Messaging Gateway

 View Only
Expand all | Collapse all

Invalid recipient validation and directory harvest attacks per domain

  • 1.  Invalid recipient validation and directory harvest attacks per domain

    Posted Jan 27, 2009 08:01 AM

    Hi there,

     

    1. Is it possible to do invalid recipient validation on some domains? I've seen an option under smtp->local domains->edit local domain but I'm not sure. I've more than 1 local domain but only 1 domain uses LDAP as directory store.

     

    2. And similar to the previous question, is it possible to enable directory harvest attacks on some domains?

     

    Thanks in advance,

    Nitass

     



  • 2.  RE: Invalid recipient validation and directory harvest attacks per domain
    Best Answer

    Posted Jan 27, 2009 10:45 AM

    Hi Nitass,

     

    You can do exactly what you are looking to do. I'm assuming here you are running version the SBG and version 7.7 which I believe you are, however in future posts remember to mention the product and version.

     

    The first step is create a Recipient Validation LDAP source from the Administration -> Settings -> LDAP page. A few tips for creating the source:

     

    -If this is an Active Directory directory I'd normally use port 3268 which is the Global Catalog port instead of the default port 389 as I find it can return queries faster.

     

    -For LDAP server usage, Authentication and Synchronization are checked by default, you can uncheck these and only check Recipient Validation which is what you are interested in.

     

    - Make sure to specify a Base DN that contains the whole userbase for the recipients you are looking to protect.

     

    -If you are using Active Directory, you can pretty much keep the default query filter which will check for the mail attribute and proxyaddress attributes for a users email address when a connection is made.

     

    Once the source is set up, from the Protocols -> SMTP -> Local Domains page, edit the local domain you want to enable Recipient Validation for and check the box to enable recipient validation for the domain. Save this, then go to the Protocol -> SMTP -> Invalid Recipients page and select the Reject invalid recipients option and save. You should now be rejecting messages to recipients that don't exist in the domain you specified.

     

    Finally, you definitely want to enable the DHA functionality as at this point as your userbase is exposed to spammers as they won't receive rejections when they send messages to valid recipients.  Do this from the Spam -> Settings -> Directory Harvest Attacks page. The Brightmail Gateway will only count bad recipents for the domains where you have enabled recipient validation. That's pretty much it, you now have the luxury of not having to even accept a lot of the spam you'll receive...

     

    Kevin



  • 3.  RE: Invalid recipient validation and directory harvest attacks per domain

    Posted Jan 27, 2009 11:13 AM

    Kevin,

     

    Noted with thanks.

     

    Regards,

    Nitass