Email has firmly established itself as the standard for business communication. Due to the high cost-effectiveness of emails, as well as several features related to text quoting and attachment handling, emails are well-suited for document exchange and polite professional communication. These same features have led to emails being highly favored by spammers. As a result, today email represents a vast turbulent ocean of spam, in which genuine business emails are a rare find. Therefore, one of the primary tasks of any mail server administrator is to protect against spam campaigns. Let’s take a look at what can be done with Zimbra Collaboration Suite Open-Source Edition.
Despite being a free solution, Zimbra OSE provides system administrators with a wealth of highly effective tools to tackle the issue of unwanted emails. We have already discussed utilities like Amavis, SpamAssassin, ClamAV, and cbpolicyd, which reliably filter incoming mail by sifting out spam campaigns, as well as infected and phishing emails. However, their main drawback is that they all operate on already received messages and consume system resources for filtering unnecessary messages, which can always be better utilized. But what if your enterprise finds itself under the crosshairs of a large botnet that constantly bombards your mail server with such massive quantities of junk emails that sifting through them takes a lion's share of the MTA server's resources?
In theory, you can protect against this by connecting to a cloud service for filtering incoming mail; however, in practice, this method of protection is not suitable for every enterprise, as it requires trusting third parties to handle not only spam but also business correspondence, which is not always safe and often directly contradicts the company's security policy. Additionally, there are risks associated with the reliability of the cloud spam filter. A solution to this situation might be to establish server protection independently. For this purpose, Zimbra has integrated the Postscreen utility designed to protect the mail server from emails sent by botnets without overloading the mail server.
The essence of Postscreen's operation is that this utility scans all connection requests to the mail server server and prevents clients that appear suspicious from connecting to the server. According to statistics, around 90% of spam worldwide is sent by botnets, so Postscreen is often used as the first line of defense for the mail server against unwanted mass emails. As a result, the mail server can operate stably without overloads even under heavy spam attacks from large botnets.
The principle of Postscreen's operation is quite simple; the utility can perform a series of basic checks on incoming emails before passing them to the mail server or other services that conduct more thorough and detailed checks on incoming messages. Each of these checks can either pass or fail. Based on the results of each check, Postscreen can take one of three actions chosen by the Zimbra administrator: Drop, Ignore or Enforce. The action Drop forcibly closes the connection with the client in case of a failed check, the action Ignore allows ignoring the results of the check when making a final decision, while still collecting information and statistics on the checks performed, and the action Enforce takes into account the results of the checks when making the final decision, while still executing all tests scheduled by the system administrator.
The simple principle of operation does not imply ease of use and configuration. The fact is that a misconfigured Postscreen can cause a number of important emails for the organization to not reach their recipient. That is why configuring such a powerful tool as Postscreen requires great care and ongoing testing of its behavior in various situations.
Postscreen is enabled by default in Zimbra, but many may not be satisfied with the initial configuration. Now, we will look at the best configuration in terms of security and risk mitigation. The essence of it is that after a certain check fails, Postscreen will not immediately drop the connection with the client but will conduct all checks to completion and, if those checks fail, will issue an error message. This will notify a live sender about the non-delivery of the email if Postscreen identifies it as spam. This is achieved by setting the enforce value in the check parameters. This value allows ongoing checks to be completed without dropping the client connection upon the first failure while still blocking the spam email upon completion without delivering it to the server.
To enable the necessary checks, you need to enter the following commands:
zmprov mcf zimbraMtaPostscreenDnsblSites 'b.barracudacentral.org=127.0.0.2*7' zimbraMtaPostscreenDnsblSites 'zen.spamhaus.org=127.0.0.[10;11]*8' zimbraMtaPostscreenDnsblSites 'zen.spamhaus.org=127.0.0.[4..7]*6' zimbraMtaPostscreenDnsblSites 'zen.spamhaus.org=127.0.0.3*4' zimbraMtaPostscreenDnsblSites 'zen.spamhaus.org=127.0.0.2*3'
This command adds DNS checks for incoming connections against the two most popular public spam databases and rates emails based on which database the sender's address is found in. The more penalty 'stars' a client accumulates, the more likely they are to be a spammer.
zmprov mcf zimbraMtaPostscreenDnsblAction enforce
This command determines the action taken based on the outcome of the DNS check. In this case, the result of the check is remembered while the email continues going through further tests.
zmprov mcf zimbraMtaPostscreenGreetAction enforce
In the SMTP protocol, after the initial connection, the server starts the communication with the client, and accordingly, Postscreen can send a greeting to the client. Because many spam clients begin sending commands before the greeting is completed, they can be easily recognized. This command allows the results of this check to be considered while continuing to perform further tests.
zmprov mcf zimbraMtaPostscreenNonSmtpCommandAction drop
In this check, Postscreen allows filtering out connections that do not come from mail clients. Since they do not send any emails, they can be safely disconnected from the server.
zmprov mcf zimbraMtaPostscreenPipeliningAction enforce
This check is based on the fact that by default, in the SMTP protocol, a client can send only one command at a time and then wait for the server's response to that command. However, many spam bots behave differently, sending multiple commands without waiting for a response from the server. This allows for near-perfect identification of spam bots.
In principle, these checks for Postscreen will be more than enough to filter out the majority of spam bots from the server and significantly reduce the load on your mail server. At the same time, live users will receive a message that their email was not delivered, which significantly reduces the risk of losing important emails due to Postscreen's settings. In the event that this happens, you can add a trusted sender to the Postscreen whitelist. To create whitelists and blacklists for Postscreen, you first need to create a file. /opt/zimbra/conf/postfix/postscreen_wblist.
In it, we will add a list of allowed and blocked IP addresses and subnets in CIDR table format. For example, we will block the subnet 121.144.169.*, but allow the connection for the single IP address from this subnet:
# Rules are evaluated in the order as specified.
# Blacklist 121.144.169.* except 121.144.169.196.
121.144.169.196/32 permit
121.144.169.0/24 reject
Please note the importance of the order of the entries. The fact is that Postscreen will scan the file of whitelists and blacklists until the first match, and if a blocked subnet appears before the allowed IP address, the check will simply not reach the record indicating that this IP address has been added to the whitelist, and the connection to the server will not occur.
After the file with the whitelists and blacklists has been edited and saved, the corresponding checks can be enabled using the following commands:
zmprov mcf zimbraMtaPostscreenAccessList «permit_mynetworks, cidr:/opt/zimbra/conf/postfix/postscreen_wblist»
zmprov mcf zimbraMtaPostscreenBlacklistAction enforce
Now Postscreen, in addition to the checks we have already set, will also refer to the file with the whitelists and blacklists, which will make it easier for the administrator to resolve issues with reliable senders being unable to connect to the server.
Source: habr.com
