Defending a Cheap Mail Server

I work for a small company that has their email services hosted by an online email provider (at a very cheap cost). I can access and manage all the mail accounts from a web interface and then configure Microsoft Outlook on all the desktops for users to send/receive mail, from the offsite mail server.

The problem is the mail server that my company's email is hosted on has no type of virus or firewall protection. Basically it's wide open, the only feature I'm able to configure is a cheap spam filter. I spoke several times to this ISP and voiced my concerns about this problem and they are just now in the process of upgrading their services and offering some type of virus protection.

Other than switching to a different mail provider (which I know the company may not do because they're cheap) what can you suggest as a good measure to effectively increase security when they download emails at their desktops via Outlook. Right now they are having all sorts of issues with spam, spyware, adware, and trojans. Are there any free gateway type of services that would provide a means to scan all email before it gets to my companies network or any utilities I can install on all the desktops to minimize these security threats. Any ideas please let me know, thanks!

http://www.barracudanetworks.com/

I have a couple of small clients where we don't have our own server for each service (like you.)
I have found one great (local) ISP/Mail host that uses the spam/antivirus/spyware firewall and we lease the service. (Part of the ISP/Mail cost). Never once had a problem on these networks.

I have AV clients on the workstations themselves...
Then for added protection against spyware... locked down workstations and blackhole dns.

Hey Hey,

You've got your mail hosted externally... that's one thing, but what about the gathering of the mail. Instead of having the users Outlook connect directly to the external mail server, could you setup an internal mail server using say fetchmail with spamassassin and clamav and set it up to clean the mail and store it locally. You don't have to run a mail server, just setup an outbound connection from the internal server to the external host, have it check every 10 minutes or whatever, this way the users aren't all checking externally individually (if you pay for bandwidth it may save you money there). Setup your users Outlooks to access the internal machine. if you don't have a server lying around you may have to obtain one, but you wouldn't need very high requirements ( prolly anything newer than a 486 would handle the task for you) and a little bit of knowledge.

peace,
HT

Very good tips thanks, I have the workstations locked down through group policy so the fetchmail and blackhole dns ideas will add an extra layer of defense, I'll check out barracuda as well. Also this mail server has been hacked recently (I suspect) the admin password was changed I didn't change it and neither did anyone else with access (only two other people) so there's no telling what kind of backdoors the attacker could have left. I had to call the ISP and have them reset the pwd and then I created a stronger password to help slow any attackers down a bit.

I'm sure I can get a spare machine and setup an additional server I'll have to plan this out though of course. What version/flavor of Linux would you recommend running fetchmail on? One other question we don't have a very good firewall system at this site either what if I setup a linux firewall using IPchains, etc would that be enough or could it be configured to help protect the mail and internal network infrastucture?

www.mailarmory.com

Will provide both spam and virus protection for a VERY low cost.

If you check it out and have any questions, let me know, I use it.

Thanks chef! I'll look into this as well.

The latest version of McAfee has an incomming mail scanner applied at each desktop. Your local file system would then be covered as well.

VirusScan 8.0i

I'm running Symantec AV 10 with the system center console so I can manage all my machines from one place. Version 10 is actually pretty good it includes tamper protection and so a virus can't totally disable SAV protection.

If you are running an active scanner locally then they should detect infected mail when it's executed. On a small network you have good visibility of whats going on so would imagine you would be ok.

//EDIT without digging into the manual, which you can do ;) The AV 10 read me indicates some e-mail integration:

Quote:

---

Internet E-mail Auto-Protect port changes are ignored
-----------------------------------------------------
The antivirus client Auto-Protect feature for Internet E-mail Advanced
Options lets you change the ports for POP3 and SMTP. The defaults
for these ports are 110 and 25. The antivirus client ignores
changes to these defaults. This issue applies to all email
programs that use POP3 and SMTP, including Microsoft Outlook.

If you change these defaults with the antivirus client but your email
program uses the defaults, Auto-Protect still scans for risks in your
email traffic. If your email program does not use the defaults and
you change the Auto-Protect ports to match the ports used by your
email program, Auto-Protect does not scan for risks in your email
traffic.

---

Yeah your right for the most part but what seems to be happening is spam email seems to be making its way back and forth through a bunch of my users computers. They are also afflicted with loads of trojans and spyware but this is probably from click happy Internet users.

I'm in the process of rebuilding every machine on the network so I can start from a clean slate, this in combination with several tips above will help out a lot.

Ahh spam, unfortunately those trojans are easy to package a small SMTP server along with. That points back to HT and Phish's ideas. I have had excessive spamming from clients before and since I use exchange I have the luxury of locking down all SMTP traffic incoming and outgoing from client machines. Hmmm If you put a packet sniffer on the gateway and filter SMTP then eliminate your mail server address you can track down the worst of the infections by seeing who is sending or recieving smtp/pop outside your server. If you think trojans are afoot. Have fun.

Have you considered hosting POP3\SMTP in-house? Mailenable (www.mailenable.com) and Desknow (www.desknow.com) are great, inexpensive Windows mail servers that are easy to administer and directly support local antivirus (Desknow allows you to subscribe to automated antivirus as well). Both servers also have great web portals.

there are here great points.
HTRegz have a good solution, you can host your own email server, and Spyrochaete, gave you a software solution (desknow)
Its free, okey its not the best, sometimes crash, have backup solution but it doesn't work very well.

you can combine these 2 ideas.

First, you creat your own Email server, lets say with Desknow (very easy to setup).
You ask your ISP to relay the company email, to your private email. Then you install, lets say a good aplications... Interscan Virus Wall.
this is a product from Trend Micro, you can buy the packged where you have the Anti-virus and virus wall.

This what will happend, The Interscan Virus wall, will recive all of your email, and scan for trojans,virus,worms,i guess spyware to, and key words of your choise(for example...porn, xxx... this usualy attaches virus), and then will deliver to your local Email server, and then the Outlook Express Clients can recive the email,and the Trend micro anti-virus, will again check the email being recived by outlook express(this you must setup on the client) and all of them will be clean.

This is a very good and cheap solution, you just have to spend money for the anti-virus( be careful to chose the packged, check all the programs that comes with it) and for the Relay (i guess your ISP will charge very few).

I've run Desknow for 3 years - as a standalone POP/SMTP/Webmail solution and as a Webmail portal on top of an existing POP/SMTP server and I can say with great amazement that the program has never ever crashed (though there are only 8 email accounts on my server - hardly high load). The only real concern with Desknow is that it takes a big tax on RAM due to its dynamic HTML generator engine.

I can't say that it WON'T crash, but I can say that it DIDN'T.

I say that Desknow crash, because it happend to me several times, at the point that the database got corrupted.
but i have more that 20 accounts, and its a high traffic email server, theres alot of email going in and out.
its by far the worst solution, but they don't want to spend money, im trying Qmail but im still learning how to install and configure.

desknow its not a bad email server, but is not good for high traffic email servers with more than 20 accounts

Fact is that the increasing spam flood is about to question usefulness of emailing in general. There is an ongoing argument whether to fight Spam on the mail server or at the client level. While my company (about 5000 employees) has decided to fight spam and viruses at the server with deploying "Postini." I switched back to Spam Bully as it is much more accurate, has a better integration into my Outlook email client and last but not least does not block too many legitimate emails from my customers as "Postini" did. Spam Bully is a reliable tool which adapts to my individual needs - I don't want to miss it anymore.