Subject: Passing SMTP

From: "Unrath, Mark" <[email-masked]>
Date: Thu, 11 May 2000 06:57:10 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

All,

I'm new to the FWTK and was wondering if anyone could pass some tips along
or configuration issues with regards to passing SMTP through the firewall.
Some do's and don'ts if you will.

Running Red Hat Linux 6.5 on a Compaq Deskpro.

Thanks,
Mark

---

From: Ted Keller <[email-masked]>
Date: Sun, 14 May 2000 21:23:53 -0400 (EDT)

Mark.

Here are some thoughts....

1. update the smap-gw with the anti-relay patches.... available at
www.fwtk.org (or ask for my version).  These will go along way in
improving the functionality of the software.

2. smap likes to relay to an internal machine.  This kind of implies a
split DNS configuration for your e-mail environment.  The external DNS
points to to your firewall, the smap/smapd/sendmail configuration then
relays this mail to an internal host for final delivery.  Obviously, you
don't want the internal domain pointing to your firewall.

3. The internal domain should use a "smart host" type of feature to relay
to the firewall all non-local domains.  The firewall can then act as the
delivery agent.

4. Mail will probably represent about 30% of all internet traffic - plan
accordingly.

5. Make some rules with regard to maximum message size.  Let you user know
about them - and that messages exceeding this limit will be rejected.
This is important to eliminate a common Dos issue at the firewall/mail
service.

6. You will be blasted with spam mail - and a lot of it.  Think about how
you want to manage it....  Some of the anti-spam patches will be
important.

7. Users will get on list servers - then leave the company without
unsubscribing.  Again, block pateches will be important.

8. It's always best to run smap/smapd/sendmail in a chroot environment.
Standard smapd does not support that.  Sendmail chroot environment is not
trivial to develop - but probably worth it.

9. Make sure you implement a "flushing" facility for e-mail that cannot be
delivered on the first try.  Since sendmail is not run as daemon, it's
standard delay queue processing is not performed.  You need to
periodically run a /usr/lib/sendmail -q (or equivalent) to flush this
queue out.

I'm sure there are more....

ted keller