You may not be familiar with SmarterMail from Smatertools.com but it is an enterprise class Windows based mail server. It has a powerful web based management GUI and the company regularly releases version updates containing bug fixes and new features. However, in my opinion one of the most compelling reasons to try SmarterMail is that they offer a full featured version free for one domain.
You may think configuring an enterprise mail server application could be a challenge but fortunately SmarterMail’s administration interface is organized in an intuitive way and the Smartermail Help manual is always available online. In this blog post I will cover a few key features that you want to configure to ensure your installation of SmarterMail is locked down. Some settings will depend on the volume of your mail server so adjust accordingly and double check often.
Change the admin password
If you’ve just installed SmarterMail the next step you will encounter after the install wizard completes is a prompt to set the admin password. Following Best Practices You should be changing it on a regular basis. This can be performed from the Settings menu by clicking on System Administrators as shown below.
However, there may come a time when you are not able to login to SmarterMail to change the admin password. To manually reset it without logging in you just need to edit mailconfig.xml which is usually located in C:\Program Files (x86)\SmarterTools\SmarterMail\Service. As noted within the file, you just need to delete the <sysAdminUserName> and <sysAdminPasswordHash> lines and then restart the SmarterMail service.
Change SMTP Relay and Authentication
On the Settings menu click on Protocol Settings and then click the SMTP In tab. Only authenticated users should be allowed to relay mail. From the Allow Relay pulldown Select Nobody and then on the Require Auth Match pulldown menu select Email Address. Next in the options at the bottom of the list check the box Allow relay for authenticated users. These settings will only allow local accounts that have successfully authenticated to send mail off the server i.e relay and in order to authenticate the users are required to provide the complete email address. SmarterMail wisely recognizes how these settings could be cause issues and have highlighted a warning at the top of the page.
Limit IP Addresses and Ports
On the Settings menu select Bindings and then click on IP Addresses. Ensure other IP addresses on the server are not enabled for mail services.
Then click on each IP address and ensure only the necessary ports are enabled.
For even greater security you should also configure SSL / TLS for your services.
Internal Spammer Notification
This is a setting that ultimately depends on the volume of your mail server. It is located under the Security menu –> Advanced Settings –> Abuse Detection. This feature will send a notification to a designated mailbox when message volume exceeds a preset threshold. The recipient could be the mail admin or a group mailbox. Regardless who receives this notification they needs to be able to leap into action and potentially lock down an account that has been exploited and is sending spam.
Without the Internal Spammer Notification enabled you will have to rely on the System Summary – Message Traffic Report to quickly identify which domain on your mail server is sending spam. Change the date filter to today and depending on the usual message volume on your server it should be obvious which domain is sending the spam. Next click on the domain in question and then you’ll see which mailboxes within that domain have the highest message count. That is the mailbox that has been exploited. You will need to temporarily reset the password of the mailbox in question to stop the spam from being sent.
Continuing with this example after resetting the password of the mailbox sending out the spam you’ll want to use a program such as GrepWin to purge the messages from the SmarterMail spool. If you don’t immediately delete that mail from the spool, SmarterMail continue to attempt to send it out which will most likely result in your mail sever being quickly being blacklisted.
Enable Greylisting
Greylisting is a great tool to leverage against spammers. It deliberately slows mail service by a preset amount of time using SMTP 4XX reply codes which tell the sender’s mail server to queue the message and try again shortly. Legitimate SMTP servers sending mail will be whitelisted for a lengthy period of time and then will be able to deliver mail as usual without repeat delays. SMTP servers used by Spammers that are not configured for 4XX queue timeouts will not reattempt to resend their junk mail there by preventing it from getting delivered. And even if spammers do configure their servers accommodate greylisting they will still most likely get blocked by Real-Time Blackhole Lists (RBL).
Configure Real-Time Blackhole Lists (RBL)
The Antispam Administration settings for SmarterMail are comprehensive. Many of these settings will need to tested and evaluated over time. The security settings are easy to reach from the navigation menu. The Spam Checks tab controls weighted numeric scores that are assigned to the incoming mail as it gets processed. The higher the numeric score the greater the likelihood that the message is spam. RBL servers are 3rd party resources that maintain extensive lists of mail server IP addresses where the servers in question have been identified as sending spam. RBL server checks should have a high weighted score so any IP address that is matched to an address already on an RBL is immediately blocked.
Configure Spam Filtering Thresholds
On Filtering tab of the Antispam Administration page you will adjust the Weight Threshold actions. So in the example below a message with a total score of 5 is considered normal mail and will delivered into a users inbox. A message with score of 12-17 is probably spam but the user can still review it in their inbox’s Junk E-Mail folder. Anything over 17 should be deleted and not delivered to the users. These values are globally set for all mailboxes by default. However, you can allow users to change the weight thresholds for their own mail in their domain’s settings. The other tabs on the Antispam Administration page are straight forward to configure.
SMTP Authentication Bypass
The SMTP Authentication Bypass settings should be used with caution and reviewed frequently. Adding an IP address to this list as the name implies will allow mail being sent from that IP to skip the authentication procedures configured above. One might do this for an internal web server so that sites hosted on that server can conveniently send mail outside the network. However, it can quickly lead to trouble because if any of the web sites happen to have poor design security a simple contact form could be leveraged for spamming. In this situation because the IP address the of web server hosting the site is present on this page the bypass rule will let the spam flow out unimpeded. This simple oversight could quickly cause your mail server to be blacklisted before anyone even realizes it.
Abuse Detection
As mentioned above the Abuse Detection settings are under the Security menu and then click on Advanced Settings. These are all threshold settings that will notify a system administrator when the specific metric has been exceeded. The settings will need to be modified based on the volume of your mail server.
Password Complexity
The SmarterMail mailbox Password Requirement rules are globally applied to all mailboxes on the server. Best Practices dictate that you should require all users to have complex passwords using mixed case and at least numbers if not special characters too. As with many of the other settings these will need to be adjusted according to the number of mailboxes you have on your server. I have supported large enterprise deployments of SmarterMail with 4000+ mailboxes. If you are only managing a fraction of that size you may be able to have less stringent requirements. However, it’s always better to be more cautious than less cautious.
A handy complement to the Password Complexity requirements is the Password Policy Compliance report that can be accessed on the Manage menu. It identifies all the mailboxes on the server that do not meet the configured required settings. It is a helpful report that quickly shows which mailboxes need to be corrected.
In Summary
SmarterMail by Smatertools.com is an enterprise Windows mail server with a powerful administration interface. I have highlighted 10 areas that should be configured to ensure your SmarterMail server is locked down and secured minimizing the chances of mailboxes being exploited by spammers. Thanks for reading!
