177
edits
Changes
From SME Server
Jump to navigationJump to searchno edit summary
==Maintainer==
==Maintainer==
This contrib has been developed by [[User:Knuddi|Jesper Knudsen]] from [http://smeoptimizer.com SME Optimizer]. If you have any question on its functionality or what it does, then just write me at jesper@swerts-knudsen.dk.
This contrib has been developed by [[User:Knuddi|Jesper Knudsen]] from [https://smeoptimizer.com SME Optimizer]. If you have any question on its functionality or what it does, then just write me at jesper@swerts-knudsen.dk.
==Description==
==Description==
=====SME Dedicated DNS Blacklist=====
=====SME Dedicated DNS Blacklist=====
The first functionality is a SME dedicated DNS Blacklist which is partially based on the user contributions. With SME Optimizer you provide data about your spam rejects and in return you get access to a large DNS blacklist. This blacklist is both providing IP as well as URI based lists and comes as a configuration option to SpamAssassin. The DNS Blacklist has as of today (October 2016) around 1.4 mio. Spam, Malware and Ransomware IP addresses as well as around 350,000 URIs. These will be provided as part of the DNS Blacklist.
The first functionality is a SME dedicated DNS Blacklist which is partially based on the user contributions. With SME Optimizer you provide data about your spam rejects and in return you get access to a large DNS blacklist. This blacklist is both providing IP as well as URI based lists and comes as a configuration option to SpamAssassin or it can directly reject via the qpsmtpd plugin. The DNS Blacklist has as of today (October 2016) around 1.4 mio. Spam, Malware and Ransomware IP addresses as well as around 350,000 URIs. These will be provided as part of the DNS Blacklist.
=====Server Monitoring=====
=====Server Monitoring=====
=====Attachment Filter=====
=====Attachment Filter=====
The system will (currently only on SME 9.2) check file attachments hashes up against a DNS based system. This will allow an extra check beyond the build-in ClamAV as this check contains malicious file hashes found by other AV engines. This functionality requires you to register for a free [https://virustotal.com VirusTotal] public API and configure the system to use it. This means that your system will, in the background, build up the has databases and all other users will benefit. This system is not expected to catch much (ClamAV does a fine job) but has show very efficient in the WannaCry attack where you will be dependent of more AV engines. This is currently in Beta, so reach out if you want to participate.
The system will (currently only on SME 9.2) check file attachments hashes up against a DNS based system. This will allow an extra check beyond the build-in ClamAV as this check contains malicious file hashes found by other AV engines. This functionality requires you to register for a free [https://virustotal.com VirusTotal] public API and configure the system to use it. This means that your system will, in the background, build up the has databases and all other users will benefit. This system is not expected to catch much (ClamAV does a fine job) but has shown very efficient in the [https://en.wikipedia.org/wiki/WannaCry_ransomware_attack WannaCry] attack where you will be dependent of more AV engines.
=====The next planned functionality is=====
=====The next considered functionality is=====
* Your suggestions... let me know...
* Allow you to configure file extensions that you do not allow (the system will handle the signatures)
* Use the DNS Blacklist directly to reject reason and not wait for SpamAssassin
* you suggestions - let me know..
==Installation==
==Installation==
Last SpamReports : 2016-10-09 18:23:02
Last SpamReports : 2016-10-09 18:23:02
Attachment Filter : Enabled
Attachment Filter : Enabled
When the attachment filter is active you will start to see log entries in /var/log/smeoptimizer.log such as these:
24-5-2017, 13:19:01 - Checking for attachments
24-5-2017, 13:19:01 - VT: OK - "3979_b679479a-fe04-439d-a86c-2e354ebd8908_d66ebd92-a361-4dd3-a32a-0f26642eebf5.pdf" didn't have any detected virus
==SMEOptimizer Configuration==
==SMEOptimizer Configuration==
-contact=[Email]: Set the contact email address where alerts are sent to - default admin@<your domain>.
-contact=[Email]: Set the contact email address where alerts are sent to - default admin@<your domain>.
-VTAPI=[API Key]: This is the VirusTotal public API key used to check attachments (will remain local).
-VTAPI=[API Key]: This is the VirusTotal public API key used to check attachments (will remain local).
-DNSBL=[qpsmtpd|sa]: This configures whether the DNS blacklist lookup rejects directly (qpsmtpd) or scores (sa=SpamAssassin).
==Privacy and Security==
The solution is dependent of the joint forces of the contributing SME servers and therefore data is shared to succeed. All communication between your SME servers and the SMEOptimizer server(s) are done via HTTPS when reporting and simple DNS lookups when checking.
====DNS Blacklist====
All IP and URL/URI checks are performed a simple DNS lookups either inline via the qpsmtpd plugin or through SpamAssassin. The sending IP address or domain is used for this lookup just as any other DNS blacklist (Spamhaus, etc.).
When your own server, based on your configured DNS blacklists, rejects a mail the SMEOptimizer qpsmtpd plugin will capture the sending IP address and the sender domain as well as the return text from the dnsbl plugin (Usually a link provided by the DNS blacklist service for further details). These details are stored in a local MySQL database and on a hourly basis transferred via HTTPS PUT to the SMEOptimizer server. Here, based on a score system, they are added to the shared DNS Blacklist for all to benefit from.
====Attachment Filter====
The system will generate a SHA1 hash based on the attached file and check this hash via a DNS lookup against the SMEOptimizer DNS server. If there is a match (A record), then the TXT record for this key provides a SHA256 and a filesize as well as Virus/Malware description. The SHA256 and size will be used to double verify the match and the description to provide a proper reject message in the qpsmtpd plugin.
If there is not match, then the SHA1, SHA256, file size and filename is stored in a local MySQL database. The SHA256 is checked up against VirusTotal and if there is a match then SHA1, SHA256, file size and filename will be sent to the SMEOptimizer server via a HTTPS PUT request. VirusTotal only allows free checke every 15 seconds and therefore this cannot be done inline (within the qpsmtpd plugin).
A no time will any attachment content leave your local server and be shared anywhere.
==Uninstall SMEOptimizer==
==Uninstall SMEOptimizer==
