hmLoadTopic({
hmKeywords:"Account Hijack Detection,From header modification,Hijack Detection,Hijack Detection,Hijack Detection From header modification,Security,Security Hijack Detection",
hmTitle:"Hijack Detection",
hmDescription:"Account Hijack Detection The options on this screen can be used to detect a possibly hijacked MDaemon account and automatically prevent it from sending messages through your ser",
hmPrevLink:"security--smtp_screen.html",
hmNextLink:"security--spambot_detection.html",
hmParentLink:"security_menu.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; Screening",
hmTitlePath:"Security Menu > Security Manager > Screening > Hijack Detection",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">Hijack Detection<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5625rem;height:26.9375rem;border:none\" src=\".\/images\/screening_hijack-detection.png\"\/><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Account Hijack Detection<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">The options on this screen can be used to detect a possibly hijacked MDaemon account and automatically prevent it from sending messages through your server. For example, if a spammer somehow obtained an account\'s email address and password then this feature could prevent the spammer from using the account to send bulk junk e-mail through your system. You can designate a maximum number of messages that may be sent by an account in a given number of minutes, based on the IP address from which it is connecting. You can also choose to disable accounts that reach the limit. There is also<\/span><span class=\"f_BodyText\"> an <\/span><span class=\"f_BodyText\" style=\"font-style: italic;\">Exempt List<\/span><span class=\"f_BodyText\"> that can be used to exempt certain addresses from this restriction. Account Hijack Detection is enabled by default.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">Account Hijack Detection only applies to local accounts over authenticated sessions, and the Postmaster account is automatically exempt.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Limit messages sent from reserved IPs to [xx] msgs in [xx] minutes<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option to prevent MDaemon accounts connecting from reserved IPs from sending more than the specified number of messages in the designated number of minutes. Reserved IP addresses are mostly as defined by RFCs (for example, 127.0.0.*, 192.168.*.*, 10.*.*.*, 172.16.0.0\/12, ::1, FD00::\/8, FEC0::\/10, and FE80::\/64).<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Limit messages sent from local IPs to [xx] msgs in [xx] minutes<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option to prevent MDaemon accounts connecting from any local IPs from sending more than the specified number of messages in the designated number of minutes. Local IPs are all IP addresses configured for any of your MDaemon domain.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Limit messages sent from all other IPs to [xx] msgs in [xx] minutes<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option to prevent MDaemon accounts connecting from any other IPs from sending more than the specified number of messages in the designated number of minutes.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Limit access to [xx] connections from differing IPs in [xx] minutes<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option to limit the number of connections from different IP addresses allowed within the specified number of minutes. For example, in normal circumstances if your account is accessed from ten different IP addresses within just a few minutes, it is likely the account has been hijacked. This option is disabled by default.<\/span><\/p>\n\r<p class=\"p_CenteredHLine\" style=\"border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_CenteredHLine\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Include LAN IPs when limiting local IPs<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default <a href=\"security--lan_ips.html\" class=\"topiclink\">LAN IPs<\/a> are included when using the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Limit messages sent from local IPs...<\/span><span class=\"f_ControlIndent\">&quot; option above. Uncheck this box if you do not wish to include LAN IPs when limiting local IPs.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Send 5XX when limit is reached (otherwise 4XX)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default when one of the limits is reached, MDaemon will send a 5XX reply code to the hijacked account. Disable this option if you wish to send a 4XX code instead.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Freeze accounts when limit is reached<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Check this box if you wish to freeze accounts that attempt to send more than the allowable number of messages. When this happens, the server sends a 552 error, the connection is dropped, and the account is immediately frozen. The frozen account will no longer be able send mail or check its mail, but MDaemon will still accept incoming mail for the account. Finally, when the account is frozen an email is then sent to the postmaster about the account. If the postmaster wishes to re-enable the account, he can simply reply to the message.<\/span><\/p>\n\r<p class=\"p_CenteredHLine\" style=\"border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_CenteredHLine\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">If an account causes [xx] 5xx RCPT errors within [xx] minutes<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This option monitors how many times an account attempts to send messages to an invalid recipient within a fixed amount of time. One common characteristic of spam email is that the messages are often sent to a large number of invalid recipients, due to the spammer attempting to send them to old email addresses or otherwise guess new ones. Therefore if an MDaemon account begins sending messages to a notable number of invalid recipients in a short amount of time, that is a good indication that the account has been hijacked and is being used to send spam. Using this option with the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Freeze the account...<\/span><span class=\"f_ControlIndent\">&quot; option below can help stop a hijacked account before too much damage is done. Note: For this option, an invalid recipient is defined as a 5xx error code in response to a RCPT command when trying to send the account\'s mail.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Freeze the account (the admin will have to unfreeze)<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Use this option if you wish to freeze an account when the &quot;<\/span><span class=\"f_ControlIndent2\" style=\"font-style: italic;\">If an account causes [xx] 5xx RCPT errors...<\/span><span class=\"f_ControlIndent2\">&quot; threshold above is reached. When this happens the administrator will be notified via email, so that he can investigate the problem and unfreeze the account.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Exempt List<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use the <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Exempt List<\/span><span class=\"f_ControlIndent\"> to designate any addresses that you wish to exempt from Account Hijack Detection. Wildcards are permitted. For example, &quot;<\/span><span class=\"f_PlainText\">newsletters@example.com<\/span><span class=\"f_ControlIndent\">&quot; would exempt example.com\'s &quot;newsletters&quot; MDaemon account, while &quot;<\/span><span class=\"f_PlainText\">*@newsletters.example.com<\/span><span class=\"f_ControlIndent\">&quot; would exempt all MDaemon accounts belonging to the newsletters.example.com domain. The Postmaster account is automatically exempt from Account Hijack Detection.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><\/p>\n\r"
})
