information about trends and make informed decisions about your website and future developments.

Malaysian DVD Pirates Out To Kill Sniffer Dogs?

Funny article. Apparently, some bad-ass Malaysian DVD pirate ring wants to hunt down and kill 2 dogs, Lucky and Flo, apparently, sniffed out their stash of DVDs and caused those pirates RM3mil in losses. As its media worth, Malaysian govt will now beef up security around the two hounds.

My 2cents worth about piracy: Well, for movies, its good to have pirates, cause you get to "preview" entire movies. But, folks, come on, if you like it, buy original la...

Also, i think pirated DVD makers will face another, and even more furious problems, and that's Bitorrent. With the release of Wimax licenses and growing internet facilities, people are gonna' download movies and stuff right out of their Bitorrent client, for free!!

I hope those DVD pirates don't go after Bram Cohen now..

Source: CNET , Malaysian Wimax License

RSA into AntiTrojan

RSA, famous for its authentication and encryption techniques recently announced a service to protect users from trojans. Called RSAFraudaction, is a service, an end-to-end solution that covers the identification, analysis, blocking, and shutdown of attacks.

RSA will get my vote in their offerings. They have far been quite an authority when it comes to certain aspects in security but only time and trojans will tell...

Would like to check it out more and if there's anything worth the effort, it will be posted :)

Link: http://www.rsa.com/press_release.aspx?id=7922

Convert stuff for free at Zamzar

Was given this site http://www.zamzar.com. It has the facility to convert stuff like movies, document, images and audio straight from your browser to your email. For free, for real!.

Did try to convert a MOV (Apple Quicktime) and it did quite a wonderful job.

What's even more cool, it can skin Youtube out of its shell and have the video posted into your email. More online video sites supported too.

Check it out and give us a review here.

PS> Erm, one note of caution, i am not too sure of any possible privacy concerns, therefore, i would not use the facilities for confidential and private materials. Perhaps you should read their privacy statement here.

Windows 2003 Service Pack 2 (and XP Pro 64bit) Released

Without much notice, publicity, hue and cry, Microsoft released Service Pack 2 for Windows 2003. This release introduces significant collection of patches and a couple of new features to the operating system.

From experience, upgrading SP1 of Windows 2003 a while back broke a lot of things including 3rd part applications, so, make you do your homeworks and test in non-production environments before deploying SP2. Please also disable Automatic Updates for SP2 if you wish to do testing first and if Automatic Updates are turned on in your production machines. There's a toolkit available to do this here.


W2K3 SP2: http://www.microsoft.com/technet/windowsserver/sp2.mspx.