Security Basics: Re: outgoing email monitoring

[Steven Hollingsworth <steven () aznc com>]

On Tue, May 01, 2007 at 10:01:39PM +0300, Matt Miller wrote:
> hi list.
> I need a solution to monitor the flow of outgoing email traffic for data 
> leak/security concerns. The two objectives that i have are:
> -monitoring and reporting -  who sends, how many and where to?
> -possibility to temporarily put outgoing all e-mail on hold for 
> reviewing by admin/user and releasing for delivery.
>
> Any suggestions?
> Thanks
>
> Matt

Hi Matt,

I achieved this by using a Linux box as an outgoing mail relay running
postfix [0] while my exchange server relayed it's mail to the postfix
"smart" host.
I ran reports using pflogsumm [1] - This gave me a good overview of who was
sending the most mail, size, errors, etc. 

This in conjunction with a outgoing firewall policy to only allow the
outgoing relay will give you a good idea of what's being passed around,
and looking at the firewall logs will tell you what PC's are possibly
infected/sending SMTP traffic when they shouldn't be.

There are plenty of ways with both FOSS and Commercial solutions. It's
a matter of what you're most comfortable with.

HTH,

~ stevo

[0] - http://www.postfix.org/docs.html
[1] - http://jimsun.linxnet.com/postfix_contrib.html