Is spam being sent out from a local machine on your network? Follow these steps to track down a spambot.

Has this happened to you? Let’s say you’re the MDaemon administrator for your company, and you’ve noticed that somewhere, somehow, spam messages are being sent from within your network. Perhaps one of your PCs has been compromised. What do you do? Here are some tips to help you track the issue down.

First, make sure you have the option “Authentication is always required when mail is from local accounts” enabled (Security | Security Settings | SMTP Authentication). Also enable “Credentials used must match those of the return-path address” and “Credentials used must match those of the From header address.” Then, make sure “…unless message is sent to a local account” is unchecked to prevent intra-domain spam (between local domain users).

SMTP Authentication in MDaemeon
Make sure the appropriate boxes are checked to require SMTP authentication

Next, find out if the spam messages are coming in from an authenticated session. To do this, locate one of the spam messages & open it up in Notepad to view its headers (or you can open it in Queue & Statistics Manager). Does the message have an X-Authenticated-Sender header? It will look something like this:

X-Authenticated-Sender: SpammerUser@example.com

If this header is present, then that is the user who authenticated to send the message. The first thing you should do in this case is to change the account’s password via the Accounts menu in MDaemon. Even if the spamming is going through the user’s mail client, until you give the user the new password and they update their mail client the authentication credentials will be rejected and the spamming will be temporarily stopped.

In newer versions of MDaemon, we’ve added Account Hijack Detection, which will automatically disable an account if it sends a specified number of outbound messages via an authenticated session in a given period of time. We recommend enabling this feature. In MDaemon, it’s located under Security | Security Settings | Screening | Hijack Detection.

Account Hijack Detection
Account Hijack Detection

The next step is to look at the Received headers. Find the one where the message was received by your server. Here is an example of what this header would look like:

Received from computer1 (computer1@example.com (192.198.1.121) by example.com (MDaemon PRO v17) with ESMTP id md50000000001.msg for <UserWhoWasSpammed@example.com >, Fri, 13 Sep 2016 21:00:00 -0800

Find the connecting IP (192.198.1.121) in the above example. This is the machine that is sending out spam. Locate that machine to deal directly with the spambot on that machine.

If the message wasn’t authenticated or wasn’t sent from your local network, locate the Message-ID header and copy that value.

Message-ID: <123.xyx.someone@example.net>

Then open the MDaemon SMTP-IN log that covers the time when that message was received by MDaemon (based on the timestamp in the received header) and search for that Message-ID in the log (in the 250 response line when the message is accepted):

Thu 2016-09-12 20:00:00: –> 250 Ok, message saved <Message-ID: <123.xyx.someone@example.net>>

Look at the rest of transaction and see why the message was accepted/not rejected – spam score, DNSBLs, etc.

Also, if your external domain is listed in the Trusted Hosts list (Security | Security Settings | Trusted Hosts), try removing it from this list.

Check back often for more tips & tricks!

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

Restricting Message Size for Everyone Except a Select Few Users in MDaemon

Recently, one of our customers asked the following question:

“How do I restrict messages to 2MB for inbound and outbound mail – for all users except a small group of users?”

In MDaemon, this can be done via the Content Filter (located under the Security menu). Simply follow these easy steps:

  1. Add the users who will not be subject to the size restriction to a group via Accounts | Groups & Templates.
  2. Go to Security | Content Filter and create a new rule.
  3. In the left-hand “Conditions” column, check the box “If MESSAGE SIZE is greater than.”
  4. In the right-hand “Actions” column, check the box “DELETE the message”, and also check the box “Send a NOTE 1 to.”
  5. In the bottom section, click on the blue text “is greater than 10K” and enter a value in KB (2000 KB, for example), and then click OK.
  6. Click on the blue text “Specify Information” next to “and send note 1.”
  7.  In the new window, enter $SENDER$ in the To field, adjust the subject if desired, and enter a message in the main window, such as “Sorry, your message has exceeded the allowed size limit.”
  8. Click OK to save your progress.
  9. Give your new rule a name in the “Name this rule” field at the top, and click OK to save the rule.
  10. Now, we need to create a new rule to skip the size limit rule for members of the group we created in Step 1. Click on New Rule.
  11. Give your rule a name.
  12. In the left-hand “Conditions” column, check the boxes “If SENDER is a member of GROUP” and “If RECIPIENT is a member of GROUP.”
  13. In the box below, click on the blue “specific group name” text for each item, and select the group you created in Step 1. Do not change the word “or” to “and.”
  14. In the right-hand “Actions” column, check the box “SKIP the next ‘n’ rules.”
  15. Click the blue text “Specify Information” in the bottom section, and verify that it has “1” specified under “Skip over how many rules?”
  16. Click OK.
  17. Save your new rule.
  18. Back on the main Rules screen, highlight the last rule you created, and click the “Move up” button to move it above the size limit rule we created previously.
  19. Click OK to exit the content filter.
Here are screenshots of these rules:

Screen1

Screen2

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

As a reminder, you can view our webinars and tutorial videos on our YouTube channel. Is there a topic you’d like to learn more about? Let us know in the comments section below!

 

 

 

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

New MDaemon Tutorials Added to YouTube

If you haven’t seen our YouTube channel lately, you’re missing out on some valuable information that can be used to help you manage MDaemon and SecurityGateway. Recently, we’ve added several new MDaemon tutorial videos. Here are a few that might interest you.

MDaemon Graphical User Interface (GUI) Overview

In this video, we provide a tour of MDaemon’s graphical user interface. We show you where to find key security, administration, and account management settings, how to navigate your way through the mail queues, and how to find information in the mail routing, security and spam filter logs using the tabs across the bottom of the MDaemon interface.

MDaemon’s File Structure

One of the benefits of MDaemon that make it easy to troubleshoot and administer is its file structure. All key settings are stored in configuration files located in the MDaemon/App directory, and user email messages are stored in the Users directory. This flat-file structure makes MDaemon very easy to backup and restore using simple drag & drop.

How to Enable and Use Two-Factor Authentication in WorldClient

Two-factor authentication is a security feature found in WorldClient, MDaemon’s webmail client, which requires users to submit two forms of identifying data – a password, and a special code or token, before they are able to login. Two-factor authentication helps prevent accounts from being hijacked by someone who manages to guess the account’s password. A potential hacker would have to know the second authenticating factor in order to access the account.

Enabling Do Not Disturb to Establish Work/Life Balance for Employees

MDaemon’s Do-Not-Disturb feature allows administrators to set a time during which certain users are not allowed to check for or send new email messages. In an age where we’re all constantly connected via mobile devices, this helps foster better work-life balance for your users.

These are just a few of the tutorial videos on our YouTube channel. Visit our YouTube channel for other tutorials, product overview videos, webinars, and more. If you haven’t tried MDaemon yet, click here to download your free trial and see how easy MDaemon is to use!

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

Protect Email Privacy with Message Expiration using Virtru

In a previous video and blog post, I demonstrated how to maintain data privacy by encrypting email messages in WorldClient (MDaemon’s webmail client) using Virtru. However, this easy-to-use client-side email encryption feature does more than just email encryption. When you use Virtru Pro, you can set a message expiration  period, revoke sent messages, or disable forwarding. In today’s video tutorial, I show you how to set a message expiration using WorldClient and Virtru.

 

If you’d like to see for yourself how easy Virtru is to use, then download  your free trial of MDaemon!

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •