Imunify and spam / mail issues feature

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • ray
    Senior Member
    Forum ExplorerTechnical AssociateSolutions Developer
    • Mar 2021
    • 108

    #1

    Imunify and spam / mail issues feature

    I asked in a thread about CSF and Imunify because it some-kinda relevant but I got no answer.
    I hope its OK to ask again,

    Do you plan features like this (mail / spam relevant) ?

    Usually when an account gets infected/hacked bots or malicious users are uploading mail scripts. And the usual Top #1 problem for us (My personal opinion of course) is dealing with outgoing mail spam.

    CSF/LFD notifies us when someone / some script is sending mass mails, localrelay, authrelay, and when the queue is above x limit.

    When I get the warning I know something is wrong and start investigation.

    The usual outcome is server IP blacklisted in multiple RBLs -and other users cant send mails-, IP block, or whole server block (for one account) from the data center.

    So I believe its crucial to know whats happening with outgoing mails and queues.
  • admin
    Member
    • Mar 2018
    • 52

    #2
    Having outgoing spam monitoring (authrelay, localrelay, localhostrelay) with email alerts is such an important feature of CSF that I would strongly urge you to consider implementing this in Imunify.

    Having to run CSF in conjunction with Imunify seems to unnecessarily complicate and devalue the product. If Imunify added outgoing spam monitoring we would be more inclined to remove CSF altogether once Imunify is stable.

    Comment

    • iseletsk
      Senior Member
      • Dec 2017
      • 1199

      #3
      There are a lot of things that CSF does that we want to automate in long term -- and after some time period we will have basic spam protection similar to CSF in Imunify360.
      Yet, for now, we wanted to move forward with where we are strong together -- so we added complete CSF integration for Imunify360 -- so you can have the best of both worlds.

      Comment

      • jk
        Junior Member
        • Apr 2017
        • 1

        #4
        I would just like to make a vote for this, since this is also one of our regular issues.

        Comment

        • eric
          Junior Member
          • Jun 2017
          • 7

          #5
          Another vote

          Comment

          • steven
            Junior Member
            • Apr 2017
            • 11

            #6
            We dont use CSF, but need this as well. There are lots of possibilities for this such as monitor/block/alert when a script is calling the php mail function a lot, but I think seeing how a malicious file behaves and stopping it is the best, then it wont be able to run in the first place (such as the sandboxing feature), including blocking the IPs that are trying to access such script.

            Comment

            • steven
              Junior Member
              • Apr 2017
              • 11

              #7
              I agree.

              In my experience, when someone gains access for example by penetrating Wordpress, the end goal is to install back doors, phishing pages (that look exactly like Hotmail, for example) and base64-encoded scripts that send thousands of emails per hour. That is a constant problem as it gets the servers IP address blacklisted and usually by the time were notified and investigate, a lot of damage has already been done.

              Comment

              • steven
                Junior Member
                • Apr 2017
                • 11

                #8
                Another vote.

                Running 25+ servers with Imunify360 and CSF side-by-side and the only reason we have CSF is because of the tracking of SPAM mail and where it is coming from.

                Hope this gets attention sooner than later.

                Comment

                • morten
                  Senior Member
                  • Aug 2017
                  • 129

                  #9
                  Well, something must be done. How Im not sure, but customers emails are getting cracked all the time and has today the same number of cracked accounts as hacked Joomla/WordPress sites on our servers.

                  So I would say its the most important thing to find a better solution then there is today.

                  I found some bugs with Imunify not blocking exim attempts so hopefully that will help when they fix it in DEFA-98.

                  Comment

                  • morten
                    Senior Member
                    • Aug 2017
                    • 129

                    #10
                    Yes I would also agree if it was not for CSF flagging up bulk outgoing mail, we would not have stopped many a spammer who had cracked an email password. I am having to switch CSF back on, as I really need this feature.

                    Comment

                    • eric
                      Junior Member
                      • Jun 2017
                      • 7

                      #11
                      You might want to look into the free Comodo WAF ruleset. They have hardened the OWASP set and weve never had a hack using Comodo WAS and CSF CXS.

                      Comment

                      • apb
                        Senior Member
                        • Feb 2018
                        • 386

                        #12
                        Comodo WAF ruleset is included into Imunify360 ruleset for apache web server

                        Comment

                        • apb
                          Senior Member
                          • Feb 2018
                          • 386

                          #13
                          > Another vote.
                          >
                          > Running 25+ servers with Imunify360 and CSF side-by-side and the only reason we have CSF is because of the tracking of SPAM mail and where it is coming from.
                          >
                          > Hope this gets attention sooner than later.

                          Do you use the CSF cluster feature? Thats another reason we use CSF. If someone is hacking one of our servers, we can lock them out of all others using Cluster. Im not sure this is in Imunify?

                          Comment

                          • apb
                            Senior Member
                            • Feb 2018
                            • 386

                            #14
                            > Do you use the CSF cluster feature? Thats another reason we use CSF. If someone is hacking one of our servers, we can lock them out of all others using Cluster. Im not sure this is in Imunify?

                            We call it herd immunity and it is already there in Imunify360. Security incidents from all our customers are sent to Imunify360 network (correlation) so that attackers can be blocked before they reach your servers.

                            Comment

                            • apb
                              Senior Member
                              • Feb 2018
                              • 386

                              #15
                              We call it herd immunity and it is already there in Imunify360. Security incidents from all our customers are sent to Imunify360 network (correlation) so that attackers can be blocked before they reach your servers.[/quote] Unfortunately, as per the other topic I started, it can take nearly 30 minutes for the ban to be actioned on servers that use Imunify360, whereas the Cluster CSF servers respond almost immediately. In my email trail, I can receive tens and tens of emails for the same IP, stating a ban has been applied, yet Imunify360 doesnt seem to block the IP address. If a brute force attack is underway, and identified, I want that IP address blocked NOW, not in half an hour

                              Comment

                              Working...