I have one Postfix SMTP server with hundreds of users, which are using it to send e-mails as authenticated users.
Sometimes one account is hacked and thousand e-mails become to go out from the SMTP server, starting a spam flooding to hundreds of e-mail addresses.
This obviously make my server to be inserted into many blacklist and when I realise I need to:
- fix the hacked account (and educate users to use good password and to change them frequently)
- stop the flooding removing spam messages from the outgoing queue
- check the IP address into blacklists and remove them if needed
- monitor outgoing e-mails to check if they are marked as spam
Now I want to understand how I can efficiently prevent the flooding before it happens, because we cannot risk to be inserted into any blacklist. I think this could be reached with:
- force users to use a good password: this can be easily reached if you are using an authentication backend like Active Directory, but what about Postfix users and virtual domains saved into the database?
- activating fail2ban on SMTP services (but this does not work if hackers already know passwords and use them at the first try)
- implementing some flooding detection like outgoing rate detection for the same users which could stop relay for a specific user if it's spamming: what technology can be used on top of Postfix to achieve this?
- monitoring: some Nagios/Icinga checks for the elements in the Postfix outgoing queue (but could be too late)
- monitoring: a lot of services which can check if the IP address is into some blacklist (but too late)
Any other idea?