Introduction
LibraCyber ESG SMTP Policy Module is a unique tool to garner fine-grained policy control on mission-critical mail servers.
The LibraCyber ESG SMTP Policy Module provides an extremely flexible policy-based definition mechanism. Both the source and destination can be matched against several different items including “anything”, @domain portion of an email address, user@ portion of an email address, blank email address, sending server IP address, sending server CIDR mask, or a group based lists, presence of SASL username, to name a few.
Nowadays rate-limiting email traffic is no more an option, to keep secure your email reputation and infrastructure availability, in case of an account compromisation or spam attack.
Every ESP (Email Service Provider) enforced its limits to keep its systems healthy and email accounts safe, and this should be also for everyone running an email server!
LibraCyber ESG SMTP Policy Module provides an easy way to accomplish this.
A good start is to configure hourly and daily email sending limits. This takes under your control the level of email traffic being processed, to ensure that the mail server will be available to support all of its users whenever they need to send an email and to prevent spam from being sent through the system. Not unlike speed limits on highways, byways, and motorways around the world, email sending limits to establish a control to keep everything moving along smoothly.
With LibraCyber ESG all mail traffic can be recorded and accounted for, this includes the number of messages and the cumulative size for any chosen tracking counter.
Linked to each SMTP Policy there are quotas. Quotas use rolling window time frames and are normally used as a means of mitigation to prevent certain senders or sending servers from transmitting an abnormally large amount of email due to possible compromisation or spam attacks. It can also be used as a means to ensure that a user or sending server stays within a specific limit of either messages or cumulative size for a certain period.
Let’s see a few scenarios.
Example 1
We want to limit outbound per user messages to a max of 500 per day, with a max spike of 100 per hour. Also, we want to enforce a cumulative size of 30 MB per day per user.
LibraCyber ESG is used as an email gateway so all outgoing emails are delivered from the internal server using LibraCyber ESG as a smart host.
Policy Definition
Name: Outbound
Description: Matches Outbound emails
Priority: 5
Status: Enabled
Next, we expand the newly created policy by clicking on [+] and we add as policy member:
Source: 1.2.3.4 (The internal mail server IP address as all outgoing emails are sent from this host)
Destination: any
Comment: Whatever
Status: Enabled
Quotas Definition
It’s time to define the quotas. Add a new quota:
Linked Policy: Outbound
Name: Daily_Quota
Track Counter: sender@domain (we want to track any single sender)
Period: 86400
Verdict: Defer (Delay)
Response: Daily quota exceeded.
Stop Processing Rules Here: No
Comment: Daily quota
Status: Enabled
Now add quota limits by expanding [+]:
Limit Type: Message Count
Threshold: 500
Status: Enabled
next, add a new quota limit under the same quota rule Daily_Quota:
Limit Type: Message Cumulative Size
Threshold: 31457280 (30 MB, this value is in bytes)
Status: Enabled
Ok, to finish we will add the “spike” rule:
Add a new quota:
Linked Policy: Outbound
Name: Houlry_Quota
Track Counter: sender@domain (we want to track any single sender)
Period: 3600
Verdict: Defer (Delay)
Response: Hourly quota exceeded.
Stop Processing Rules Here: No
Comment: Daily quota
Status: Enabled
Now add quota limits by expanding [+]:
Limit Type: Message Count
Threshold: 100
Status: Enabled
Done!
Example 2
We are a small ISP. We want to limit outgoing emails for our customers to 1000 emails per domain per day. We have two customers that paid for extended service and for these customers (special.com and veryspecial.com) we need 5000 messages per day. In all cases, we do not allow more than 150 emails per 30 minutes.
Policy Groups
It’s handy to define a group with customer domains with special agreements, and another with all relayed domains.
Name: Special_Customers
Description: Special agreement customer domains
Status: Enabled
Next, we add members to the group by clicking [+] and new:
Member: @special.com
Comment: Special Customer A
Status: Enabled
and one the next one:
Member: @veryspecial.com
Comment: Special Customer B
Status: Enabled
Next, the group includes all relayed domains:
Name: Customers
Description: Customer domains
Status: Enabled
Next, we add members to the group by clicking [+] and new:
Member: @domain.com
Comment: Customer A
Status: Enabled
and one by one all other members.
Now we can create our policies using groups:
Policy Definition
We will create two policies as follows:
Name: Outbound_Special
Description: Matches Outbound emails for special customers
Priority: 10
Status: Enabled
Next, we expand the newly created policy by clicking on [+] and we add as policy member:
Source: %Special_Customers (this matches all sources included in the group)
Destination: any
Comment: Special Customers Policy
Status: Enabled
And now the general customer policy:
Name: Outbound_General
Description: Matches Outbound emails for all customers
Priority: 20
Status: Enabled
Next, we expand the newly created policy by clicking on [+] and we add as policy member:
Source: %Customers
Destination: any
Comment: General Policy
Status: Enabled
Quotas Definition
It’s time to define the quotas. Add a new quota:
Linked Policy: Outbound_Special
Name: Daily_Quota
Track Counter: Sender @domain (we want to track any single domain sender)
Period: 86400
Verdict: Defer (Delay)
Response: Daily quota exceeded.
Stop Processing Rules Here: Yes (We do not want to go further with other rules on special customers)
Comment: Daily quota
Status: Enabled
Now add quota limits by expanding [+]:
Limit Type: Message Count
Threshold: 5000
Status: Enabled
Linked Policy: Outbound_General
Name: Daily_Quota
Track Counter: Sender @domain (we want to track any single domain sender)
Period: 86400
Verdict: Defer (Delay)
Response: Daily quota exceeded.
Stop Processing Rules Here: No
Comment: Daily quota for all domains
Status: Enabled
Now add quota limits by expanding [+]:
Limit Type: Message Count
Threshold: 1000
Status: Enabled
Now add the limit of 150 messages per 30 minutes:
Linked Policy: Outbound_General
Name: 30_Min_Quota
Track Counter: Sender @domain (we want to track any single domain sender)
Period: 1800
Verdict: Defer (Delay)
Response: 30 minutes quota exceeded.
Stop Processing Rules Here: No
Comment: Half an hour quota
Status: Enabled
Now add quota limits by expanding [+]:
Limit Type: Message Count
Threshold: 150
Status: Enabled
Done!