Blog

From time to time, you’ll need to monitor a port to see if there’s a problem brewing.  For smaller companies, it can be quite a chore to deploy some sort of commercial or open-source monitoring solution (e.g., NAGIOS-based stuff), when all you want to do is do some quick and dirty monitoring. Example: you justRead more

I just wanted to share with you a very useful tool that’s been around for a while now, and it helped me solve a problem on a customer’s machine.  To properly investigate, I had to extract several logs from the customer’s server on a scheduled basis and have them FTP’d here so that I couldRead more

From time to time, customers wind up getting blocked by a seldom seen blacklist called ‘RFC-Ignorant.’  Unlike classical blacklists that are usually honeypot driven, this one is driven by people who have manually reported you as violating RFC. RFC-Ignorant targets 5 specific faux-pas: 1. Lack of a Postmaster address on the server 2. Inability toRead more

Every time I do a setup with a customer, the question always comes up: Should we use Reverse DNS checking or not when configuring connection-level blocking security measures? What is reverse DNS lookup? Here’s a snippet taken from Wikipedia’s description: ‘Reverse DNS lookups for IPv4 addresses use a reverse IN-ADDR entry in the special domainRead more

Is it good or bad? Well the answer is it depends. If your organization only operates within North-America, for instance, blocking the more prolific spam sources by country may be a very good way to reduce the amount of traffic hitting your MTA. For example, you could block all traffic coming from the top-10 spamRead more