Q about mail proxy servers and setups

[Michael Scheidell <sc...@secnap.net>]

Sometimes a large company will have a proxy server set up in the DMZ and
then send it to their internal mail server.
I understand that ideally, the proxy server would be replaces with a
SpamAssassin/MTA setup.

However, sometimes, client, security and company policy needs outweigh
logic.
I can think of several things this might break, depending on if you
count that proxy server as an internal/trusted server.

#1, SPF.  SPF helo, SENDERID
  The proxy will be adding a received header, and announcing 'HELO/EHLO'
using its own name, not the senders.
  (please no bitching about SPF)
#2, many blacklists that depend on the last received header (the proxy
will normally put on in)

For Amavisd/others that use p0f, all we get is signature of the proxy.
Smtp ratelimiting, greyisting, even recipient verification break.  You
can't drop the SMTP session when the sender sends you an email with a
bad address, the proxy has already accepted it.  You can't use 4xx
errors in your policy server to do greylisting on policy blacklisting
because you are sending the 4xx error to the proxy.

On amavis, if we use MY_NETS policy, and we put the proxy ip in the
'localnets', it will spam the spam and virus contact address on every
email from the 'local network'.

If you don't put it in there, it breaks some of the things I mentioned
above.

Anything else I missed?
Any solutions other then take the proxy server out and replace it with
the SpamAssassin/MTA combo?

-- 
Michael Scheidell, CTO
Office: 561-999-5000 x 1259
Direct: 561-939-7259
Join SECNAP at SecureWorld Detroit 9-10
http://www.secnap.com/events for free and discounted seminar tickets  
_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(tm). 
For Information please see http://www.spammertrap.com
_________________________________________________________________________

Re: Q about mail proxy servers and setups

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

> Michael Scheidell wrote:
> > Sometimes a large company will have a proxy server set up in the DMZ and
> > then send it to their internal mail server. I understand that ideally,
> > the proxy server would be replaces with a SpamAssassin/MTA setup.
> >
> > However, sometimes, client, security and company policy needs outweigh
> > logic. I can think of several things this might break, depending on if
> > you count that proxy server as an internal/trusted server.
> >
> > #1, SPF.  SPF helo, SENDERID
> >   The proxy will be adding a received header, and announcing 'HELO/EHLO'
> > using its own name, not the senders.
> >   (please no bitching about SPF)
> > #2, many blacklists that depend on the last received header (the proxy
> > will normally put on in)

On 23.09.07 22:24, mouss wrote:
> These are easily solved by correctly configuring trusted_networks.

and internal_networks - the proxy has to be in both of them. In such case
SA will behave correctly, unless the proxy does any bad in modifying headers
etc (and for SA-3.2.x, the proxy has to do reverse DNS check and put it into
Received: headers)

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I feel like I'm diagonally parked in a parallel universe. 

Re: Q about mail proxy servers and setups

[mouss <mo...@netoyen.net>]

Michael Scheidell wrote:
> Sometimes a large company will have a proxy server set up in the DMZ and
> then send it to their internal mail server.
> I understand that ideally, the proxy server would be replaces with a
> SpamAssassin/MTA setup.
>
> However, sometimes, client, security and company policy needs outweigh
> logic.
>   

You are free to do whatever your policy dictates, as long as this
introduces no nuisance for others. "your freedom stops where that of
others starts".

> I can think of several things this might break, depending on if you
> count that proxy server as an internal/trusted server.
>
> #1, SPF.  SPF helo, SENDERID
>   The proxy will be adding a received header, and announcing 'HELO/EHLO'
> using its own name, not the senders.
>   (please no bitching about SPF)
> #2, many blacklists that depend on the last received header (the proxy
> will normally put on in)
>   

These are easily solved by correctly configuring trusted_networks.

> For Amavisd/others that use p0f, all we get is signature of the proxy.
> Smtp ratelimiting, greyisting, even recipient verification break.  You
> can't drop the SMTP session when the sender sends you an email with a
> bad address, the proxy has already accepted it.  You can't use 4xx
> errors in your policy server to do greylisting on policy blacklisting
> because you are sending the 4xx error to the proxy.
>   

If mail is accepted at the edge of the network, it can no more be
bounced. backscatter is no more acceptable. if you can't block invalid
mail at the edge, then you have a choice between:

1- deliver to someone that will check whether the message is legitimate,
and the sender was not forged. inform the company/customer/... that when
someone mistypes the boss address, the possibly sensitive message is
read by an employee.
2- silently discard. inform the company/customer/whomever that their
mail system is not reliable and may discard mail without notice.

and BTW, tell the boss to buy more hardware to cope with a queue of
invalid recipients mail...

a better alternative is to tell all users to open an account at gmail,
yahoo, ... This may not look "professional", but it will at least avoid
polluting the mailboxes of the rest of us.


> On amavis, if we use MY_NETS policy, and we put the proxy ip in the
> 'localnets', it will spam the spam and virus contact address on every
> email from the 'local network'.
>
> If you don't put it in there, it breaks some of the things I mentioned
> above.
>
> Anything else I missed?
> Any solutions other then take the proxy server out and replace it with
> the SpamAssassin/MTA combo?
>
>   

Re: [AMaViS-user] Q about mail proxy servers and setups

[Jo Rhett <jr...@netconsonance.com>]

Every problem you've named here is solved by putting Amavis/SA on the 
proxy instead of the internal system.

If the proxy doesn't do the spam-checking, and the internal system does 
I can name a dozen other problems that will occur, the most important of 
which will be backscatter.  2-step relay where the internal system 
doesn't trust the external system is a backscatter system, and will get 
blacklisted fairly quickly.

