USA India
Home Articles UserTV Press Releases Dictionary Books Education Careers B-Channels Resources Forums Blogs Classifieds
Thursday 20 Nov, 2008 eNewsletter Register Login
Archives
Articles By Date
Articles By Category
 
 
 Archives >> Details
Put your e-mail server to good use
Posted by : Drew Robb

Nobody likes to think that Big Brother is watching them. But with spam, viruses, other security threats and internal espionage running rampant these days, companies had better do some monitoring of their e-mail systems or they face could face trouble ahead. This article discusses ways to minimize these issues to discover such things as:

• How to eliminate virus troubles such as those caused by SoBig
• What service providers have customers which are trying to use your server for spam?
• And who in the company is receiving the most email and who do they receive it from?

For the purposes of this article we will focus on the popular iMail Server by Ipswitch Inc. in conjunction with a plug-in tool called Logalot by Somix Technologies.

“iMail is an inexpensive tool and includes a number of valuable features such as good anti-spam filtering, anti-virus, calendaring and multi-language support,” said Michael Osterman, an analyst at Black Diamond, Wash.-based Osterman Research. “But it needs a monitoring and reporting tool like Logalot to detect spam sources, email bandwidth hogs and other such problems.”

Let’s start with how to block viruses like SoBig. First, click on the hostname in IMail Administrator, select the Inbound Rules tab and click Add. From the dropdown box, select “If the body text” and paste in the following:

filename=.*\.scr

Click add condition and then insert OR. In the text box, paste once again:

filename=.*\.pif

Click add condition and OK. Finally, select the action to be taken, “recommended delete for emails that match this rule.”

Next, we’ll deal with spam. “iMail has several features that help me manage my system,” said Bret Yarrison, email administrator at Patco Construction, a residential and commercial builder based serving the New England market. “IMail can lessen the amount of spam delivered to users by doing DNS and RDNS (reverse DNS) lookups against a connecting mail server to determine if it is a valid mail host.”

iMail comes with Real-time Blackhole Lists (RBLs--third-party services that list the domain names and IP addresses of known spammers); “Mail From” verification; Reverse DNS Lookup (this prevents spoofing by verifying the IP address of sending servers); EHLO/HELO domain validation (to verify that the sending mail server domain exists in DNS); kill lists (for blocked e-mail addresses and domains); trusted IP address; and statistical, phase and HTML filtering (to detect such things as nested tables, scripts, invalid tags, mailto links, deceptive URLs and embedded comments).

“As most spammers spoof the IP address of the sending mail server to avoid being detected, you can do a blacklist lookup that allows you to determine if the sending email server is a known spamming gateway,” said Yarrison. “You can also do content based filtering focusing on text strings (phrases) and HTML content to cut down on unwanted pornographic email and free printer cartridge offers.”

Another useful feature in iMail is the Inbound Rule set you can create that allows the administrator to specify exact parameters for determining if mail is not valid i.e. you can create a rule that blocks email from a particular user, or if the message header contains a particular piece of information you can filter based on that. Then of course, you can perform a number of actions once the mail has been determined to be invalid/spam. If a mail message is considered spam, it is forwarded to an alias that replies with a message (auto-reply) that indicates that our mail server has determined the email is spam, thus allowing an end-user to write back if it was a valid email.

Not everything you’ll want to know is covered by iMail itself, however. A worthwhile plug in is Somix’s Logalot, a syslog and event log collection system. If you want to know what service providers have customers which are trying to use your server for spam, for example, you go into Logalot Reports tab and run reports on relay attempts using your server. Click on the "Remote Server" address to find detailed information about each relay attempt. This provides you with IP and Domain information, as well as all the contact info you need to contact the ISP to get any spammers reported and/or blacklisted.

“The from_ address column is typically an erroneous spoofed name,” said Yarrison. “But if you click on the UP address in the remote_srv column, you can determine what carrier owns this IP address and possibly identify the actual ISP as well.”

