Imunify and spam / mail issues feature

[ray]

I asked in a thread about CSF and Imunify because it some-kinda relevant but I got no answer.
I hope its OK to ask again,

Do you plan features like this (mail / spam relevant) ?

Usually when an account gets infected/hacked bots or malicious users are uploading mail scripts. And the usual Top #1 problem for us (My personal opinion of course) is dealing with outgoing mail spam.

CSF/LFD notifies us when someone / some script is sending mass mails, localrelay, authrelay, and when the queue is above x limit.

When I get the warning I know something is wrong and start investigation.

The usual outcome is server IP blacklisted in multiple RBLs -and other users cant send mails-, IP block, or whole server block (for one account) from the data center.

So I believe its crucial to know whats happening with outgoing mails and queues.

[admin]

Having outgoing spam monitoring (authrelay, localrelay, localhostrelay) with email alerts is such an important feature of CSF that I would strongly urge you to consider implementing this in Imunify.

Having to run CSF in conjunction with Imunify seems to unnecessarily complicate and devalue the product. If Imunify added outgoing spam monitoring we would be more inclined to remove CSF altogether once Imunify is stable.

[iseletsk]

There are a lot of things that CSF does that we want to automate in long term -- and after some time period we will have basic spam protection similar to CSF in Imunify360.
Yet, for now, we wanted to move forward with where we are strong together -- so we added complete CSF integration for Imunify360 -- so you can have the best of both worlds.

[jk]

I would just like to make a vote for this, since this is also one of our regular issues.

[eric]

Another vote

[steven]

We dont use CSF, but need this as well. There are lots of possibilities for this such as monitor/block/alert when a script is calling the php mail function a lot, but I think seeing how a malicious file behaves and stopping it is the best, then it wont be able to run in the first place (such as the sandboxing feature), including blocking the IPs that are trying to access such script.

[steven]

I agree.

In my experience, when someone gains access for example by penetrating Wordpress, the end goal is to install back doors, phishing pages (that look exactly like Hotmail, for example) and base64-encoded scripts that send thousands of emails per hour. That is a constant problem as it gets the servers IP address blacklisted and usually by the time were notified and investigate, a lot of damage has already been done.

[steven]

Another vote.

Running 25+ servers with Imunify360 and CSF side-by-side and the only reason we have CSF is because of the tracking of SPAM mail and where it is coming from.

Hope this gets attention sooner than later.

[morten]

Well, something must be done. How Im not sure, but customers emails are getting cracked all the time and has today the same number of cracked accounts as hacked Joomla/WordPress sites on our servers.

So I would say its the most important thing to find a better solution then there is today.

I found some bugs with Imunify not blocking exim attempts so hopefully that will help when they fix it in DEFA-98.

[morten]

Yes I would also agree if it was not for CSF flagging up bulk outgoing mail, we would not have stopped many a spammer who had cracked an email password. I am having to switch CSF back on, as I really need this feature.

[eric]

You might want to look into the free Comodo WAF ruleset. They have hardened the OWASP set and weve never had a hack using Comodo WAS and CSF CXS.

[apb]

Comodo WAF ruleset is included into Imunify360 ruleset for apache web server

[apb]

> Another vote.
>
> Running 25+ servers with Imunify360 and CSF side-by-side and the only reason we have CSF is because of the tracking of SPAM mail and where it is coming from.
>
> Hope this gets attention sooner than later.

Do you use the CSF cluster feature? Thats another reason we use CSF. If someone is hacking one of our servers, we can lock them out of all others using Cluster. Im not sure this is in Imunify?

[apb]

> Do you use the CSF cluster feature? Thats another reason we use CSF. If someone is hacking one of our servers, we can lock them out of all others using Cluster. Im not sure this is in Imunify?

We call it herd immunity and it is already there in Imunify360. Security incidents from all our customers are sent to Imunify360 network (correlation) so that attackers can be blocked before they reach your servers.

[apb]

We call it herd immunity and it is already there in Imunify360. Security incidents from all our customers are sent to Imunify360 network (correlation) so that attackers can be blocked before they reach your servers.[/quote] Unfortunately, as per the other topic I started, it can take nearly 30 minutes for the ban to be actioned on servers that use Imunify360, whereas the Cluster CSF servers respond almost immediately. In my email trail, I can receive tens and tens of emails for the same IP, stating a ban has been applied, yet Imunify360 doesnt seem to block the IP address. If a brute force attack is underway, and identified, I want that IP address blocked NOW, not in half an hour