Michael Scheidell wrote:
> Sometimes a large company will have a proxy server set up in the DMZ and
> then send it to their internal mail server.
> I understand that ideally, the proxy server would be replaces with a
> SpamAssassin/MTA setup.
> 
> However, sometimes, client, security and company policy needs outweigh
> logic.
> I can think of several things this might break, depending on if you
> count that proxy server as an internal/trusted server.
> 
> #1, SPF.  SPF helo, SENDERID
>   The proxy will be adding a received header, and announcing 'HELO/EHLO'
> using its own name, not the senders.
>   (please no bitching about SPF)
> #2, many blacklists that depend on the last received header (the proxy
> will normally put on in)
> 
> For Amavisd/others that use p0f, all we get is signature of the proxy.
> Smtp ratelimiting, greyisting, even recipient verification break.  You
> can't drop the SMTP session when the sender sends you an email with a
> bad address, the proxy has already accepted it.  You can't use 4xx
> errors in your policy server to do greylisting on policy blacklisting
> because you are sending the 4xx error to the proxy.
> 
> On amavis, if we use MY_NETS policy, and we put the proxy ip in the
> 'localnets', it will spam the spam and virus contact address on every
> email from the 'local network'.
> 
> If you don't put it in there, it breaks some of the things I mentioned
> above.
> 
> Anything else I missed?
> Any solutions other then take the proxy server out and replace it with
> the SpamAssassin/MTA combo?
> 


-- 
Jo Rhett
Net Consonance ... net philanthropy, open source and other randomness

Re: [AMaViS-user] Q about mail proxy servers and setups

[Clifton Royston <cl...@lava.net>]

On Sun, Sep 23, 2007 at 01:50:43PM -0400, Michael Scheidell wrote:
> Sometimes a large company will have a proxy server set up in the DMZ and
> then send it to their internal mail server.
...
> #1, SPF.  SPF helo, SENDERID
>   The proxy will be adding a received header, and announcing 'HELO/EHLO'
> using its own name, not the senders.
>   (please no bitching about SPF)
> #2, many blacklists that depend on the last received header (the proxy
> will normally put on in)
> 
> For Amavisd/others that use p0f, all we get is signature of the proxy.
> Smtp ratelimiting, greyisting, even recipient verification break.  You
> can't drop the SMTP session when the sender sends you an email with a
> bad address, the proxy has already accepted it.  You can't use 4xx
> errors in your policy server to do greylisting on policy blacklisting
> because you are sending the 4xx error to the proxy.
> 
> On amavis, if we use MY_NETS policy, and we put the proxy ip in the
> 'localnets', it will spam the spam and virus contact address on every
> email from the 'local network'.
> 
> If you don't put it in there, it breaks some of the things I mentioned
> above.
> 
> Anything else I missed?
> Any solutions other then take the proxy server out and replace it with
> the SpamAssassin/MTA combo?

  I think most of your commenters missed this last paragraph.  (I
sympathise with the difficulty of getting *any* change in place in the
large corporate model, let alone one which involves other departments. 
I spent half last year working as a contract software developer inside
a major multinational, and while I could have offered better solutions
for several areas than their IT department, it would have been useless
for me to volunteer that.)

  #1, semi-correct, but meh.  I'm unconvinced that SPF would help you
very much except as it provides for some useful whitelisting
mechanisms.  The MTA is the wrong place to check it, though; see next
paragraph.

  Your point #2 *can* be worked around at the SpamAssassin level, by
configuring the proxy (or potentially multiple parallely proxy servers)
as part of SpamAssassin's "Trusted networks" configuration.  Note that
trusted and *internal* are not the same; trusted simply means that the
MTA is not subverted and that you can rely on it to tell you where mail
really came in from.  It would require a bit of hacking to do something
similar in amavisd, I think, so you would have to rely on SA's own
blacklisting/whitelisting features.  In this context, if you get the SA
config right, you *can* use SPF by having SA evaluate it, looking back
through the received headers to where it really came in from.  I did
something similar to scan back through received headers in some custom
software I wrote (sadly, not available to open source as I wished to.)

  Graylisting and throttling are pointless once the mail is within
the corporate network, correct.  With regard to p0f, again you've
covered it - part of the information might be there but even if you can
get the proxy to forward you the IP via XFORWARD, it won't have the
fingerprint info.  That too needs to come from the point of contact.

  As to your next-to-last point, it would definitely be *incorrect* to
put the proxy in MY_NETS.  It should be configured in amavisd just as
you would configure an MX server which mail comes through.  That would
be a distinct policy from either MY_NETS or the typical incoming mail
policy, IMHO.

 If the powers-that-be are unable to consider open source as an
alternative, perhaps they would consider some of the commercial
products which can perform similarly to amavisd with enough tuning. 
The problem is that a lot of the commercial products are, not to put a
fine point on it, crap.  When the IT departments are fixated on
Microsoft, and trying to run anything on top of Exchange, that's a
killer.  (Not that Exchange belongs in a DMZ in any case.) I hear Lyris
Mailshield can be made to do some pretty impressive filtering, if you
tweak it enough.

  In summary, if a corporate SMTP proxy filter is inadequate to shield
the corporation from spam, unfortunately you are left with a relatively
limited subset of today's antispam features which you can actually use
on the inside.  In the end, the corporation has to live with (or die
with) the choice of filtering technology it has made.

  -- Clifton

-- 
    Clifton Royston  --  cliftonr@iandicomputing.com / cliftonr@lava.net
       President  - I and I Computing * http://www.iandicomputing.com/
 Custom programming, network design, systems and network consulting services