To calculate who in the company is receiving the most email, go into Logalot Reports, specify the date range you want and run a report on the top ten email originators or recipients. This shows you the percentage of total email. At Patco, for example, three users were receiving the bulk of the email. By copying their email addresses into the Report screen, you can detect who is sending them the most traffic. In one case, for example, the individual was receiving and generating mainly internal traffic yet had a sales position. This alerted management to a possible reason for ineffectiveness.

Another user was found sending 1000 e-letters, each with a 2 MB file attached. By spotting this, Patco management instructed him to create a web link for the next e-letter. You can also utilize such features to observe possible instances of internal espionage or headhunting.

“It is vital to keep track of which individuals generate the most email and where spam is coming from,” said Osterman. “By doing this sort of in-depth analysis of email messaging, a company can save a huge amount in storage and bandwidth.”

Drew Robb is a freelance technology journalist.
 
 
Archives by Date
 
 
 
 
 
Copyright © 1994-2008 ComputerUser, Inc., All Rights Reserved All marks are trademarks of ComputerUser Media. Reproduction in whole or in part in any form or medium without express written permission of ComputerUser, Inc. is prohibited.
About us | Terms of use | Privacy Policy | Legal | Trademark/Copyright | Awards | Advertise | Writer guidelines | Sitemap | Contact | FAQ's | Feedback  | Link to us

