Max messages

[Userx]

I have a significant problem with users giving out access to their webmail account unsuspectedly. We have had a few Phish messages arrive with a link, The link delivers a page that looks exactly like my webmail login page. When my users visit the link and login they have given their login credintials to a SPAM source.

The SPAM source is using the account access to relay mail from other sources. In some cases the compromised accounts have been logged into and setup to send mail.

I am tightening up my rules to prevent the original phish.

The easy answer to this is to have my users change their password(s).

I'm looking for the hard answer:
1. Can I search all mailboxes for a message containing a string? Then if I find the string can I delete this from all mailboxes? For example, if the culprit Phish message contains "login to webmail for maintenance", I want to find that string and delete before my users "CLICK".
2. Can I throttle how many messages are sent from accounts? Once an account is compromised we find it trying to send thousands of messages to 10-20 accounts. Is there a way to tell my MTA's to alert me when an account is trying to send to X number of accounts or X number of messages?
3. We setup a script to look for the number of authentications to the audit.log file. This gives a quick look to find compromised accounts. Is there a better way?
4. The accounts are setup to send mail from a different domain with a reply to the different domain. Can I block my server from sending from a different domain? i.e. the email message came from abc@xyz.com, but my domain is 123.com.


Thanks for any assistance. Since we have to have webmail access from anywhere, it is difficult to block this from happening (users not checking carefully when logging into a site).

[uxbod]

With respect to outbound email throttling that is going to be quite tricky. A couple of methods you could research would be :-

* Implement a policy daemon that supports per user restrictions :- Policyd : HomePage
* Implement TC and throttle SMTP traffic :- Linux advanced Routing & Traffic Control HOWTO
* Modify the Postfix configuration in master.cf to reduce how many SMTP daemon can be started

[iway]

Yes, we'd like for a Zimbra-integrated throttling solution as well!

[fowler]

Mitigating the fallout of phished accounts has been a huge headache and a Zimbra integrated throttling solution (policyd in 6.0?) would be greatly valued.

[uxbod]

Please feel free to check Bugzilla for any current RFEs which may fit your idea, and vote for them, otherwise raise one for others to vote on and post the number back here.

[fowler]

This best describes the desired feature enhancement, but should be monitored at the SMTP port.

Bug 22300 - rate limit amount of mail sent via web client

It addresses a chronic problem admins are plagued with on holidays, nights and weekends. Another dealing with this issue:
Help with compromised accounts

Rate limiting is not a perfect solution, but it will help our MTAs from being blacklisted by Yahoo, GMail, Hotmail, etc and limit the impact our mail queues struggle to cope with when accounts are compromised.