Security in Agua

One of the main targets for attacks on the Internet is the mail server, and you can guarantee that any vulnerability will be found and exploited very quickly indeed. You need a mail server that protects against malicious attacks and allows you to safeguard against unsolicited e-mail.

Agua is the culmination of developments over a period of thirteen years where we have experienced every kind of attack that can occur on a mail server. Each one of those attacks has led to further safeguards being built into Agua.

The most recent development, and most effective against spam today is grey listing. This relatively simple technique prevents one-off attempts to send spam through your mail server by delaying.

Agua also has three further rules which can be defined in three different places. The rule types are:

• Country rules
  You can define which countries are allowed or denied access to Agua. The country information can be obtained from an IPDB database, if you have access to one.
• Network/host rules
  Enter partial or full host names, network names or IP addresses. Agua uses regular expressions to match incoming connections against this list and allows or denies access.
• Sender address rules
  Entries in this list are checked against the sender specified in the SMTP envelope. Agua uses regular expressions again to match partial or full names.

These rules work in a hierarchical order, each giving you more fine-grained control over the last. Also these rules can be specified in three different locations:

• Globally
  Global rules will take effect across the entire SMTP service, for all domains and all mailboxes.
• Per-domain
  Each of the above three sets of rules can be specified on a per-domain basis. Each domain can therefore have its own setup within Agua.
• Per-mailbox
  Every individual mailbox can also have its own set of rules allowing the greatest level of control over incoming mail. What is acceptable to one person might not be to another so we have made Agua as flexible and as configurable as possible.

The combination of these nine sets of rules results in each incoming message having a black, white or grey status. If the message does not result in being explicitly allowed or denied it is subjected to grey listing.

These rules can also be applied to incoming POP3 connections, with the exception of the sender address. POP3 servers are also subject to malicious attacks and should therefore have the same security considerations.