OT: features / test criteria for email filtering/security product

2018-11-15 Thread Roger Goh
I'm looking at Votiro, Proofpoint & Israel email security products to reduce spam, emails from bad reputation IP, emails with malicious attachments & URL. What are the features/criteria to assess or look out for? Esp if I'm on O365. a) can link to SpamHaus, RBL etc to get bad reputation IP? b)

OT: Risks & mitigations of allowing an external sender to send to us (with sender 'same domain' as us)

2018-05-14 Thread Roger Goh
There is an external app server (that is our service provider) that we want them to blast emails to a team/department in our organization (email domain @ xyz.com) but these emails will have the sender to be in same domain as us ie @xyz.com . What are the risks of permitting such bypass (ie

Re: How to obtain blacklists IP lists

2016-12-17 Thread Roger Goh
Thanks. I'm not sure if the product I uses ie ProofPoint could do API integration to the list esp : http://mxtoolbox.com/blacklists.aspx In one forum that I join, E Exchange, I was told that usually these providers (esp antivirus vendors) will not release their blacklists because doing so will

How to obtain blacklists IP lists

2016-12-16 Thread Roger Goh
This may have been raised before: we received quite a few malicious emails (containing malicious attachments) & on tracing the senders' IP (from the 'Internet Headers' of the received mails) & key into one of the services below, noted they are malicious & then we manually block them but by then

Re: Can source and IP in email header be spoofed and how to mitigate

2016-07-29 Thread Roger Goh
Just a last post from me: is there any chance that a whitelisted IP address (whitelisted on our local email server for the remote to forward email to us as we plan to permit Tcp25 incoming for this whitelisted IP while the rest of the emails have to go to our ProofPoint) could have been spoofed?

Re: Can source and IP in email header be spoofed and how to mitigate

2016-07-28 Thread Roger Goh
nly scan for emails sent to us addressed to a_u...@xxx.com.nz On 7/28/16, Viktor Dukhovni <postfix-us...@dukhovni.org> wrote: > >> On Jul 27, 2016, at 11:24 PM, Roger Goh <gpro...@gmail.com> wrote: >> >> Can source (ie smtp.zzzbank.com.au & srvm02.zzzbank.co

Re: [OT] Re: Can source and IP in email header be spoofed and how to mitigate

2016-07-28 Thread Roger Goh
If the IP address is spoofed, how does firewall rejects it? In the case of MS Exchange, will implementing something like SPF (Sender Policy Framework) and Sender ID filtering help? Sun On Thu, Jul 28, 2016 at 11:48 AM, David Benfell <dbenf...@gmail.com> wrote: > On 07/27/2016 08:24

Can source and IP in email header be spoofed and how to mitigate

2016-07-27 Thread Roger Goh
Our headquarter's email server auto-forward emails over to our email server & I have a concern: Can source (ie smtp.zzzbank.com.au & srvm02.zzzbank.com.au below) & the IP addresses be spoofed? Received: from smtp.zzzbank.com.au (10.98.2.87) by ZZZWVEXC01ZZ.bbb.com.au (10.9.95.37) with z

Re: sendmail vs postfix : robustness, stability vulnerabilities

2015-01-25 Thread Roger Goh
on the support. Roger On Fri, Jan 23, 2015 at 11:23 PM, Viktor Dukhovni postfix-us...@dukhovni.org wrote: On Fri, Jan 23, 2015 at 09:43:39PM +0800, Roger Goh wrote: We are using a commercial version of sendmail (refer to sendmail.com) on RHEL 5.x We have seen something like 2 mails

sendmail vs postfix : robustness, stability vulnerabilities

2015-01-23 Thread Roger Goh
We are using a commercial version of sendmail (refer to sendmail.com) on RHEL 5.x We have seen something like 2 mails sent to it within 5 mins it just hung up or caused severe delay in delivery. Q1: Is postfix (which is now the default Smtp with RHEL 6.x) more robust ie can take bursts of

OT: specify relay server in mutt or settings to be done before mutt could work

2014-07-15 Thread Roger Goh
I have got the firewall rules permitted from our RHEL 5.x RHEL 6.x servers to our SMTP relay server (it runs on RHEL 5.8). In the past, I recall I have a server that I could just issue mutt command below it will send email out via the relay server at that site: mutt -s Test mail -a

Re: MUA/Smtp client/script to send mails via a Postfix relay server

2011-12-01 Thread Roger Goh
Noel provided but sendmail.cf will need to be configured. ...why ? Are you using sendmail, or are you using postfix ? I need to send mails out from an RHES4.x box (which does not have Postfix installed sendmail is not supposed to be started as it's hardened for security reason). This box is

MUA/Smtp client/script to send mails via a Postfix relay server

2011-11-28 Thread Roger Goh
Quite desperate sorry if this is OT. I have a Linux RHES 4.5 box that's on the same subnet as my Postfix box. For security reasons, I'm not allowed to ftp/scp/sftp files between this box the Postfix server. I have the following Perl script which I wanted to use to mail ( attach files) out to

Re: MUA/Smtp client/script to send mails via a Postfix relay server

2011-11-28 Thread Roger Goh
Yes, understand the syntax/example mutt nail that Jeroen Noel provided but sendmail.cf will need to be configured. I got the following script which someone has tested working on his postfix but I have a problem with RCPT TO: (need someone to tell me how to obtain a valid address for RCPT TO)

Re: MUA/Smtp client/script to send mails via a Postfix relay server

2011-11-28 Thread Roger Goh
Just to add, I'm not allowed to start up sendmail (as it's hardened for security reason), so editing sendmail.cf may not be an option. So I certainly need a script/tool to do this forwarding to the relay /postfix server Roger On Tue, Nov 29, 2011 at 11:15 AM, Roger Goh gpro...@gmail.com wrote

Too many TLS sessions : at sender or recipient's end?

