1. Exchange 2003 and SPAM Fighting Emmanuel Ormancey, Rafal Otto Internet Services Group Department of Information Technology CERN 3 June 2015

2. HEPiX meeting 2004 Rafal Otto (IT/IS) Agenda Exchange 2003 upgrade Mail Gateways upgrade Spam Fighting Evolution

3. HEPiX meeting 2004 Rafal Otto (IT/IS) Status of the update Update of server software started during summer ~2000 (15%) users moved to the new servers Migration should end this year Transparent: users warned by email to close their client during the night

4. HEPiX meeting 2004 Rafal Otto (IT/IS) New Features Webmail: New interface, display and navigation speed was improved. New features, like creating server side filtering rules (useful for IMAP users). Mobile features: Pocket PC can synchronize directly with server. Cached mode: Download headers only (useful when slow connection). RPC over HTTP: Connect from outside CERN, without VPN or ISA Server. Using HTTP over SSL, secure connection.

5. HEPiX meeting 2004 Rafal Otto (IT/IS) Agenda Exchange 2003 upgrade Mail Gateways upgrade Spam Fighting Evolution

6. HEPiX meeting 2004 Rafal Otto (IT/IS) Why a new architecture ? Spam and virus attacks were dramatically increasing, something had to be done. Floods happened more and more often Detection of problems must be quick, and raise alarms when manual intervention is needed. Old architecture was very complex, any modification could create unexpected side effects. Running on old servers, new hardware was needed. The mail service was running since many years, was modified by many different teams, many different features were added, stores were migrated to MMM, giving this architecture…

7. HEPiX meeting 2004 Rafal Otto (IT/IS) Old architecture Listbox4 Exchange Back Ends smtp4 / mint smtp3 / smtpmail6 Other Sendmail mail3 Mmm (Front Ends) Outside CernUsers mail8mail7 Antivirus mail5

8. HEPiX meeting 2004 Rafal Otto (IT/IS) New architecture Listbox4 Exchange Back Ends Other Sendmail Outside CernUsers cernmxlb cernmx01 to 06, load balanced Antivirus, Antispam, Antiflood. Authenticated Trusted host Mmm (Front Ends)

9. HEPiX meeting 2004 Rafal Otto (IT/IS) Feature Overview Low level Spam Filter ESRE Evident Spam Rejection based on Envelope DNS checks Internal Blacklists Anti Flood System IFD Intelligent Flood Detection IPFromTo Reject If score too high Content Spam Filter SpamKiller Content based Intelligent Detection Add header with Spam Detection Score Reject Clean mail with Spam header Virus Scanning Symantec Symantec Antivirus for Exchange Clean viruses, remove un-cleanable files. Mail from Internet Exchange Back-Ends / Other CERN Mail Servers Internet / Outside CERN Reject If 500 mails in 10 minutes

10. HEPiX meeting 2004 Rafal Otto (IT/IS) Technical Overview Incoming Mail HELO / EHLO MAIL FROM RCPT TO _EOD Nothing done at this level, Sinks don’t provide information on sender’s IP. CommandEvent Sink action End Of Data If IP is Back-End server, abort checks. (currently all CERN IPs). IP checks: Reject if IP is listed in IPBadBoys. Reject if no Reverse DNS configured for IP. Reject if domain (given by reverse DNS) if listed in SpamDomains. Reject if IP is currently Flooding. From (envelope From) checks: Reject if From listed in Spammers. Reject if no MX configured for From domain. Reject if From is currently Flooding. Reject if no Reverse SMTP Connect. If IP is Back-End server, abort checks. To checks: Reject if domain not listed in RelayDomains. Reject if To listed in SpamDests. Reject if To is currently Flooding. If IP is Back-End server, abort checks, log outgoing message. From (real displayed From) checks: Reject if From listed in Spammers. Reject if no MX configured for From domain. Reject if From is currently Flooding. Add X-External header if IP not listed in Inside CERN IP. Send mail to SpamKiller servers: Write score in Keywords header. If Spam rewrite subject if recipient match configuration. If Spam change recipient if match configuration.

11. HEPiX meeting 2004 Rafal Otto (IT/IS) Benefits SMTP Gateways have a 100% uptime, due to load balancing. Floods (everyday!) are automatically detected and blocked. Automatic generated graphics and mail queues monitoring show quickly any problem. Configuration and log files can easily be checked by Helpdesk, if any problem is raised.

12. HEPiX meeting 2004 Rafal Otto (IT/IS) Gateways statistics 1 day statistics on SMTP gateways: CERN receives 84% of Spam (92% on Week Ends) ! But 81% is rejected. Huge increase of mails rejected due to forbidden attachments, from 15pm to 3am. This is a virus attack ! Classic day, ‘No Reverse DNS’ reject reason is number one, except when a flood is detected.

13. HEPiX meeting 2004 Rafal Otto (IT/IS) Agenda Exchange 2003 upgrade Mail Gateways upgrade Spam Fighting Evolution

14. HEPiX meeting 2004 Rafal Otto (IT/IS) Current Status Content based detection is not worth improving Increasing 1% requires lot of work, and may produce false positives. Focus on low level Spam Rejection Reverse DNS activated on 15th June: increase of Spam rejection from 55% to 85%. Reverse SMTP connect rule activated on 6th October. Next steps: Try and identify new techniques: SPF, SenderID, DomainKeys. Try to reject evident Spams, detected by SpamKiller, CERN Content based Spam detection engine.

15. HEPiX meeting 2004 Rafal Otto (IT/IS) Reverse SMTP Connect Reverse SMTP Connect process: CERN mail gateway receives a mail from bob@domain.combob@domain.com CERN mail gateway will simulate a reply to the bob@domain.com, by trying to connect to the SMTP server responsible for domain.com (MX): bob@domain.com If connection succeeds, the mail is accepted. If connection fails, mail is rejected with a temporary error, if the remote server has temporary problems, the mail will be resent. 25% of mails that we currently accept could be rejected with this rule. No false positives detected.

16. HEPiX meeting 2004 Rafal Otto (IT/IS) Future “Standards” Solutions being investigated SPF (Sender Policy Framework), Unified SPF evolution (main problem of SPF is that it does not support forwarding). SenderID: merge of SPF and MS Caller-ID. DomainKeys proposed by Yahoo Google put this idea into production TODAY! All these new standards allow to detect mail sender forgery They will not block Spam A validated check DOES NOT mean it is not a Spam.