Jeffreys Ruminations - Network Blog » Mail Tools

Spam/Virus Filtering Solutions for Small Businesses (Free)

jeffreycentex — Thu, 06 Apr 2006 07:12:37 +0000

OK, for all of you out there who work in a small business environment (or a “stingy” company, IT-wise), I have a recommendation for you on an excellent way to filter spam/virus email and even limited web traffic virus scanning – and best of all, it is free.

CopFilter (for the IPCop software firewall distribution)

From the website:

The main goal of Copfilter is to provide a free and easy to use solution to filter and scan traffic from any unsecure network, like the internet, for viruses and spam. It has been designed as a preconfigured and easy to install addon for the opensource firewall IPCop . Copfilter is a package of various opensource traffic filtering software and tools, customized and built to work together smoothly. All included proxies filter traffic transparently, which means that no client reconfiguration is necessary. It scans POP3 and SMTP emails for viruses and spam. Instead of a virus infected emails, a user will receive virus
notification messages containing details about originally sent emails, which can also be quarantined if desired. Spam emails will be tagged as spam by inserting the following text into the subject field: *** SPAM *** . With this procedure any email client will be able to use its own message filtering rules to automatically delete or move these spam messages into a different folder for a later review. HTTP and FTP traffic will also be scanned for viruses. If a virus is found, access to that web page or file will be denied.

I use a subset of this capability at the office to provide limited virus and scanning checking (I also use an Exchange-based solution, along with IMF, to enhance the Spam and Virus tracking). I have offloaded much of the core scanning infrastructure off of our somewhat “overloaded” exchange server.

This type of setup is also ideal when you need to set up a quarantine network. I put untrusted machines from the “wild” on this network in order to get their patch and AV level back up to snuff before allowing them on the real LAN.

For a small (under 25 person) business, this is an ideal, low cost solution. The standard caveats exist, though – keep the box up-to-date with all security fixes and lock it down as much as you can.

Tags: IPCOP, COPFILTER,

Another Exchange 2003 Tool Update

jeffreycentex — Thu, 06 Apr 2006 07:00:56 +0000

From the “You Had Me At EHLO” (aka, the Exchange Team):

The Exchange Best Practices Analyzer (ExBPA) version 2.6 has been released. Click here for the direct download as the ExBPA page hasn’t been updated from the 2.5 version as of yet.

Source: You Had Me At EHLO

Tags: ExBPA, Exchange

Exchange Direct Push Configuration

jeffreycentex — Tue, 04 Apr 2006 06:46:33 +0000

This is a rare Exchange posting, but with the release of MSFP ROM updates for Windows Mobile 5 Smartphones and Pocket PC Phones, Direct Push is now a reality. However, there are some optimization tweaks that can be done that would extend the battery life of the smart phone devices, plus there are some caveats when you are using firewalls that will terminate the connection too quickly.

See here for the blog entry.

I can vouch that Direct Push works well. I have a Cingular 8125 as my main phone right now. I installed the Imate MSFP ROM (available at XDA-Developers) and started using Direct Push as soon as my hosting provider (LanLogic) upgraded to SP2. Others at my office have the Sprint PPC6700 that has also been updated to the MSFP ROM. In general, we noticed a huge improvement in battery life. My Cingular 8125 now has about an average of 15% battery drain per day with DirectPush enabled and with about a half hour of phone calls. The CDMA-based PPC-6700 loses about 25% a day.

Tags: Direct Push, MSFP, AKU

Verizon Warning…

jeffreycentex — Wed, 23 Feb 2005 09:00:37 +0000

Heads up from Susan about Verizon’s new policy on SMTP relaying with Dynamic IP’s…

I thought the reasoning of the ISP’s to port block TCP Port 25 was to direct all traffic through the ISP mail server (for spam and virus control – although I haven’t seen many major ISPs virus check on the gateway level).� Now Verizon is saying that you can’t relay your mail server through their service…

At my office, we have a business class DSL account with static IP’s running Exchange Server.� We are forced to use SBC’s smarthost due to the fact that Time Warner keeps blacklisting our address space as dynamic (we have gone through the process of getting removed from the blacklist, but they “forget” about this every month or two and all email to rr.com domains fail)…

Arrrgggghhhh….

Tags: SMTP, Verizon

Mail Tools: SpamAssassin on Windows

jeffreycentex — Thu, 05 Feb 2004 08:43:34 +0000

On the matter of SpamAssassin, here is a good howto on how to install it on a Windows system:

USING SpamAssassin WITH WIN32

For low volume Exchange Systems, click here for a link on how to integrate SpamAssassin with Exchange Server 2000/2003 using event sinks.

Finally, click here for an Outlook SpamAssassin Plugin…

Mail Tool: “Rules du Jour” for Spamassassin

jeffreycentex — Thu, 05 Feb 2004 08:36:43 +0000

For those of you out there who use SpamAssassin to filter junk mail from your mailbox, I want to point y’all to a tool that can help decrease the amount of SPAM you are getting now that spammers are adjusting to the new SA rules. Take a peek at the Rules du Joursite – it will allow you to update your ruleset on a fairly frequent basis (I do it once a week at my mail server) with new rules that will help defeat the new spamming technique. After installing the default rulesets available at Rules du Jour, the amount of junk mail detected on my office domain has gone from about 80% to just under 99% (I haven’t had a false positive reported to me yet).

If you do use these additional rulesets, make sure you either increase your warning level to 6 or you will find some real email marked as spam (most real spam messages are running with a score of 30+ on my system, when they were about 6~9 before).