2011-08-24 Thread Roger Goh
All four of us (, , mmm, ppp) suddenly received a notification email below: An app from xxxportal.com's postfix server was sending an email to all four of our mailboxes (in sss.com.au's mail server). So is the notification below indicating we need to tune TLS at xxxportal.com's postfix

Re: Automating regular checks that incoming outgoing mails are still working

2011-08-22 Thread Roger Goh
We host a portal for the citizens as add-on value, we offer a free mailbox service. Our marketing chaps blast marketing mails to subscribers of our mail service (which is also owned by us) so we're authorized to 'spam' marketing newsletters to those who signed up with us. However, some

Re: Automating regular checks that incoming outgoing mails are still working

2011-08-21 Thread Roger Goh
There could be various reasons why mails are not going out or coming in I have test scripts to send between my two postfix servers; so why not monitor those test mails hourly?

Re: Automating regular checks that incoming outgoing mails are still working

2011-08-21 Thread Roger Goh
Thanks for the Perl script Wolfgang resource were exhausted, too many MAILER-DAEMON or tens of thousands of stuck mails due to invalid email address (as shown by mailq) Then your configuration is partially or wholly incorrect. Well, it's often triggered by our mail blasting team : it's time

Tackling looping auto-reply / auto-forward mails

2011-07-27 Thread Roger Goh
My apologies if this is not the right group to post but I'm getting desperate. Currently I have a mailbox (let's refer to it as abc@exchange_pop3.com) hosted in our corporate IS MS Exchange server. This old Exchange 2003 server permits POP3 so that my CRM app can download mails from this

Re: Tackling looping auto-reply / auto-forward mails

2011-07-27 Thread Roger Goh
If users send mails to abc@postfix_pop3.com, I don't get this looping problem; it's only when they send mails to abc@exchange_pop3.com. Also, previously when POP3 was enabled on Exchange 2003 server auto-forwarding was not set up on the Exchange mailbox, I don't get this looping mails issue.

security vulnerability : SMTP daemon supports EHLO

2011-05-03 Thread Roger Goh
Hi, During a VA scan, it's reported that my postfix server has a security vulnerability : EhloCheck: SMTP daemon supports EHLO 1. How can I disable EHLO still send/receive mails? 2. Or is there a later version of postfix (let me know the version) that addresses this or any patch to

Re: security vulnerability : SMTP daemon supports EHLO

2011-05-03 Thread Roger Goh
1 more question: if there's a way to disable EHLO or fixing it via a patch, how do I verify (without running VA scan) that this EHLO vulnerability has been fixed? TIA Roger

Re: security vulnerability : SMTP daemon supports EHLO

2011-05-03 Thread Roger Goh
or empty string ( where what's the syntax to set the above suggestions?) Roger On Tue, May 3, 2011 at 11:56 PM, Roger B.A. Klorese rog...@queernet.org wrote: On May 3, 2011, at 8:49 AM, Reindl Harald wrote: Am 03.05.2011 17:34, schrieb Roger Goh: Hi, During a VA scan, it's reported

Re: security vulnerability : SMTP daemon supports EHLO

2011-05-03 Thread Roger Goh
from the url Roger Klorese provided, http://www.iss.net/security_center/reference/vuln/smtp-ehlo.htm it says : SMTP daemons that support Extended HELO (EHLO) can release information that could be useful to an attacker in performing an attack. Attackers have been known to use the EHLO command

Reducing time it takes to set undeliverable mails to MAILER-DAEMON

2011-04-02 Thread Roger Goh
1)What are the types of emails in postfix queue that would be set to MAILER-DAEMON? Is it all undeliverable mails? Or we can add in extra criteria to set incoming mails to MAILER-DAEMON ( how)? 2)I think it takes several hours currently to set undeliverable mails to MAILER-DAEMON.

mails delivered to procmail were removed ; SASL support not compiled

2011-03-17 Thread Roger Goh
Bear with me; I'm a newbie struggling to get a  newly set up postfix server to receive mails on Unix account (roger8 is the account that I've useradd'ed) 1. firstly, is ISPconfig necessary in a postfix server or I can still get a basic postfix set up without it? If it's essential where can I

Re: mails delivered to procmail were removed ; SASL support not compiled

2011-03-17 Thread Roger Goh
Thanks Noel. Further assistance needed: The message means what it says.  You have specified SASL auth, but postfix was not compiled with SASL support.  Recompile postfix with SASL or if you're using packages find a package that has SASL support. Would you be able to point me to a link that