Hello Virtualmin Fans!
I just started migrating my clients to Linode/Virtualmin last year through 2 freelancing server admins. Each client has their own set-up; I’m not operating as an ISP. My challenge is that I cannot always reach my server admins and e-mail issues repeat themselves. With the exception of moving clients to GSuite, I would love your advice so that I can put in place proper procedures.
- Problem: Breach from someone clicking on a spam email and then sending everyone an email from that email address.
Nothing is bulletproof, but I would like suggestions on preventative measures.
Example:
After paying for expedited de-listing a backscatterer blacklist, I checked out http://www.uceprotect.net/en/index.php?m=4&s=0 and I like the idea of #2. I sent it to my server admins. Both ignored the idea, but one used a different method (blocking IP addresses) which blocked legit IP’s from sending email (ug).
Are the ideas on the UCE Protect link valid? If so, can I hire someone to write the script (idea #2) that I can apply/modify for each client’s server?
- Problem: All clients experience more incoming spam since migrating from a managed shared server to their new cloud server.
Am I doing everything I can do to filter out spam? See server specs at the bottom of this message.
a. Greylisting is not enabled; I’m concerned that it will cause more problems to whitelist legit users. ---------
b. As of today, my server admin set a mail rate limit of 50/hr, which is handled on a domain level. This seems low to me, so I changed it to 300. 5 employees use that domain. I hope the idea of #1 replaces this solution.
- Problem: When I need to put a bandaid on a security problem, where can I find the following information? I checked the documentation and did not find it there.
a. How do I access the logs for email when a breach happens? ---------------
b. What kind of language am I looking for in the log that will indicate the cause of the problem? --------------
c. Where do I go to blacklist an IP Address from using the server?
SYSTEM INFO:
Operating system Ubuntu Linux 16.04.5---------------
Perl version 5.022001 ---------------
Path to Perl /usr/bin/perl ---------------
BIND version 9.10 ---------------
Postfix version 3.1.0 ---------------
Mail injection command /usr/lib/sendmail -t ---------------
Apache version 2.4.18 ---------------
PHP versions 7.0.33, 7.1.32, 7.2.22, 7.3.9 ---------------
Webalizer version 2.23-08 ---------------
Logrotate version 3.8.7 ---------------
MySQL version 5.7.27 ---------------
ProFTPD version 1.35 ---------------
SpamAssassin version 3.4.2 ---------------
ClamAV version 0.100.3 ---------------
We have DKIM, SPF and DMARC in place. The free version of MXToolbox is monitoring but it’s usually too late when MXToolbox reports a problem.
Thank you for your time! This post is a mouthful!