4.2. Common host setup

Although it isn't strictly related to mail filtering we should at least mention that we took steps to keep our hosts secure. As the processor and holder of a significant volume of email we had to make sure that it couldn't be leaked, stolen, or copied elsewhere. (Because many emails contain sensitive information such as credit card numbers, usernames and passwords, and street addresses.)

We took multiple steps to secure our hosts, and we also implemented monitoring to detect both possible intrusion attempts and unexpected failures of the servers themselves.

All our servers were managed via remote SSH access. To ensure that remote attackers couldn't guess our usernames and passwords we restricted access via SSH to a small list of known-good administrative IP addresses, and disabled the use of password based authentication.

The SSH restrictions were implemented via a simple firewall installed upon each host. The firewalls would also ensure that only SMTP (for all machines) and HTTP/HTTPS (for the master machine) were publicly accessible.

To ease management of this setup all of our hosts were configured via a minimal installation of CFEngine.

We used a combination of the snoopy and logwatch tools to detect anomalous activities, combined these would give us the opportunity to see intrusions and have log of any activities carried out upon the machines.