Monitor/audit Inbound/outbound Emails
Apr 18, 2008any good solution for corporates out there?
View 13 Replies
ADVERTISEMENT
Iptables - Block Inbound & Outbound
Jun 20, 2007What is the command I need to issue to block an IP address from my server? I need to block both inbound and outbound access.
I need the rule to append to existing rules so if the server is rebooted the rule will still be in effect.
Port Speed: Big Difference Inbound Vs Outbound
May 18, 2008I am moving into the world of dedicated servers (from VPS). I just got a server from Serveraday.com /OLM.net.
When I was doing bandwidth tests, I found the server's inbound speed was much slower than outbound. I tried downloading a bunch of different provider's 10MB test files from the command line of my server using wget. They were all around 20-30 Kbps.
When I take those same 10MB files and serve them from my dedicated box, the results are much different. My server can push the files out at over 1Mbps.
Why would my server be set up this way, and is this normal behaviour? I sent a ticket to OLM, but their support seems to take a long time. So I figured I would bounce the question off of all you here on WHT
Mailenable : Copy All Inbound / Outbound Email
Feb 16, 2007I'm using the free edition of MailEnable and need to configure each post office to copy all incoming and outgoing email to one of the email accounts on the same post office.
Is there a way to configure this ?
I know I can configure mail forwarding on incoming mail per account but need to do it for all acounts (except the audit account).
e.g. anythinghere@dbnetsolutions.co.uk
incoming or outgoing would be copied to audit@dbnetsolutions.co.uk
Plesk 12.x / Linux :: Keep Permanent Record Of All Mail Inbound And Outbound - Log Rotation Settings
Nov 19, 20141/ What is the difference between maillog and maillog.processed? I want to keep a permanent record of all mail inbound and outbound even if delivery is deferred by the gray listing. I'm not sure which one is the best to keep.
2/ I would like to change the way that the mail logs get log rotated. I am struggling to work out exactly what happens at the moment but I would like to rotate the log out every day regardless of size. I think currently that the maillog.processed is rotated daily if it is over a specific size.
Plesk 11.x / Linux :: All Inbound Emails Bouncing - TLS Negotiation Failed
Nov 23, 2014I ran the script in KB article 123160 [1] to disable SSLv3 and avoid the POODLE vulnerability, but I recently discovered that this has caused all inbound emails to bounce. The bounce message says, "TLS Negotiation failed."
Here is Plesk version information:
# cat /usr/local/psa/version
11.5.30 CentOS 5 115140407.17
# cat /root/.autoinstaller/microupdates.xml
<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<patches>
<product id="plesk" version="11.5.30" installed-at="20131109T085857">
<patch version="47" timestamp="" installed-at="20141123T162005" />
[URL] ....
How Can I Monitor Emails From Php/asp Sites
Mar 29, 2007I have an MSWIN 2003 hosting server with 350 working domains.
The problem is that I receive hundreds of failures of emails that get sent from my server..to some random email addresses.
I try to find a way to locate the website with the script, that spams but logs dont help at all.
The mail server is Mail Enable.
The messaged I get back wont help either..
they are something like this:
Message contents follow:
Received: from win12 ([127.0.0.1]) by myserver.tld with MailEnable ESMTP; Thu, 29 Mar 2007 01:51:11 +0300
Date: Thu, 29 Mar 2007 01:51:11 �0200
Subject: Verify Your Account Details
To: deeandra@aol.com
From: U.S. Bank <internetbanking@usbank.com>
Reply-To:
If I try to search or grep all the files hosted in the server that include some word like "Account Details" it will not find anything...
VPS Audit On Technical Skills
Apr 27, 2008I am thinking of Futurehosting.biz unmanaged server.
Can you please see if these skills are enough:
(1) Futurehosting will do the security setups.
Skill-sets:
(2) use of ssh to backup mysql, directory contents; do file management (create directories, move files); restore mysql
What other skill-sets do i need?
(3) do i need to know how to install o/s? (gulp!)
(4) setup email accounts?
(5) create sub-domains?
I thought of downloading webmin (i read about it in the other posts but have no experience) and will it help in points (3) to
(5)?
Company Recommendation For Security Audit
Jan 5, 2007Can someone recommend an affordable shop that performs security audits a more specifically network and web-application penetration tests?
View 3 Replies View RelatedPlesk 12.x / Linux :: Empty Modsec Audit Log?
May 26, 2015I'm testing Plesk 12.1 and noticed after enabling ModSecurity, the modsec_audit log file is empty.
I'm running CentOS7.1 w/Plesk 12.1.23
Lynis (Unix Audit Tool), Technical Input
Jun 22, 2008After peeking around at this board for some years, I decided to create an account.
