Need help stopping outgoing SPAM

[madcat]

Plesk developers, please help us users of your product to stop our servers from being abused for sending spam. What I think we really need is:

1. Log all SMTP authentication logins, whether they pass or fail. Record the IP and username on the same line. I have setup a test box running Plesk 8.3 and it appears only failures are being logged.

2. Provide the ability to define parameters for how complex user passwords must be. I know you have a "check passwords in the dictionary" checkbox in the "Mail" configuration, but it is not enough. We need the ability to force users to include special characters (ie: !@#$%^&*), use capital letters other than the first character, and that sort of thing.

3. For mail sent from authenticated STMP sessions, the message should be rejected at RCPT if the domain part of the "From:" address (the part after the '@' symbol) is not the same as the domain part of the username they used to authenticate. This should help stop spammers from sending with a fake "From:" address.

4. The Qmail log file should be at /var/log/maillog, not /usr/local/psa/var/log/maillog . This won't necessarily help stop outgoing SPAM, but it is a much better place for the log.

5. Provide the ability to completely stop bouncing as much as possible, and reject at RCPT instead. Currently I can stop bounces for mailboxes that don't exist, but I still see bounces for overquota accounts. Bouncing for overquota accounts is used by spammers who forge their "From:" or "Reply-To:" address to be the address of the person they want to receive the spam, and then send their spam to the bouncing overquota mailbox. Bounces should only occur for a rare system failure that might occur after the message has been accepted for delivery.

Thanks. If you are able to implement any of these features, please update this forum posting and let us know, and I will upgrade to the version that has these features as soon as possible.

 

[sergius]

Hello madcat,

Thank you for the report.
We will consider the suggestions as soon as possible.

 

[madcat]

Thanks. Your control panel is quite popular and used in many places. Imagine the dent you could put into the Internet's SPAM problem if you made it quick and easy for server administrators to track down sources of outgoing spam!

 

[madcat]

One other thing, for IMAP and POP logins, please include the whole email address of the user logging in, not just the mailname part. Eg:

May 7 16:20:34 localhost pop3d: IMAP connect from @ [10.20.30.40]IMAP connect from @ [10.20.30.40]INFO: LOGIN, user=username, ip=[10.20.30.40]

For the part the says "user=username", it would be much more helpful if it said something like "user=username@domainname.com".

Thanks.

 

[brainlag]

Hello

the best thing would be to:

1) while user enters their password, Plesk should examine it just like gmail.com does, and not allow weak passwords by default (weak: less than 8 digits, dictionary names, numbers like 123456 etc and the email username or the domai itself).

When the user enters a strong password (that complies with the above restrictions), then he should be allowed to save the password.


2) plesk administrator should have the ability to get all e-mail accounts passwords by eg: instantly telling Plesk to generate a txt file containing:
a) the full list of mail user accounts
b) e-mail account passwords that are made up of only letters

please have this for Plesk 9, it will save lives.

 

[64bithost.com]

red/black/green box

Hello

the best thing would be to:

1) while user enters their password, Plesk should examine it just like gmail.com does, and not allow weak passwords by default (weak: less than 8 digits, dictionary names, numbers like 123456 etc and the email username or the domai itself).

When the user enters a strong password (that complies with the above restrictions), then he should be allowed to save the password.


2) plesk administrator should have the ability to get all e-mail accounts passwords by eg: instantly telling Plesk to generate a txt file containing:
a) the full list of mail user accounts
b) e-mail account passwords that are made up of only letters

please have this for Plesk 9, it will save lives.

I would like to see the little red/black/green box in plesk that indicates the strength of a password over 6 characters

- Chris