November 7, 2010

 Fail2Ban for Exim SMTP Auth

Fail2Ban is a great utility which can be found via: http://www.fail2ban.org. It checks for the output of various log files, and assigns an action to take, based on the IP address in the log file.This can be handy for introducing lockouts for various services. In this scenario, we will use Fail2Ban to create a lockout time for 3 consecutive failed logins to Exim SMTP Auth, via IP tables.

Prerequisites:

- IPTables

- Python 2.3 or newer

Steps:

1.) Download Fail2Ban for your distribution via: http://www.fail2ban.org/wiki/index.php/Downloads

2.) If using the source version, untar the file, then install:

% tar xvfj fail2ban-0.8.3.tar.bz2
% cd fail2ban-0.8.3
% python setup.py install

3.) This will create the fail2ban binary. To check if everything is running fine, run:

% fail2ban-client -h

This will have an output similar to:

% fail2ban-client -h
Usage: /usr/bin/fail2ban-client [OPTIONS]

Fail2Ban v0.8.3 reads log file that contains password failure report
and bans the corresponding IP addresses using firewall rules.

4.) Download the jail-smtpauth.conf and smtpauth.conf files from the following links:

- http://atmail.com/kb/attach/smtpauth.conf

- http://atmail.com/kb/attach/jail-smtpauth.conf

5.) Place jail-smtpauth.conf in /etc/fail2ban/jail.conf. Place smtpauth.conf in /etc/fail2ban/filter.d/smtpauth.conf.

6.) Start the fail2ban service:

% fail2ban-client start

7.) You can further alter the parameters. By default, if a user fails to login to Exim SMTP Auth for three times, the user is blocked from port 25 for about 10 minutes. Should you want to change this behaviour, open the /etc/fail2ban/jail.conf file, and find the following lines:

# "bantime" is the number of seconds that a host is banned.
bantime  = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 3

8.) So should you wish to  set it so that the user can fail to login for five times in the span of 20 minutes, before banning the IP for an hour, the settings will look like:

# "bantime" is the number of seconds that a host is banned.
bantime  = 3600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 1200

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

9.) Stop and start Fail2Ban afterwards:

% fail2ban-client stop
% fail2ban-client start


Filed under: Uncategorized, Anti-Spam, Exim, OS, Anti-Virus, Atmail 6 — John Contad @ 8:33 pm

 

December 2, 2009

 Adding Per-domain AV and Spam Support

You can add per-domain AV and Spam filtering support, if you wish. Just follow the following steps:

1.) open up /usr/local/atmail/mailserver/configure

2.) find:

MYSQL_DOMAINS = select Hostname from Domains where Hostname='${quote_mysql:$domain}'

3.) Below this, add:

MYSQL_AVCHECK = SELECT Hostname from Domains where AV='1' and Hostname='$domain'

MYSQL_SPAMCHECK = SELECT Hostname from Domains where Spam='1' and Hostname='$domain'

4.) Then, find this line:

domainlist relay_to_domains =

5.) Below this:

domainlist sa_domains = mysql;MYSQL_SPAMCHECK
domainlist av_domains = mysql;MYSQL_AVCHECK

6.) Then, find:

accept  hosts = :

7.) Below this:

warn domains = +av_domains
set acl_m1 = 1

warn domains = +sa_domains
set acl_m2 = 1

8.) Then, find:

acl_check_content:

9.) Below this, add:

accept condition = ${if match{$acl_m1}{1}}

accept condition = ${if match{$acl_m2}{1}}

10.) Login to your MySQL

11.) Add the two other columns to the Domains table:

> alter table Domains add Spam tinyint(1) default NULL;
> alter table Domains add AV tinyint(1) default NULL;

12.) To enable filtering for a specific domain, do the following:

> update Domains set Spam='1' where Hostname='yourdomain.com';

Replace yourdomain.com with your chosen domain.

13.) Restart atmail:

% /etc/init.d/atmailserver restart


Filed under: Uncategorized, Anti-Spam, Exim, Anti-Virus — John Contad @ 8:38 pm

 

January 10, 2009

 libidn.so: No such file or directory

Under a fresh installation of RedHat Fedora Core3 ( FC3 ) , a compile of the Clam/@Mail Anti-virus daemon can fail with the following:

gcc: /usr/lib/libidn.so: No such file or directory
make[2]: *** [libclamav.la] Error 1
make[2]: Leaving directory `/usr/local/atmail/webmail/libs/src/clamav/libclamav'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory

Basically this is an error with the library pathname. To solve, just create a symbolic link with the following:

root# ln -s /usr/lib/libidn.so.11.4.6 /usr/lib/libidn.so

Next, recompile and the Clam installation will be successful.