I'm the original author of Rootkit Hunter and decided to create a new tool, named Lynis.
Lynis is an auditing tool for Unix (Linux, BSD and other). It scans the system and available software to detect security issues, bad/insecure configuration options and unsafe file(s) permissions. It tries to assist administrators in using and maintaining best practices, but also in the common things which get forgotten (like expired SSL certificates).
Though Lynis has been available for some months now, and many
updates/suggestions have been implemented, it still can use a broader user base. So my issue (we are in the technical issues section after all) is that I like more input and want to know what other people audit on their systems. Or what tools they like the most. Of course I have many ideas myself, but with the many different people here (in skills and specialties), every input is most likely improving the tool and increasing security for others as well.
In case you like to try the software (GPL, free to use), the software can be found at www . rootkit .nl (can't use URL's yet, due 5 post policy)
Since I don't only want to announce my tool (but like to have some input), I placed it in this section, hope it doesn't look like a "commercial" sell.
VPS With Mostly Inbound Traffic
Mar 24, 2009Imagine you want a set of servers (VPSs would be a cheaper choice, that is why I am posting here) that do not have much outbound traffic but download from other servers (more or less as spiders, but I am not trying to create a web index). Disk space or memory size are not important, but port speed and monthly transfer should be as high as possible. As inbound traffic is less frequently used, I wonder if any provider offer cheaper rates if traffic is like this.
I have been searching the forums and have not found too much about this topic (a quite related post named "I want to download the Internet" or something similar did not get a conclusion).
Why Inbound Traffic So High
Dec 18, 2008Why did my inbound traffic jump? Any ideas what could be happening here? I have this server and do not upload anything on the server?
View 12 Replies View RelatedIs It Possible To Specify An IP Address To Use For Inbound Traffic
Feb 23, 2007I have 2 IPs bounded on a Windows 2003 server. These 2 IPs have different network routes (one uses network A, one uses network B). Obviously for outbound traffic I can freely choose which IP to use (I simply choose to use [url]or [url]), however I wonder if it's possible to tell the server which IP it should use for inbound traffic when I need to download something from the internet to the server?
View 1 Replies View RelatedInbound SYN Flood Attack
Jan 11, 2007my server under attack with syn flood and i attach the active connection during attack
View 2 Replies View RelatedError APF :: {glob} Opening Inbound Udp Port
Aug 10, 2008We have following error when try to start apf in one of our vps:
apf(3126): {glob} opening inbound tcp port 80 on 0/0
apf(3126): {glob} opening inbound tcp port 110 on 0/0
apf(3126): {glob} opening inbound tcp port 111 on 0/0
apf(3126): {glob} opening inbound tcp port 143 on 0/0
apf(3126): {glob} opening inbound tcp port 443 on 0/0
apf(3126): {glob} opening inbound tcp port 465 on 0/0
apf(3126): {glob} opening inbound tcp port 623 on 0/0
apf(3126): {glob} opening inbound tcp port 918 on 0/0
apf(3126): {glob} opening inbound tcp port 993 on 0/0
apf(3126): {glob} opening inbound tcp port 995 on 0/0
apf(3126): {glob} opening inbound tcp port 2082 on 0/0
apf(3126): {glob} opening inbound tcp port 2083 on 0/0
apf(3126): {glob} opening inbound tcp port 2086 on 0/0
apf(3126): {glob} opening inbound tcp port 2087 on 0/0
apf(3126): {glob} opening inbound tcp port 2095 on 0/0
apf(3126): {glob} opening inbound tcp port 2096 on 0/0
apf(3126): {glob} opening inbound tcp port 3306 on 0/0
apf(3126): {glob} opening inbound tcp port 3389 on 0/0
apf(3126): {glob} opening inbound tcp port 6666 on 0/0
apf(3126): {glob} opening inbound tcp port 7776 on 0/0
apf(3126): {glob} opening inbound tcp port 7777 on 0/0
apf(3126): {glob} opening inbound tcp port 7778 on 0/0
apf(3126): {glob} opening inbound tcp port 7779 on 0/0
apf(3126): {glob} opening inbound tcp port 8887 on 0/0
apf(3126): {glob} opening inbound tcp port 8888 on 0/0
apf(3126): {glob} opening inbound tcp port 8889 on 0/0
apf(3126): {glob} opening inbound udp port 21 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 53 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 161 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 465 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 623 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 873 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 21 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 22 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 25 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 26 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 27 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 37 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 43 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 53 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 80 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 110 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 113 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 443 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 465 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 623 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 873 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 2089 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 3389 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 20 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 21 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 53 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 161 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 465 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 623 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 873 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 3 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 5 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 11 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 0 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 30 on 0/0
Plesk 12.x / Linux :: Inbound TLS Due To Standard DNS Template
Jul 17, 2014With the standard-DNS-Layout every customer has an MX-entry like MX 10 mail.customerdomainexample.com
The problem is, that inbound mailservers get a TLS warning, because the mailhostname does not match mail.companydomainexample.com, which is the domain with a valid SSL-Certificate pointing to the same server.
