To get rid of spoofed internal emails you need to use iptables at your routers and firewalls to disable SMTP (TCP25) traffic from any host other than your dedicated mail servers. Set a default policy of DENY for SMTP traffic and then an ALLOW declaration for each of the mail servers in your organization. Additionally disable telnet login for your mail server. The use of a security product such as Security Blanket TM (<a href="http://www.trustedcs.com">www.trustedcs.com</a>) on your in-house linux machines will help as well. As for the issue with spoofed external e-mails using internal addresses I recommend looking for security measures that are home-brewed. For example you could create a transparent gig that contains a security code and embed it in the signature of all e-mails originating within your infrastructure. Then use a simple script to check for the existence of that file upon receipt. If the email does not contain that file then drop before delivery. Also you could require PGP signatures.<br>
-Jesse<br><br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>
<br>
Message: 13<br>
Date: Mon, 12 May 2008 09:25:42 +0300<br>
From: "shadow floating" <<a href="mailto:nadengine@googlemail.com">nadengine@googlemail.com</a>><br>
Subject: [Full-disclosure] exchange server spam problem<br>
To: <a href="mailto:full-disclosure@lists.grok.org.uk">full-disclosure@lists.grok.org.uk</a><br>
Message-ID:<br>
<<a href="mailto:5c1b7500805112325r7df9ec86gc9323621a15f0687@mail.gmail.com">5c1b7500805112325r7df9ec86gc9323621a15f0687@mail.gmail.com</a>><br>
Content-Type: text/plain; charset=ISO-8859-1<br>
<br>
I ve been recently found many supicious emails sent from the internet<br>
to the internal clients using the sender address as a legitimate email<br>
address of one of the internal users, do you know how to configure<br>
exchange server to stop such emails (by authenticating users before<br>
sending for example),....I also suffer from internal email spoofing<br>
that users send each other with spoofed internal emails....any help<br>
would do.<br>
thanks alot<br>
<br>
<br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
Full-Disclosure - We believe in it.<br>
Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html" target="_blank">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>
Hosted and sponsored by Secunia - <a href="http://secunia.com/" target="_blank">http://secunia.com/</a><br>
<br>
End of Full-Disclosure Digest, Vol 39, Issue 25<br>
***********************************************<br>
</blockquote></div><br><br clear="all"><br><br>