Filed under: Anti-Virus, Atmail 5 — info @ 11:42 am

 

January 1, 2009

 Auto-run ClamAV if found inactive

ClamAV, at times, fails and puts mail delivery and the processing of emails in the spool to a stop. This can be avoided by using ClamAV with supervise, a Unix tool that comes with the daemontools (http://cr.yp.to/daemontools.html) package, which basically checks if a service is running, then re-runs it if found inactive.
Implementing supervise with ClamAV is pretty straightforward. Just go through the following steps:

(more...)


Filed under: Anti-Virus — info @ 12:00 am

 

 Upgrading SpamAssassin

When you want to upgrade SpamAssassin 2.63 for @Mail to 3.0, keep in mind that the two versions have different SQL querying schemas. Also, you may need to take out some lines in the local.cf file, as many options have been deprecated.To upgrade your SpamAssassin installation, just run through the following steps:

(more...)


Filed under: Anti-Virus — info @ 12:00 am

 

 Testing SpamAssassin

Should you want to see if your Spam filter is working, just send an email with the following string:

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

This is the GTUBE - the Generic Test for Unsolicited Bulk Email. If your spam filter supports it, the GTUBE provides a test by which you can verify that the filter is installed correctly and is detecting incoming spam, in a similar fashion to the EICAR anti-virus test file.


Filed under: Anti-Virus — info @ 12:00 am

 

 Adding AV scanned in Message-header

Question:We are using @Mail in the mail-server mode with the AV scanner. We'd like all incoming messages that are clean via the AV scanner to append a header "X-Virus-Scanned: Clean" to each message in the users mailbox.

Answer:This is possible by editing the transport router in Exim to append the new header for each incoming message.

(more...)


Filed under: Anti-Virus — info @ 12:00 am

 

 Disable SpamAssassin filtering for some users or d

Should you want to disable SpamAssassin for some domains or users, just do the following:- open up your /usr/local/atmail/mailserver/configure
- find the following lines:

domains = ${lookup mysql {MYSQL_CHECKSPAM}{$value}}

- replace this with:

domains = lsearch;/usr/local/atmail/mailserver/domains

- create a file /usr/local/atmail/mailserver/domains, and put your desired domains to enable SpamAssassin with, in the following format:

domain1.com
domain2.com

- restart Exim:

% /etc/init.d/atmailserver restart

This will then limit the SpamAssassin filtering to the users in the domains listed.


Filed under: Anti-Virus — info @ 12:00 am

 

June 11, 2008

 Virus Oversized.Zip detected

If you receive the SMTP error:

"550 Virus Oversized.Zip detected. Mail delivery avoided"

This is due to the ClamAV engine of Atmail scanning a message attachment and the zip file compression ratio is too high. For example, zipping a large number of BMP files with high compression.

This feature is implemented in Clam to avoid a special crafted Zip file to loop on extraction causing a denial-of-service attempt.

To change the compression ratio simply edit: /usr/local/atmail/av/etc/clamd.conf

# If a file in an archive is compressed more than ArchiveMaxCompressionRatio
# times it will be marked as a virus (Oversized.ArchiveType, e.g. Oversized.Zip)
# Value of 0 disables the limit.
# Default: 250
ArchiveMaxCompressionRatio 0

Specify 0 to disable, or increase the ratio above the default 250, then restart the Atmail services.


Filed under: Uncategorized, Anti-Virus — info @ 9:23 pm

 

February 17, 2008

 Block sending and receiving of all emails not on the @mail server.

Question:Our need is to block all email addresses/domain not configured in the @mail server.
So I want to avoid mail deliveries from addresses like bill.gates@microsoft.com or george.bush@whitehouse.org.

Answer:Yes this can be done. Follow the step detailed below.
Open and edit the Exim configuration file located at /usr/local/atmail/mailserver/configure, please remember to also back up this file before changes are made. Find and delete the following code.

# This router routes addresses that are not in local domains by doing a DNS
# lookup on the domain name.
dnslookup:
driver = dnslookup
domains = ! +local_domains
transport = remote_smtp
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
no_more

Restart the @mail server and test.


Filed under: Anti-Spam, Customization, Exim, Anti-Virus, PHP version — Stewart Bazley @ 10:43 am