Wouldn't it make sense to change the default template to mail.companydomainexample.com since it is the same machine anyway?
Plesk 12.x / Windows :: Spammers Blocking Inbound SMTP
Sep 19, 2014I am having some problems with the inbound smtp sockets, we are receiving a constant attack from spammers, and they are taking all the sockets we have open for our users. We have enable SPF, greylisting, inbound control access through authentication, relay access with authentication also. but after some weeks we are on the same situation yet. We have spam assasin also installed as power pack from plesk, and we have add DSN black list from b.barracudacentral.org, bl.mailspike.net and bl.spamcop.net but we still suffer from this problem.
We have also try to increase the socket assigned to 200 and after some minutes they used all again and the CPU change increase up to 25% of the total capacity.
Exim Outbound Relay Per Domain
May 4, 2008I have been searching for a solution to a problem that shouldn't exist but it does.
Background:
I have a customer on a UK server who sends emails to 500+ recipients on a monthly basis, and all but 3 emails are delivered....
The 3 that don't go, bounce after 3 days (as per the exim setup)
The 3 recipient domain's that reject don't seem to accept email from UK/European ip's and I have tried to send them emails from 4 different networks and still they bounce.
I have even tried to contact them via gmail, and still not heard back.
Proposed solution:
I want to be able to send email for that 1 domain to a Postfix Relay I have in the US.
Question:
How do I achieve this within Exim (a Cpanel Server).
I have found that so far its to do with the Router Configuration section within the Cpanel Exim setup, but I cannot seem to find an example of what and where i need to change the config...
Can anyone provide an example?
Is It Possible To Restrict Outbound Email With Smartermail
Jul 20, 2009A prospect wants an email server that could allow him to restrict some accounts and make them send emails only to the companies domain.
I was thinking of setting up a VPS with smartermail, so I was wondering if this be done with smartermail?
HiVelocity Forcing Cogent Outbound
Mar 29, 2009Could you guys look and see if what I am seeing is right? They offer Global Crossing and Cogent officially. So if I use GLBX looking glass, I get this.
Trying trace from node 'Miami, FL, US' to '96.31.73.xxx'
1 64.214.16.65 (64.214.16.65) 0.761 ms 0.608 ms
2 so0-0-0-2488M.ar2.TPA1.gblx.net (67.17.66.165) 5.690 ms 5.695 ms
3 WBS-CONNECT-LLC.ae0.409.ar2.TPA1.gblx.net (64.214.147.222) 5.731 ms 5.880 ms
4 69.46.31.106 (69.46.31.106) 7.442 ms 6.667 ms
5 node1.sarorahosting.com (96.31.73.2) 15.734 ms 15.993 ms
6 96.31.73.xxx (96.31.73.xxx) 15.861 ms 15.795 ms
Now if I tracert from the VPS to the GLBX router, I get this.
traceroute to 64.214.16.65 (64.214.16.65), 30 hops max, 40 byte packets
1 node1.sarorahosting.com (96.31.73.2) 0.072 ms 0.035 ms 0.008 ms
2 69.46.31.105 (69.46.31.105) 0.731 ms 0.863 ms 1.003 ms
3 gi0-6.na21.b001841-0.tpa01.atlas.cogentco.com (38.99.204.33) 1.147 ms 1.142 ms 1.428 ms
4 gi4-1.core01.tpa01.atlas.cogentco.com (38.20.33.89) 0.818 ms 0.814 ms 0.807 ms
5 po2-0.core01.mco01.atlas.cogentco.com (154.54.27.90) 148.004 ms * *
6 po5-0.core01.jax01.atlas.cogentco.com (66.28.4.146) 5.847 ms 5.839 ms 5.872 ms
7 po5-0.core01.atl01.atlas.cogentco.com (154.54.3.197) 11.953 ms 23.819 ms 23.870 ms
8 te3-3.ccr01.atl01.atlas.cogentco.com (154.54.5.38) 11.721 ms 11.752 ms 11.787 ms
9 te8-2.mpd01.atl04.atlas.cogentco.com (154.54.3.174) 11.962 ms 11.921 ms 11.987 ms
10 ge4-1-0-390-1000M.ar4.ATL1.gblx.net (64.208.110.97) 12.252 ms 12.359 ms 12.444 ms
11 64.214.16.65 (64.214.16.65) 16.026 ms 16.061 ms 16.594 ms
Now what would be causing this to happen?
