Securing SmarterMail

This article will discuss some of the basic steps you can take to secure SmarterMail and prevent abuse from the server. This article applies to SmarterMail version 5.x and greater.

Log into SmarterMail admin which is typically located at http://<server_ip_address>:9998

Enable detailed Logging    

Enable logging under Settings > Log Settings. The minimum Log Detail Levels should be Detailed logging enabled for at least Delivery Log Level and SMTP Log Level

 

Setup SMTP Authentication

Under Settings > Defaults > Domain Defaults check the box for Require SMTP Authentication.

This will ensure that all users for each domain must authenticate in order to send mail. Note that for domains that are already setup in SmarterMail, this is not a retroactive setting. If a domain was setup without SMTP Authentication it will still be setup without it even after enabling this setting.

 

Ensure secure passwords

Under Security > Advanced Settings > Password Requirements, check off a minimum of 2 boxes with a minimum password length of 8 characters. The more boxes that are checked the more secure the server will be.

Note: enabling these options will not affect users that connect via POP or IMAP. A user will need to log into the web interface to have the password requirements enabled for their account. For example, if John Smith checks mail exclusively via POP in Outlook and his password is insecure such as 'mypassword1', he will not be prompted for a new password until he logs into webmail directly. Only at that time will he be forced to change his password and thus it will also have to be changed in his Outlook settings.

A secure password should be at least 8 characters, not contain any dictionary words, not contain the username, and should contain uppercase, lowercase, symbols, and numbers. If you need to generate a new password, you can do so following the random password generator here: http://www.pctools.com/guides/password/

 

Ensure the SmarterMail admin password is strong

Navigate to Settings > General Settings > Administrator tab and change the password per the guidelines listed above. This will prevent brute force attacks on SmarterMail admin.

 

Setup Abuse Detection

Under Security > Advanced Settings > Abuse Detection setup some basic abuse detection rules so the server does the work for you. Click New and setup a Denial of Service (DOS) rule where if the service (SMTP/POP/IMAP) is hit X number of times in Y minutes, block the connection for Z minutes.

 

Ensure SmarterMail is up-to-date

Navigate to Settings > SmarterMail Self Diagnostic

This will report the version installed on the server. Compare that version number to http://www.smartertools.com/SmarterMail/Download/ and if the server is not running the latest version, you should download the new version and update SmarterMail. Often new versions contain security and bug fixes.

 

Don't whitelist IP addresses

Even if you whitelist 127.0.0.1 and/or the server's external IP address, there is a chance it will be abused. Check to make sure no IP's are whitelisted under Security > Whitelist. Disabling any whitelisted IP's prevents abuse from mail forms and scripts. If a hacker does compromise your site and uploads a mail script to blast out spam and the external IP address of the server is whitelisted without SMTP authentication checked, the script will pass that mail on and the server will become blacklisted. Instead, setup a domain such as 'localhost.com' with a secure username and password that your forms will use to authenticate. Require SMTP authentication for the domain and all mail be authenticated rather than unauthenticated through SmarterMail thus preventing any insecure script used to spam from doing harm to the server IP's reputation.