Here are the topics we cover computer certification computer careers computer training computer games consulting data recovery data security digital entertainment emerging technology gadget reviews handheld computers hardware reviews home automation home networks home office how-to advice internet linux local companies local news local profiles macintosh mp3 players network security online music online security open-source small-business technology soho software reviews technology books technology dictionary vpn web site reviews wi-fi windows wireless technology tech articles tech news press releases tech dictionary education resources career solutions create your personal blog upload your videos become a writer usergroups special interest group SIG 3com cipts adobe adobe certified expert apc ncpi apple achds acpt acsa actc avaya bea 8.1 certified administrator 8.1 certified architect 8.1 certified developer 9 certified administrator bicsi rcdd checkpoint ccmse ccsa ccsa ngx ccse ccse ng plus with ai ccse ngx cisco access routing and lan switching ccda ccdp ccie ccip ccna ccnp ccnp old ccsp ccvp crmam ip communications optical proctored exams for validating knowledge sales specialist storage networking vpn and security wireless lan citrix cca 3.0 cca 4.0 cca 4.5 cca xp ccea 3.0 ccea 4.0 ccea xp ccia ciw ciw associate ciw certified instructor master ciw admin master ciw designer master ciw enterprise developer security analyst comptia a+ network+ security+ server+ computer associates ca cusa cuse cwna cwna cwsp dell eccouncil cea cep certified ethical hacker chfi e-commerce architect emc emc specialist implemenation technology foundations enterasys ese eta exam express exin exin itil extreme networks ena ens filemaker f7cd f8cd fortinet fortigate foundry cne fujitsu fujitsu guidance software ence hdi css hda hdm hdsa hitachi hitachi certified professional hp ais apc app aps ase certified systems developer csa cse master ase huawei hcne hyperion hcp ibm advanced deployment professional advanced technical expert application developer business process analyst certified administrator certified advanced system administrator certified advanced technical expert certified associate developer certified enterprise developer certified solution designer certified specialist certified systems expert database administrator db2 deployment professional enterprise developer eserver certified specialist ibm on demand business solution advisor solution designer solutions developer solutions expert storage administrator system administator iisfa cifi intel isaca cisa isc cissp sscp iseb itil ism cpm juniper jncia jncis legato lcaa lcea lotus clp lpi lpic level 1 lpic level 2 lpic level 3 macromedia mcafee mcdata csnd microsoft crm mbs mcad .net mcdba mcdst mcitp mcp mcpd mcsa longhorn mcsa 2003 mcsa 2008 mcsd .net mcse mcse 2000 security mcse 2000 to mcse 2003 upgrade mcse 2003 mcse 2003 messaging mcse 2003 security mcse 2008 mcts microsoft business solutions microsoft partner competency mile2 cnsa network appliance nac-na nac-nie naca nace nacp network general sniffer certified professional nokia nokia security administrator nortel ncde ncds ncse ncss ncts novell5 cna 5 cne 6 cna 6 cne 6.5 cne cne upgrade omg ocup oracle 10g dba 10g oca 11i 8i dba 9i dba 9i internet application developer oca ocp8 to ocp8i dba upgrade exam pmi project management professional polycom pcve redhat rhce rhct sair sas institute sas scp saas scp snia snia certified architect snia certified professional snia certified systems engineer snia storage networking certification program administrator professional associate symantec scse scsp scta scts teradata tca v2r5 tcad v2r5 tcda v2r5 tcis v2r5 tcm v2r5 tcp v2r5 tia ccnt ctp tibco tcp trusecure ticsa veritas infraguard chamber of commerce vcp vmware certified professional webex linkedin facebook myspace Professional page layout, image editing, vector illustration, and print production Website design, development, prototyping, and blogging Creation of rich interactive content Industry-standard visual effects and motion graphics Video capture, editing, and production; DVD titling; and digital audio, Adobe Photoshop CS3 extended, Adobe illustrator CS3,Adobe indesign CS3,Adobe Acrobat 8 Professional, Adobe Flash CS3 Professional, Adobe Dreamweaver CS3,Adobe Contribute CS3,Adobe Fireworks CS3,Adobe After Effects CS3 Professional, Adobe Premiere Pro CS3,Adobe Soundbooth CS3,Adobe Encore CS3,Adobe OnLocation,Adobe Bridge CS3,Adobe Version Cue CS3,Adobe Device Central CS3,Adobe Stock Photos, Intel Pentium 4 (1.4GHz processor for DV; 3.4GHz processor for HDV), Intel Centrino, Intel Xeon, (dual 2.8GHz processors for HD), or Intel Core, Duo (or compatible) processor; SSE2-enabled processor required for AMD systems Microsoft Windows XP with Service Pack 2 or Microsoft Windows Vista Home Premium, Business, Ultimate, or Enterprise (certified for 32-bit editions) 1GB of RAM for DV; 2GB of RAM for HDV and HD; more RAM recommended when running multiple components 10GB of available hard-disk space (additional free space required during installation) Dedicated 7,200 RPM hard drive for DV and HDV editing; striped disk array storage (RAID 0) for HD; SCSI disk subsystem preferred Microsoft DirectX compatible sound card (multichannel ASIO-compatible sound card recommended),1,280x1,024 monitor resolution with 32-bit color adapter Blu-ray burner required for Blu-ray Disc creation OHCI compatible IEEE 1394 port for DV and HDV capture, export to tape, and transmit to DV device QuickTime 7.1.2 software required to use QuickTime features Broadband Internet connection required for Adobe Stock Photos* and other services

