TrendLabs: Spam Campaign Abuses PHP Functions for Persistence, Uses Compromised Devices for Evasion and Intrusion

Figure 4. A spam mail snippet with the targeted email address

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/spam-campaign-abuses-php-functions-for-persistence-uses-compromised-devices-for-evasion-and-intrusion/

Proxmox Mail Gateway 6.0

The highlights of the new major relase include:

• Based on Debian 10.0 (Buster) and Linux Kernel 5.0.21
• Improved support for ZFS on UEFI and on NVMe devices
• Updated Spam Assassin rules.
• The Mail filter now logs the rule name.
• The system logs get displayed faster in the GUI because they now use the ‘mini-journalreader’ instead of ‘journalctl’.
• and more...

Forum announcement

https://forum.proxmox.com/threads/proxmox-mail-gateway-6-0-released.57356/

Download

https://www.proxmox.com/downloads

Proxmox Mail Gateway 5.1 We are pleased to announce the availability of Proxmox Mail Gateway 5.1. The Mail Gateway is based on Debian Stretch 9.5 with a 4.15 kernel, and the new version 5.1 comes with Debian security updates, bug fixes, and GUI improvements. The new Transport Layer Security (TLS) policy provides certificate-based authentication and encrypted sessions; the user management now allows a  help desk role; editing and showing smarthost port is possible; and we included support for SMTPUTF8

REF: https://forum.proxmox.com/threads/proxmox-mail-gateway-5-1-available.47798/

Mail: lock error

MDaemon發生maildrop already lock的錯誤，是同時兩個裝置使用POP收信造成，參考網址如下。

REF: http://blog.752club.com/mdaemon-multi-pc-receive-pop3-account/

Email mailhub for SMTP service

架設mailhub作為email server用的STMP gateway是個蠻好的做法，因為多了一層保護與過濾。基本架構如下：

• SMTP-In：外部防火牆將port 25 用 port mapping redirect 到mailhub，然後mailhub再relay給mail server。這樣就可以用mailhub專門進行過濾，如antivirus, antispam, 或是手動加入任何relay rejct規則，都很有彈性。
• SMTP-out：這得看mail server能否指定外部 smart host來幫自己發信了。若非得自己發信，就無法中間擋一層mailhub。

sort unique ip address from mail log

sort maillog.tmp | uniq -c