How to prevent compromising the email server if user credentials leaked?

Ljubisa Livac

4/21/24, 8:54 PM

I've been using AWS SES as an SMTP relay (Postfix + Dovecot) for years and now am facing the pausing of sending emails for the second time. We use this combination as an email server for business email purposes.

After my email server has been hacked for the first time I enabled Multi-Factor Authentication. I didn't find out how the attacker managed to compromise the server and send emails. Everything went well for more than a year, and now the problem was one of the user's email accounts as an attacker somehow got in the possession of the user's email password.

So, I am wondering what is the best way to prevent future problems of this type, as this can happen all the time to any of the users? After my email server was compromised for the first time I configured Amazon's Automatically pausing email sending for the entire Amazon SES account, using their guide, but it seems it looks it didn't help this time to pause email sending after reaching the bounce limit, so I will have to check in more details what happened with this alarm.

Are there any other suggestions? I thought that it may be good to somehow (using postfix configuration) limit the number of outgoing emails, for each user, per minute/hour - so it could give me more time to react if the same happens again, instead of allowing the user to send hundreds of emails per minute?

0 + 3

postfix

hacking

credentials

amazon-web-services

Greg Askew

4/22/24, 9:32 AM

`what is the best way to prevent future problems of this type` There are plenty of EDR solutions on the market. You obviously don't have one, however solution requests are inappropriate for this forum.

larsks

4/22/24, 9:13 PM

When Greg says "EDR" he means "[Endpoint Detection and Response](https://en.wikipedia.org/wiki/Endpoint_detection_and_response)". Your rate limiting idea seems reasonable; postfix has built-in [rate-limiting facilities](https://www.postfix.org/postconf.5.html#smtpd_client_message_rate_limit).

Ljubisa Livac

4/23/24, 7:56 PM

Thank you @larsks for the clarification, never heard of EDR before! Awesome, I'll check that rate-limiting facilities!

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to prevent compromising the email server if user credentials leaked?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.