Nobody likes to think that Big Brother is watching them. But with spam, viruses, other security threats and internal espionage running rampant these days, companies had better do some monitoring of their e-mail systems or they face could face trouble ahead. This article discusses ways to minimize these issues to discover such things as:

• How to eliminate virus troubles such as those caused by SoBig
• What service providers have customers which are trying to use your server for spam?
• And who in the company is receiving the most email and who do they receive it from?

For the purposes of this article we will focus on the popular iMail Server by Ipswitch Inc. in conjunction with a plug-in tool called Logalot by Somix Technologies.

“iMail is an inexpensive tool and includes a number of valuable features such as good anti-spam filtering, anti-virus, calendaring and multi-language support,” said Michael Osterman, an analyst at Black Diamond, Wash.-based Osterman Research. “But it needs a monitoring and reporting tool like Logalot to detect spam sources, email bandwidth hogs and other such problems.”

Let’s start with how to block viruses like SoBig. First, click on the hostname in IMail Administrator, select the Inbound Rules tab and click Add. From the dropdown box, select “If the body text” and paste in the following:

filename=.*\.scr

Click add condition and then insert OR. In the text box, paste once again:

filename=.*\.pif

Click add condition and OK. Finally, select the action to be taken, “recommended delete for emails that match this rule.”

Next, we’ll deal with spam. “iMail has several features that help me manage my system,” said Bret Yarrison, email administrator at Patco Construction, a residential and commercial builder based serving the New England market. “IMail can lessen the amount of spam delivered to users by doing DNS and RDNS (reverse DNS) lookups against a connecting mail server to determine if it is a valid mail host.”

iMail comes with Real-time Blackhole Lists (RBLs--third-party services that list the domain names and IP addresses of known spammers); “Mail From” verification; Reverse DNS Lookup (this prevents spoofing by verifying the IP address of sending servers); EHLO/HELO domain validation (to verify that the sending mail server domain exists in DNS); kill lists (for blocked e-mail addresses and domains); trusted IP address; and statistical, phase and HTML filtering (to detect such things as nested tables, scripts, invalid tags, mailto links, deceptive URLs and embedded comments).

“As most spammers spoof the IP address of the sending mail server to avoid being detected, you can do a blacklist lookup that allows you to determine if the sending email server is a known spamming gateway,” said Yarrison. “You can also do content based filtering focusing on text strings (phrases) and HTML content to cut down on unwanted pornographic email and free printer cartridge offers.”

Another useful feature in iMail is the Inbound Rule set you can create that allows the administrator to specify exact parameters for determining if mail is not valid i.e. you can create a rule that blocks email from a particular user, or if the message header contains a particular piece of information you can filter based on that. Then of course, you can perform a number of actions once the mail has been determined to be invalid/spam. If a mail message is considered spam, it is forwarded to an alias that replies with a message (auto-reply) that indicates that our mail server has determined the email is spam, thus allowing an end-user to write back if it was a valid email.

Not everything you’ll want to know is covered by iMail itself, however. A worthwhile plug in is Somix’s Logalot, a syslog and event log collection system. If you want to know what service providers have customers which are trying to use your server for spam, for example, you go into Logalot Reports tab and run reports on relay attempts using your server. Click on the "Remote Server" address to find detailed information about each relay attempt. This provides you with IP and Domain information, as well as all the contact info you need to contact the ISP to get any spammers reported and/or blacklisted.

“The from_ address column is typically an erroneous spoofed name,” said Yarrison. “But if you click on the UP address in the remote_srv column, you can determine what carrier owns this IP address and possibly identify the actual ISP as well.”

To calculate who in the company is receiving the most email, go into Logalot Reports, specify the date range you want and run a report on the top ten email originators or recipients. This shows you the percentage of total email. At Patco, for example, three users were receiving the bulk of the email. By copying their email addresses into the Report screen, you can detect who is sending them the most traffic. In one case, for example, the individual was receiving and generating mainly internal traffic yet had a sales position. This alerted management to a possible reason for ineffectiveness.

Another user was found sending 1000 e-letters, each with a 2 MB file attached. By spotting this, Patco management instructed him to create a web link for the next e-letter. You can also utilize such features to observe possible instances of internal espionage or headhunting.

“It is vital to keep track of which individuals generate the most email and where spam is coming from,” said Osterman. “By doing this sort of in-depth analysis of email messaging, a company can save a huge amount in storage and bandwidth.”

Drew Robb is a freelance technology journalist.