Thanks for all the ideas .. hopefully I can give you a little more detail
on this scenario ..
At 11:39 AM 4/29/2000 +0200, you wrote:
>>Basically, we would like to have IMail handle the smtp, for anti-spam and
>>such reasons, so I hesitate to use the AV's built-in smtp server, then
>>relay on the imail.
>
>This is the best way, imo. I like different boxes for different tasks,
>the granularity, modularity means any one box is more simply configured
>and maintainable vs piling everything into one godzilla box, which is he
>old mainframe approach (the one the box mfrs and MS want you to take so
>they make more money, but it's bad for you, really) which should have died
>10 years ago. One box going down doesn't bring your whole mail operation
>down. And PC's are free compared to salaries and client revenues and
>bandwidth costs. The following mail infrastructure will provide total
>mail services in a very reliable, hi volume, scaleable manner
Sometimes, yes .. other times, why maintain 15 boxes when a small cluster
of 4 smp xeons could do the trick, and provide fault-tolerance? :)
>============ your shop ==========
>
>1. SMTPD server (2 or more machines for 2 or more MX's for all incoming
>mail for
> Imail and downstream domains)
> -incoming mail only (doesn't do outgoing)
> -anti-spam with mail-abuse.org lookups
> -DNS validation
> -global Reg Ex filtering
> -global bcc: all mail to incoming mail archive
> -incoming relay for downstream mail servers (ETRN, leased line clients,
> who forward
> their outgoing to 5.) but without A-V scan
What's a decent mail daemon to use at this step? (platform doesn't matter,
we run a lot of sendmail on FreeBSD, Solaris and Linux(ugg))
I really don't think it necessary to break incoming and outgoing smtp up in
this particular situation. Incoming mail does several million messages a
week, outgoing only does several hundred. :) Most of the users are on
other networks where we have outgoing smtp servers doing their jobs. (and
remote users, SUPPOSED to be using their ISP's SMTP relay. :)
>2. A-V box
> - global clean and forwards to 3. (or 2.5)
Dedicating a box to AV.. adding a hop .. adding the latency, adding the
extra lan traffic, adding another point of failure .. is it really worth
it? (sorry, I just need to be convinced sometimes)
>2.5 "routing" hub
> - receives global incoming from 2., after anti-spam, after A-V scan
> - forwards anti-spam and antil-virus to 3.
> - relays the rest for downstream mail servers but
> now with A-V as well as anti-spam. (Your downstreams pay for A-V
> service)
> - forwards advanced list traffic to 4.
2.5 wouldn't really be necessary in this case either, I don't think. No
downstream mail servers on this network, everything's at the ops center,
maintained by us.
>3. Imail
> -POP3/IMAP/LDAP server
> -Web Mail server
> -SMTP AUTH incoming mail from dial-up users
> -basic list services
> -per-domain filtering
> -autoresponders
> -per-user filtering, forwarding
> -forwards outgoing mail to 5.
>
>4. "Advanced" list server
> - no MX presence (but has full anti-spam config of 1. just in case)
> - forward outgoing to 5.
> - per-list archiving
Gosh it'd be nice if IMail had a more robust list engine.. </dream>
>5. SMTP outgoing server (can be replicated if traffic requires)
> - no MX presence (but has full anti-spam config of 1. just in case)
> - outgoing-only relay for
> - Imail(s)
> - downstream mail server(s)
> - advanced list server(s)
> - global bcc: to outgoing mail archive
>
>============ your shop ==========
>
>6. remote Internet SMPTD servers
>
>>I know we could be using the smtp scanner on the workstation, but that
>>opens up a whole new mess of concerns in our experience.
>
>To be avoided if possible, but mail is not the only vector for viruses:
>portable media and ftp. You could "single choke point" the Internet
>traffic, but portable media would still be a concern.
Right, we're already doing real-time scanning on the workstations(tcp/ip,
removable media, and network/smb access), as well as on the file servers.
We're also doing periodic full scans of the volumes, spot checks by hand,
etc .. I was referring to having Eudora use that cheezy smtp server built
into Norton AV on the workstation, rather than protecting it at the
gateway. I'm really looking for a quick fix at this point, we've had a lot
of concern (it's quite complicated) about the mail being filtered on this
network for AV content. It's not that it's impossible, it's just politics.
In the mean time, our internal Eudora users' MBXs get wiped out every time
one of these silly script virii comes in.
Best Regards,
Jonathan
________________________________
You want it? We've got it!
http://home.paperwork.com
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
