Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm planning on creating a simple SMTP Server to auto parse incoming emails to integrate into an application. I chose this method over polling a pop3 account so that I can get instant notification.

Not knowing a whole lot about server protection, I was wondering what I should do to protect against attacks?

The SMTP server will be a .NET app running on Windows Server 2008. My plan is to only allow incoming content, and only emails "to" a whitelist of known email addresses defined within the application.

share|improve this question
    
An SMTP port threat? I wan't aware that there was such a thing. What kind of "attacks" are you envisioning? –  joeqwerty Mar 13 '11 at 5:11
    
@joeqwerty Sure, why wouldn't there be? Pick your flavor: Microsoft? How about exim or postfix? –  Shane Madden Mar 13 '11 at 6:02
    
@Shane: Regardless of the MTA used, what is an SMTP port threat? –  joeqwerty Mar 13 '11 at 11:30

1 Answer 1

From a security perspective, rolling your own SMTP stack is a very bad idea.

You said that POP3 won't work because you want instant notification; I'd suggest looking into IMAP (specifically, the IDLE command). All the instant notification without the internet-exposed custom TCP socket!

share|improve this answer
    
+1 for the security tip –  poke Mar 12 '11 at 20:02
    
@Shane, any chance you can explain why it's a bad idea? –  Matt Brailsford Mar 12 '11 at 20:10
    
I agree that's not a great idea. Mail servers will be connecting to your port and you will have to write the service to handle everything that the incoming mail server would possibly do. That's what existing SMTP servers are for. You can achieve instant notification in your app with an asynchronous worker thread that runs in the background handling your mailbox work. –  BoxerBucks Mar 12 '11 at 21:15
    
@Matt With an internet-facing TCP socket, the first concern would be buffer overflows, but there are a number of potential attack points, beyond just the socket listener itself. A screwed up regex in the parsing code could allow a crafted payload in something getting passed to your message handler, for instance. –  Shane Madden Mar 13 '11 at 6:21
    
@Shane: Could you elaborate on your comment? What attack points are you referring to? Also, if there exists a real threat by allowing incoming SMTP connections why aren't more SMTP servers afflicted? I can't say that I've ever heard of an MTA being attacked by malicious code, or a screwed up regex, or a buffer overflow. Not that it couldn't happen in theory but I've never heard of it. –  joeqwerty Mar 13 '11 at 19:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.