Category Archives: General Stuff

The great spam-off, part 3: Enter the Praetor

The next product on my evaluation list is CMS’ Praetor. My initial impression is that this is a complex, full-featured product, and it’s expensive, too. (The fact that CMS is offering a 30% discount if you’re using a competing product helps reduce the sting somewhat.) It supports X- headers for filtering and has a range of quarantine options. However, I’m not crazy about three aspects of the product:

  • it doesn’t use the Windows Installer, and its custom installer doesn’t bother to check for existing SMTP services on a machine
  • it has its own separate administration program (which apparently can’t be installed on any machine other than the one running Praetor– so much for remote administration)
  • it doesn’t integrate directly with Exchange. Although CMS says you can run it on your Exchange server, they seem to recommend running it on a separate box, so that’s what I’m doing. It didn’t coexist well with ISA in my very limited testing, so for now it’s on a separate machine.

I’m also not too impressed with the documentation; while it is complete, it’s formatted using the old “ransom note” style template, and it’s a reference. For a product this complex, a task-oriented doc would be much more useful.

Comments Off on The great spam-off, part 3: Enter the Praetor

Filed under General Stuff, Musings

The great spam-off, part 2

MailEssentials has been running for the last week or so. After a little experimentation, I discovered that it wasn’t catching spam because I’m an idiot. I hadn’t specified any SMTP domains as inbound, so ME was looking for spam sent to *@robichaux.local– since robichaux.net and 3sharp.com are the domains I use, it wasn’t catching anything. After I fixed that, it began behaving as expected. However, its lack of a way to add subject tags to indicate spam means that I have to route all suspected spam to a public folder– where E2K turns it into an IPM.Post item, so it loses its original addressee information. Redirecting all the spam to a single mailbox works, but that raises the question of how to redirect it; the only way I can see to do it is with a script that adds a spam tag to the subject and redirects the message. That’s more trouble than I’m willing to go to for this product. In GFI’s favor, their product installs and uninstalls cleanly, it’s stable, and it has good documentation. However, it’s time to try something else.
UPDATE: GFI support confirms that their product doesn’t allow subject rewriting, and they’re not likely to add it.

Comments Off on The great spam-off, part 2

Filed under General Stuff, Musings

In the balance

So, some reader mail:

What struck me about your editorial was that you were spending time with your family and still checking email. Is your family really that unimportant that you have to check email when you are having family time? This is a prime example of work/family balance having gone all wrong.
There are too many examples of people not knowing how to relax that they eventually succumb to a stress attack that prevents them from working again – or worse, their family loses them permanently. Perhaps it is worthwhile learning that email is like postal mail. You CAN leave it until you have finished the family time. You can also switch off the mobile phone!
Nothing – especially work – should interrupt family time. No wonder the divorce rate is so high.

Now, of course, there’s nothing I like better than reader mail, even when it’s nosy and presumptuous. In this case, I reassured the writer that my work/life balance was just fine, and that the divorce rate here in the Robichaux family is holding steady at 0% after 11 years. I also pointed out that checking email while the kids are napping hardly constitutes vacation abuse. I didn’t bother to explain that checking email regularly is one of those quaint business practices that allows me to make it so my family can eat regularly, and that an IT support manager for a company specializing in HR communications might not understand that so well.
So, the executive summary: I love hearing from y’all, but let’s leave my family out of it, ‘kay? Otherwise I shall have to improve my work/life balance by sending my three noisy, energetic young sons to your house.

Comments Off on In the balance

Filed under General Stuff

The great spam-off, part 1

So, I finally decided that the volume of spam on my servers had grown past my ability to tolerate. I decided to hold a spam-off by testing several well-known products and reporting the results here. My critieria are simple if unscientific: whichever product gives the best price/performance/usability ratio wins.
I started with GFI MailEssentials, which has been widely praised in a variety of places. It downloaded and installed easily (great installer), but after three days, it hasn’t caught any spam, at least according to its own logs! It doesn’t offer a way to quarantine spam into a public folder, and there’s no way to mark a message as suspected spam. Other than that, it’s great 🙂 I’ll post an update after I check with their technical support; I can see that the event sink is working because some messages from hosts on the ORBS RBL have been NDR’d (at least according to the logs).

Comments Off on The great spam-off, part 1

Filed under General Stuff, Musings

Run E2K admin tools on WinXP

Hallejulah! Microsoft has released a patch that allows the Exchange System Manager tool to run on Windows XP. As it turns out, getting this done took a lot of work from several product teams at Microsoft. Good for them– this is a welcome, if overdue, release.

Comments Off on Run E2K admin tools on WinXP

Filed under General Stuff, Musings

TechNet chat: Using ISA Server to Securely Publish Exchange Server

TechNet is sponsoring yet another Exchange security chat, this one with folks from the ISA Server product team. April 9, from 1200-1300 EST / 0900-1000 PST / 1600-1700 GMT.

Comments Off on TechNet chat: Using ISA Server to Securely Publish Exchange Server

Filed under General Stuff, Musings

Free SQL security chapter

Just in from NTbugtraq: Erik Birkholz is giving away the SQL Server chapter from his new book, SPECIAL OPS: Host and Network Security for Microsoft, UNIX, and Oracle. I have no idea if the chapter is good or not; I do know that the book’s Exchange chapter was written by Jim McBee, who knows how many beans make five. You can get it directly, or check out the book’s cool web site (much cooler than this one, I must admit.)

