Security Basics mailing list archives
Re: outgoing email monitoring
From: Steven Hollingsworth <steven () aznc com>
Date: Tue, 1 May 2007 14:26:44 -0700
On Tue, May 01, 2007 at 10:01:39PM +0300, Matt Miller wrote:
hi list. I need a solution to monitor the flow of outgoing email traffic for data leak/security concerns. The two objectives that i have are: -monitoring and reporting - who sends, how many and where to? -possibility to temporarily put outgoing all e-mail on hold for reviewing by admin/user and releasing for delivery. Any suggestions? Thanks Matt
Hi Matt, I achieved this by using a Linux box as an outgoing mail relay running postfix [0] while my exchange server relayed it's mail to the postfix "smart" host. I ran reports using pflogsumm [1] - This gave me a good overview of who was sending the most mail, size, errors, etc. This in conjunction with a outgoing firewall policy to only allow the outgoing relay will give you a good idea of what's being passed around, and looking at the firewall logs will tell you what PC's are possibly infected/sending SMTP traffic when they shouldn't be. There are plenty of ways with both FOSS and Commercial solutions. It's a matter of what you're most comfortable with. HTH, ~ stevo [0] - http://www.postfix.org/docs.html [1] - http://jimsun.linxnet.com/postfix_contrib.html
Current thread:
- outgoing email monitoring Matt Miller (May 01)
- Re: outgoing email monitoring Noaman Khan (May 01)
- RE: outgoing email monitoring Miguel Ramirez (May 01)
- Re: outgoing email monitoring Steven Hollingsworth (May 01)
- Re: outgoing email monitoring gjgowey (May 01)
- RE: outgoing email monitoring Zhihao (May 07)
- <Possible follow-ups>
- Re: outgoing email monitoring vachanta (May 01)
- Re: Re: outgoing email monitoring security (May 02)
- RE: outgoing email monitoring jfvanmeter (May 08)