3PAR, Accellion, Acronis, Actional, Active Endpoints, ActiveGrid, activePDF, ActiveServers, ActiveState, Actuate, Adaptec, Agile Software, AGiLiENCE, Agilysys, Akorri, AlachiSoft, Alter Logic, Altor Networks, Altova, AMD, AMDAHL, Amentra, Amyuni, anacubis, Apani, APC, Appcelerator, AppSense, AppStream, Array Networks, Ascential, Astaro, Attune Systems, Autodesk, AutoVirt, Availl, Avanade, Azul Systems, Barracuda Networks, BEA Systems, B-hive, Black Duck Software, Blackbaud, Blade Network Technologies, Blue Coat, Blue Lane, BlueArc, BlueNote Networks, BluePheonix Solutions, BMC Software, Borland, Bristol Technology, Brix Networks, BroadVision, Brocade, Burton Group, Business Objects, CA, CalAmp, Cassatt, Cast Iron Systems, Catbird, Cayenne Technologies, Ceedo Technologies, Cenzic, Certeon, CiRBA, Cisco Systems, Cision, Citrix Systems, ClearApp, ClearCube Technology, CollabNet, Compass America, Composite Software, Compugen, Compuware, Configuresoft, Continuity Software, Coraid, Courion, Coyote Point Systems, Crescendo Networks, CSC, DataCore, DataSynapse, Dell, Desktone, Digipede Technologies, Double-Take Software, Ecora Software, EDS, eG Innovations, Egenera, Elastra Corporation, Electric Cloud, Embotics, EMC Corporation, Emulex, Endeavors Technology, Enigmatic Corporation, Enterprise Management Associates, Entuity, EqualLogic, Ericom Software, ESRI, EVault, eXludus Technologies, F5 Networks, FalconStor, FastScale Technology, Foedus, Force10 Networks, Fortisphere, Forum Systems, Fujitsu, GemStone Systems, Getronics, GlassHouse, Green Hills Software, Grid Dynamics, GridGain Systems, GT Software, Hitachi, HP, Hyper9, Hyperic, IBM, ICEsoft, IGEL Technology, Illumita, ILOG, IMEX Research, Information Builders, Ingres, InstallFree, Integrien, Intel, Intellium, International Computerware, iTKO LISA, JBoss, Juniper, KACE, Kidaro, LeftHand Networks, Leostream, Lifeboat Distribution, Liquid Computing Corporation, Liquid Technology, Lynux Works, Mainline, ManageIQ, Managed Methods, ManageSoft, Marathon Technologies, McAfee, Mellanox Technologies, Microsoft, Mid-Atlantic Computers, Mindbridge Software, Mindreef, MKS, MonoSphere, Motorola, MQSoftware, mySoftIT, NASTEL, Ncomputing, NEC, Neocleus, NeoPath Networks, Neoware, NetApp, Netegrity, Neterion, Netuitive, Neverfail, Nexaweb, NextAxiom, Nimbus, Nimsoft, Niyuta, NoMachine, Novell, ONStor, Opalis Software, Open Kernel Labs, OpenSpan, OPNET Technologies, Optaros, OpTier, Oracle, Pano Logic, Parallels, Parasoft, Perforce Software, PHD Technologies, Phoenix Technologies, Phurnace Software, Pillar Data Systems, PlateSpin/Novell, Progress Software, Prolifics, ProSync Technology, Provision Networks, QLogic, Quest Software, Racemi, Raritan, Raxco Software, Red Hat, Reflex Security, Resolution Enterprises, RingCube Technologies, Riverbed Technology, Rogue Wave Software, RSA Security, Sagnet Solutions, SanDisk Corporation, SAP, SAVVIS, ScaleMP, Scalent Systems, Seanodes, Secure Command, Secure Computing, Sentillion, Shavlik Technologies, ServInt Internet Services, Silpion IT Solutions, SIMtone, Skytap, Skyway Software, Software AG, Sonasoft, SourceGear, Splunk, StackSafe, SteelEye Technology, StillSecure, StoneFly, Stonesoft, Stoneware, StoreVault, StrikeIron, STT WebOS, Sun Microsystems, SunGard, Supermicro Computer, Surgient, SWsoft, Sybase, Symantec, Systar, TBD Networks, Tenfold, TheInfoPro, Thinstall, Third Brigade, TIBCO Software, Tidal Software, Tideway Systems, TOA Solutions, TRANGO Virtual Processors, Trend Micro, Tresys Technology, Trigence, Tripwire, Ulteo, Unisys, United Devices, VaST Systems, VDIworks, VeeAm Software, Verari Systems, Verio, VeriSign, Vicom Computer Services, VirtenSys, Virtera, Virtual Iron, VirtualLogix, Virtugo Software, Virtutech, VisionCore, Vizioncore, VKernel, VMLogix, vmSight, VMware, Vordel, vThere-Sentillion, Vyatta, WaveMaker, Web Age Solutions, WSO2, Wyse Technology, XDS, XenoCode, Xiotech, xkoto, Xsigo Systems, Zenith Optemedia, Zeus Technology.