osm (Outgoing Spam Monitor) Beta

Posted on by Chirpy

As mentioned in our previous posting, osm is nearing release and has now entered beta testing. We have put up a web page outlining our new product.

If you are interested in beta testing osm and are…

  1. willing to run beta software
  2. able to allow us access to the server should any issues arise
  3. happy to provide feedback
  4. running a cPanel server!

…we would like to hear from you.

We have limited slots available for beta testers who will get a single free license of osm once beta testing has completed.

If you would like to help, please log a ticket on our helpdesk with a cPanel server IP address and we will provide further information.

Outgoing Spam Monitor (osm)

Posted on by Chirpy

We’ve been quiet of late on the development front, but only on the blog. We are currently working on a new product that has been frequently requested by customers. It is still in development, but will enter Beta testing shortly. So, what is it?

ConfigServer Outgoing Spam Monitor (osm)

ConfigServer Outgoing Spam Monitor (osm) has been designed to use multiple methods to monitor outgoing email and SMTP connections for activity that could indicate a spammer is active on a server.

With the proliferation of web scripts in shared hosting environments that are often poorly maintained or badly written, the chances of a hacker exploiting vulnerabilities in scripts is at an all time high. Additionally, end-user PC’s and other devices that send email through a server (relay) that have been compromised and used as a spam source has always been a problem. These issues along with spammers deliberately targeting hosting providers by purchasing accounts simply to send out spam have kept the diligence required to prevent spam from being sent from servers all the more difficult.

osm is for any server owner using cPanel that is concerned about future or active attempts to send out spam email through the server. It targets all the methods available to keep track of outgoing email and SMTP connections. It is designed to be used entirely from the cPanel WHM UI, which provides both configuration and viewing of reports generated by a daemon process running continuously on the server.

Features

  • Outgoing email sent via exim is tracked per cPanel account
  • Matching Subject headers for outgoing email sent via exim is tracked per cPanel account
  • Script path location (cwd) is tracked per cPanel account
  • Matching script path location (cwd) is tracked per cPanel account
  • Outgoing SMTP connections to remote servers (that bypass exim) are tracked
  • Matching script path location for outgoing SMTP connections to remote servers (that bypass exim) are tracked
  • Authenticated outgoing email is tracked by account and connecting IP address
  • osm uses real-time Packet Inspection to track SMTP connections, this is primarily useful if you cannot use the csf SMTP_BLOCK or cPanel provided equivalent feature
  • Configurable trigger levels for each type of tracking on a per email/connection per second basis
  • Apache Status used to link outgoing email with actual scripts being used
  • Multiple actions can be performed once a report is raised after a trigger level is reached:
    • Send an email report of the events
    • Store the report of events to view in the WHM UI
    • Hold outgoing email from the cPanel/email account in the exim queue
    • Discard outgoing email from the cPanel/email account
    • Suspend the whole cPanel account
    • Prevent the email account from logging in
    • Rename the reported path
    • Run the custom script configured in the WHM UI
    • Rename the file determined from the Apache Status
    • Block the IP address (AUTHRELAY, ALWAYSRELAY, POPRELAY, Apache Status) in csf
  • Custom action script is configurable and can be sent JSON, YAML, XML and PERL data structures to allow for client specific actions
  • Inheritance rules are used to configure all trigger levels for each cPanel account plus the default settings

We will provide more information once we enter Beta testing and will put out a call for limited slots for those that would like to help test at that time.

New csf v12.03

Posted on by Chirpy

Changes:

  • Make CC_IGNORE check case-insensitive
  • Improved TCP/UDP port inspection for IPv6 connections (affecting CT_*, PT_* and PT_SSHDKILL)
  • Updated cxs FontAwsome to v5
  • Added fixes for additional Include line processing
  • Fixed race condition when processing CC_* zip files that could sometimes prevent the csv files from being extracted
  • Updated HTTP::Tiny to v0.070