Printable View
Hi all,
My company uses Interscan Viruswall NT for smtp server.
I discovered that I can connect to port 25 and fire up some faked email. We confirm with ORDB it's not open relay. But I guess you can still spam email inside the domain.
So how can I prevent this? block the conection or disable some commands? and we still want email server functioning.
Thanks for any help.
Are you connecting using an annonymous account
or are you using a username\password to send mail?
Is this from an external connection???
AFAIK....strong access\username\password policy is the best protection.
You may be able to tweak your program not to accept connections from external requests.
MLF
I have never ued Interscan Viruswall NT before but with the ones I have used you can configure it to not acccept connections from port 23 (telnet) which is the most common way of logging into a smtp server for faking email reasons, is it configured to allow annonomous login's? If so configure it so it needs a user name and password for login. Then configure the mail client you use with the approprate details.
People on your network may be able to find the user name from whatever program you use but the password should be hidden, *********!
As long as the senders (MAIL FROM: ) address and/or the receivers (RCPT TO: ) address contains your company's domainname you should be able to "fake" an email. Your mailserver is supposed to do that. There's no way to prevent this exept taking the mailserver off-line. But I guess that's not an option.
I am assuming you meant connecting to port 25 from outside the company?
Or is it port 25 inside the company?
Hey Hey,
morganlefay: As far as I understand he is trying to prevent fake email from coming into his company... not users from accessing it.
mikema: mail servers are relatively simple devices... they recieve messages and send deliver them to the proper recipient. While you could attempt to validate the domain the message has originated from, there is no way to validate the sender. If the sender of every email sent was validated it would really slow down the way we communicate with email, I'd shudder to think of the queues on some of the bigger mail servers. You can do some searches on here for things like "Fake Email" and "Spoofed Email" and you'll find a few discussions on it.. Most people don't send fake email these days because it's too easy to get caught, mail headers give it away immediately. As for any spam you're receiving... deploy a spam filter on your mail server... It's going to catch the spam whether it goes directly to your SMTP server from a PC or from another SMTP server, the mail server can't distinguish the difference.
Peace,
HT
I guess I must of misunderstood the question.........Quote:
morganlefay: As far as I understand he is trying to prevent fake email from coming into his company... not users from accessing it.
Along with SirDice and Nokia.
Obviously you gleened spam out of the original question....
We all seemed to have missed that :rolleyes:
MLF
Is this the incoming mail server for your company?
If so blocking port 25 will prevent mail from being delivered.
If not are you sure port 25 is visible from outside the company network.
Check your firewall setup.
Steve
1st of all, thanks for you guys quick help.
My concern is faked email from inside, is there no way to prevent this? Since my VP doesn't like the idea that someone inside company forges email to ask some passwords, etc, and I think it' hard to trace that person, at least you can not find any inforamtion from header since it sends email on server.
then maybe I will disable Telent port23?
Our mail server has email tracking....all internal email.
Maybe yours does too??
MLF
Hey Hey,Quote:
Originally posted here by mikema
1st of all, thanks for you guys quick help.
My concern is faked email from inside, is there no way to prevent this? Since my VP doesn't like the idea that someone inside company forges email to ask some passwords, etc, and I think it' hard to trace that person, at least you can not find any inforamtion from header since it sends email on server.
then maybe I will disable Telent port23?
As SirDice said, you're asking how to stop your mail server from doing what it's supposed to do... If you have employees that you are worried about doing that, perhaps firing them is the best route to take. As far as finding the information, if everything is internal with private addressing, you should be able to track down the sender to their individual workstation using the mail headers... It'd actually be easier to track down the sender than if it was external.
How does disabling telnet fit into the picture?
MLF: sounds like ya don't agree with what I said... but I still stand by it... usernames and passwords aren't going to help prevent mail being sent... It'll limit who can send through the mail server, but not what information is going to be displayed when the other user receives it and sees the Sender... Unless the sarcasm I sensed wasn't really there but I doubt that.
Peace,
HT
SMTP is a very, nieve protocol. It trusts that you are who you say you are, which from a security (or spam) point of view is BAD. You can turn on SMTP authentication which will require users to authenticate before being able to send. Clients will need to be reconfigured to authenticate. You obviously can't block port 25, or you won't be able to send and receive email, but you should restrict your server from relaying from any IP that is not in your network. This will prevent outsiders from relaying through your server. I don't know the exact steps to do this on your specific server, but atleast the concepts should be the same.
Yes, I think so.Quote:
Originally posted here by morganlefay
Our mail server has email tracking....all internal email.
Maybe yours does too??
MLF
Steve said blocking port 25 will solve the problem if it's from inside, how to do that?
What is your mail server, most can be configured to only accept a from address that is within a list of allowed domains:
Eg [email protected] is ok but [email protected] would be rejected.
However what is very difficult to stop is someone forging [email protected].
Consider using some form of authentication on the smtp server (local network side) so that a user must be validated
Steve
That's not what I meant, and is not relevant to your situation.Quote:
Originally posted here by mikema
Steve said blocking port 25 will solve the problem if it's from inside, how to do that?
What I was assuming was the your mail server was only handling internal mail but was accessable from outside.
Your situation is stopping internal users from forging internal from address to SE a password etc.
You need to consider user authentication on the internal NIC of your mailserver.
Steve
If you block port 25, you won't be able to send or receive email. Port 25 is how email servers talk to each other, and how they accept new mail.Quote:
Originally posted here by mikema
Yes, I think so.
Steve said blocking port 25 will solve the problem if it's from inside, how to do that?
When you send an email, it is first sent to your SMTP server via port 25. Then the server connects to the server listed in the MX record of the receiving domain and sends it to that server via port 25. As you can see, having this port open is very much needed.
Sorry Steve, I misunderstood. :)Quote:
Originally posted here by steve.milner
That's not what I meant, and is not relevant to your situation.
What I was assuming was the your mail server was only handling internal mail but was accessable from outside.
Your situation is stopping internal users from forging internal from address to SE a password etc.
You need to consider user authentication on the internal NIC of your mailserver.
Steve
SO I will suggest to my VP, fire them or configure user authentication.... need find more information...
I guess it comes down to user name and password authentication :rolleyes:
As I cannot send mail or open my bosses mail...unless I use the admin account...or his account and I would need his password to do thatQuote:
usernames and passwords aren't going to help prevent mail being sent
As for spoofing a "from address"....the email can then be tracked back to the original sender and then dealt with from there.
Just was wondering why I was singled out...Quote:
Unless the sarcasm I sensed wasn't really there but I doubt that.
I guess I am just plain misunderstanding the original question.......as with other people
MLF
Ok here's what I understand of your situation. You are worried about people connecting to your port 25 and forging emails? Correct me if I'm wrong.Quote:
Originally posted here by mikema
Sorry Steve, I misunderstood. :)
SO I will suggest to my VP, fire them or configure user authentication.... need find more information...
I'm pretty sure you can set a timing thing so if someone stops typing for a set amount of seconds it will automatically disconnect them from the server. If someone does manage to forge and email, depending on what email program you use, you should be able to find the X-Originating-IP which should be the IP address from the computer that sent the forged mail, then you should be able to track down that IP and report it.