Default Outbound IP Address With Virutal IPs
Mar 24, 2009I have an interesting situation on my CentOS 4 server. I have a number of virtual adapters (e.g. eth0:1, eth0:2 etc), and for some reason all outbound traffic is going through one of these, not eth0. If I go to ipchicken.com, it shows the ipaddress of a virtual adapter, not the normal eth0 adapter.
I have been looking around for information on how to set the default adapter to eth0, but I can't seem to find anything. I can't reboot yet, as it's a production server, so I have to wait for 'scheduled maintenance'. If that's the solution, I can try it, but I am sure there is another underlying issue/routine here.
Is there a way, while live, to set the outbound adapter back to eth0?
Please note, that I have only just realized this has happened. In fact, it has been this way since November. I can tell because server name stamps on Email messages sent from this server indicate a virtual domain at that IP address. I recall I had done some work around that time, which had involved me ifup'ing and ifdown'ing some of these adapters (but not eth0, or the eth0:100 adapter (if I recall correctly) that is now the default).
Also note that I have groups of eth0 adapters, such like:
eth0:1
eth0:2
eth0:3
eth0:100
eth0:101
eth0:102
It's the eth0:100 adapter that is now the default.
Plesk 12.x / Linux :: Mail - Outbound Only?
Oct 14, 2014We have an AWS plesk instance with around 400 domains on. All domains DNS are pointing mail to a different server and almost all domains have a contact form on their website.
the problem is, the contact forms won't work as mail is on a different server. I'm assuming that the local server thinks mail is on the server and thinks it has already been received?
is this because we need to disable incoming mail for all of these domains? if so how would we go about doing this? I tried stopping all courier-imap services but this didn't seem to work.
How To Setup Outbound Email Forwarding In Cpanel ?
Nov 14, 2006I need to setup forwarding of a copy of all outbound smtp emails from clients domain (setup on CentOS/cPanel) to their backup gmail / pop account...
View 0 Replies View RelatedServer Sending High Outbound Bandwidth
Nov 6, 2008My datacenter has told me about my server sending high amount of outbound bandwidth from my server:
During the attack time my email logs, I found several messages:
cpdavd failed @ Thu Nov 6 12:21:18 2008. A restart was attempted
automagically.
Question #1. How can I check which user is using cpdavd (connect from their PC to the home folder)
I suspect someone is connecting their PC to my server and uses very high bandwidth!
The datacenter says the attack is still going on when they plug in the server.
Question #2. How can I check what is sending outgoing traffic on the server right now?
Can't Send Outbound Email From My Server With Comcast
Nov 7, 2008It appears Comcast is now blocking port 25. As a result, I can't sent outbound email via my dedicated server. They had me change to port 587 for my comast email account, but that doesn't solve my not being able to send outbound from my dedicated server.
Is there anythighn I can do (like change the post my mail server uses to 587) so that I can send outbound mail from my server with outlook (over Comcast connection) or am I just stuck now with using web mail?
Can We Create OutBound Rules In Smarter Mail
Mar 6, 2008i have installed a new mail server i.e. SmarterMail, and from past few days i have devoted much time to find "How to create Out Bound rules in Smarter Mail?" but unfortunately i ended up with no solution, hence here i am seeking help from all the member of WHT for my two questions:
1) Can we create an out bound rule in smartermail?
2)if yes, then what is the process for same?
Stop Outbound Spam On An Open Wireless Network
Jan 31, 2008I'm not sure if this is the right place to be posting this, but at our hotel, we have wireless routers (Linksys) that any of our clients can use to connect their laptops to the internet. We have been getting reports from our ISP that spam has been coming from our external IP address, so I wanted to know what people would recommend as ways to combat either our computers or any of our clients' computers from sending out spam. The internet is connected through a firewall/server computer running linux. I thought about blocking port 25, but I'm sure we would have clients complaining about not being able to send any mail.
View 9 Replies View RelatedSpam Test For Outbound False Positive Mail
Jul 9, 2007I tried a little searching both in Google and on here but this is probably going to be a private or member-based thing anyway.
I've gotten a couple comments that some of my outbound personal mail is ending up in spam folders. I think it's almost completely limited to having Outlook (or Express?) as a client... which I assume doesn't even do network-based lookups. Nonetheless I don't seem to be on any blacklists, and running it through my own spamassassin filter comes up basically zero score. But the fact that more than one person has had the problem concerns me greatly. Also, I haven't seen any significant reason why the content itself would trigger anything.
I realize a public spam test service would basically be a "testing ground" for spammers to evade detection, but there's obviously legitimate uses as well... is there such a tool somewhere? Thanks for any advice. Public information sharing is key to a forum, but PMs are welcome in this case.