Preventing an internal spammer - E-Bitz - SBS MVP the Official Blog of the SBS "Diva"

Kurbli — Mon, 13 Aug 2007 11:08:12 GMT

Avagy: a spammerek már a spájzban vannak.

So what can you do to proactively prevent a client's workstation to be turned into a spam spewing beast?
Les Connor and ISA Server 2004 once again to the rescue:
He builds a rule to deny any port 25 transmissions from anything other than the server itself and an internal scanner.
Action: Deny, log requests
Protocols: Selected : SMTP
From: The lan (defined IP address range)
Exceptions: SBS, Printer and Scanner IP's, which are defined specific IP
addresses.
To: Anywhere (pre-existing destination)
Users: All
Schedule: Always

Caveat, this blocks the use of telnet <external host> 25 from any local
machine for troubleshooting purposes, so beware of this if you use it on
your *own* network for testing SMTP.
You might also want to build an alert rule when this deny rule kicks in as it would be a sign of infestation.

ISA Server 2006 as a Kitchen Utensil: Part 1 - External Attacks

Kurbli — Thu, 19 Oct 2006 15:29:00 GMT

This article, part 1 of a two part series on how hackers see our firewalls, takes a look at how ISA Server 2006 reacts to port scans.

Source: ISA Server 2006 as a Kitchen Utensil: Part 1 - External Attacks

Nagyon jó elképzelés, hogy a beállításokat rögtön a másik fél szemével is lehet nézni, ugyanakkor az ISA Server reakcióját is lehet látni.

Kurbli : ISA Server

Preventing an internal spammer - E-Bitz - SBS MVP the Official Blog of the SBS "Diva"

ISA Server 2006 as a Kitchen Utensil: Part 1 - External Attacks