19
Dec
Limit the Chance of Your MDaemon Accounts Being Hijacked and Abused by Spammers
This year in particular, I've seen an increasing number of users' email account credentials become compromised, which has allowed spammers free reign to use their mail server to send spam out to the Internet.
The usual result is an overflowing outbound mail queue, thousands of bounce messages coming in and your server's IP address being blacklisted.
The first thing to note is that if your company has an email server, you should assume that spammers will always be trying to hijack users' accounts by guessing their passwords.
In this post I will run through a few simple pro-active settings checks that can reduce the chances of this happening and - in the unfortunate event that it does happen - can limit the resulting negative effects.
Over the last 24 hours we have seen a few instances where valid email from Outlook.com servers has been rejected by our customers MDaemon and SecurityGateway servers due to SPF record checks.
The emails getting rejected do appear to be valid messages but have been arriving from an IP address not included in the sending servers SPF records. The common factor here is that all the sending domains are using outlook.com services.
If you're using Office 365, or one of the many hosted Exchange variants available today, you may be aware that MailStore has long been able to give you a complete and automatically synchronised off-site copy of your mail.
I've always been happy recommending it as a solution, 
If you've recently made the move to MailStore version 9, it's entirely possible you'll be sat there wondering why on earth all of those archiving jobs you had set up can't be modified any more.
Today's nugget of MDaemon wisdom comes from conversations I've had with a small number of customers reporting they're unable to send outbound email to specific recipients.
Upon closer inspection of the error in the SMTP (OUT) log, there's a message reading "SSL negotiation failed".
Configuring any Web service to work over HTTP using SSL is a good idea.
We certainly recommend it for BackupAssist's Multi-site Manager (BAMM) and in this post I'll show you how to create an SSL certificate you can then bind this kind of service to.
A new SSL vulnerability is doing the rounds this morning, known as POODLE, or Padding Oracle On Downgraded Legacy Encryption.
POODLE is a newly disclosed vulnerability in the legacy SSL 3.0 protocol that could be exposing users of newer Transport Layer Security (TLS) encryption protocols to risk.
If exploited, the POODLE flaw could potentially enable an attacker to access and read encrypted communications.
If you have recently upgraded to MailStore version 9 you may not be aware that the new maximum number of messages that an archive can contain has now been increased from 500,000 to 5,000,000 messages.
If you are like me and you have found yourself with a collection of much smaller MailStore message archives it is now much easier to merge these together into a smaller number of larger archives.
If you have ever suspected that a slow performing server is down to slow access to a hard drive you may have started searching the web for a tool to help diagnose the root of the problem.
What you might not know is that Windows has a very handy built-in tool for doing just that and can provide some excellent real-time statistics.
As with a lot of new technologies the real power comes from when they are used by the masses.
Sender Policy Framework or SPF is no longer a new technology and is generally widely used to help preserve email domain reputation for large organisations, but it's as well-known about in the Small to Medium sized business end of the email market.
Spammers know this and have started to target domains that do not have valid SPF records as they can most easily be used to spoof and send spam claiming to be from valid companies. Often these types of spoofed email are used in phishing attacks to then harvest more valuable data, so the smaller companies that can adopt the use of SPF the better.