Comments Off on Free SQL security chapter

Filed under General Stuff

TechNet chats: wireless & Exchange security

Two more security-related TechNet chats to announce this week:

  • Wireless security (March 5, 1000 PST/1300 EST/1800 GMT). Are you thinking about setting up a wireless network at the office? At home? If so, you won’t want to miss this chat. We can answer questions about how to control who accesses your network, WEP, and integration with Windows. (Attend the web cast immediately prior to this chat for additional information on wireless security.)
  • Exchange security (March 5, 0700 PST/1000 EST/1500 GMT) Come and ask your questions relating to Exchange Security. Questions can range from email virus protection to encryption to OWA configurations. Come test your questions against skilled Microsoft Technology Specialists.

Comments Off on TechNet chats: wireless & Exchange security

Filed under General Stuff, Musings

Securing Exchange with ISA Server

Sure, you could read my book; if you really wanted the straight scoop, you could buy Shinder’s ISA book, which has a wealth of ISA-specific information. You could also read this free article from SecurityFocus to help you get started.

Comments Off on Securing Exchange with ISA Server

Filed under General Stuff, Musings

MEC? TechEd? MEC Ed?

The always-subtle Kim Cameron-Webb came up with “MEC Ed” as the new name for this year’s TechEd conference; for the first time, its content is being combined with the MEC of yore. Dallas in June? I’ll be there. Sign up now and get a $400 discount.

Comments Off on MEC? TechEd? MEC Ed?

Filed under General Stuff, Musings

SMTP, or not SMTP?

My question is: Is SMTP the only protocol / port required for basic email connectivity through a firewall?
Here’s the scenario. We have a simple exchange 2000 implementation: one server, one network, and one firewall separating us from the outside. We only have a need to send and receive email with the outside. I have a dispute with a fellow admin (who also happens to be the boss and has final say – hence the need for an authoritative answer) that believes ports 135-139, 445 and 61007 need to be open at the firewall for exchange to send/receive correctly. I insist they need to be closed, as they are unnecessary and for security concerns. Thank you for any help you can provide.

Continue reading

Comments Off on SMTP, or not SMTP?

Filed under General Stuff

For some value of “shallow”…

From a friend who shall remain nameless, lest he get flamed to oblivion. I think this speaks for itself. Physician, heal thyself.

Eric Raymond coined the term “Many eyes make all bugs shallow”. he has an open source product, Fetchmail. in the last six months there have been at least four serious buffer overruns in the product:

Oldest affected version Release date</td?

Vuln date Days til found CVE Number Short comment
5.3 2/22/20 10/11/02 962 CAN-2002-1174 long headers
5.3 2/22/00 10/11/02 962 CAN-2002-1175 DNS records
5.9 8/13/01 12/23/02 497 CAN-2002-1365 “@”s in local addresses
2.5 12/23/96 6/25/02 2010 CAN-2002-0146 Message limits


look at the length of time from the defective version being released to the date the defect was found (or at least made public). makes you wonder about the “many eyes” philosophy, doesn’t it 🙂
note, the version release date comes from ESR’s news page

Comments Off on For some value of “shallow”…

Filed under General Stuff

Yet another reason to avoid disclaimers

File this under “there’s never a right way to do a wrong thing”. In fairness, Sybari is proactively alerting their customers about this bug, and they still make a darn good AV product. However, if they had resisted the temptation to make their product do something that shouldn’t be done, they wouldn’t have this problem now!

From: support@sybari.com [mailto:support@sybari.com]
Sent: sometime last week
To: faithful E2KSecurity reader
Subject: Re: Configuring Scanned Folder Locations – Antigen for Exchange
7.0
Hello reader,
What build of Antigen are you running? There is a known issue with
corruption of the priv1.stm associated with use of the Disclaimer.
Several clients have seen this, and it is easily resolved by turning the
Disclaimer off. However, this is only a work-around, and, as of now, future
releases of Antigen will not have a resolution to this, since we don’t know what
the cause is. We have been unable to reproduce this in house, and we need
someone who is seeing this to run a diagnostic utility that will provide
more information and, hopefully, a solution.
[ snipped some other unrelated stuff ]
Regards,
a support person
Sybari Software, Inc.
E-mail: support@sybari.com

Home

Comments Off on Yet another reason to avoid disclaimers

Filed under General Stuff

Early spring cleaning

I’ve made a couple of minor changes to the site. First, you’ll notice that the dorky-looking Amazon blob is gone from the right side bar. No one was clicking on it anyway. Second, there’s a new form for signing up for the goodies mailing list– I’ve moved from pairlist to Topica’s paid publishing service, which means that all y’all will finally have a real interface for subscribing and unsubscribing.

Comments Off on Early spring cleaning

Filed under General Stuff, Musings

The new phone book is here

My wife’s voice floated down the stairwell, jolting me away from my exciting task of filling out a matrix showing how OCS compares to Exchange. “Honey, the FedEx man left about a dozen packages on the front porch!”
Now, you have to understand that the arrival of the FedEx lady at our house is always a time of celebration. The best times are when she unexpectedly brings some kind of goodie, like a piece of review hardware. Next-best are when she brings something I’ve been anticipating, like salmon chowder or a copy of iLife. (I’ll have to tell y’all about the 50 pounds of candy some other time). When I grabbed the boxes to bring them in, I was greeted by a curious sight on the address label: “AOL Time Warner Book Group”.
This worried me; I was briefly afraid that I was the victim of a drive-by AOL CD dropoff. A glance at the side of the box, though, revealed that the boxes contained my author copies of the book! O joy! Sure enough, when I opened the first box, two copies were staring right out at me. That means that my contributing editors and reviewers will be getting copies over the next few days; the rest of you, alas, may have to actually buy it.

Comments Off on The new phone book is here

Filed under General Stuff, Musings