Is it possible for an attacker to extract the list of mailboxes for a specific domain from an Mdaemon installation?
Yes, its possible.
If so, what settings in the Mdaemon configuration should be checked to avoid problems like this?
There is no way to completely prevent this, other than to take your server off the internet. Given enough time and patience a malicious person can discover all of your addresses by simply sending valid mail to them. For example, a dictionary attack would take a long time. The stricter your settings are for limiting connections, rcpts etc, the longer it takes.
Try to not follow a traditional pattern such as firstname.lastname@domain.com for your mailboxes. This makes it easy to figure out valid email addresses, you just need a list of employee names.
How to protect against it is really just a guide on how to secure your MDaemon server.
You should turn off every server in MDaemon that is running but not used. Reduce your attack surface as much as possible.
Require strong passwords and force them to be as long as your environment allows. Expire passwords at least once a year. In my opinion, the longer the passwords are required to be, the less frequent they need to be changed, but they should still be changed once a year. For example, if you require passwords to be 20 characters long, then you can change passwords every 90 - 180 days.
Use app passwords for clients.
Require two factor authentication for Remote Administration and Webmail.
You should turn on every security feature in MDaemon. I'll touch on some of the main security features that should be enabled.
Make sure VRFY and EXPN are disabled (Setup | Server Settings | Servers)
Enable Reverse PTR, HELO/EHLO, and MAIL lookups (Security | Security Settings | Reverse Lookups) Configure it to be as strict as your environment allows. Reverse lookups block more malicious connections in our environment than any other security feature.
For Dynamic Screening, enable authentication failure tracking, dynamic screening block list, block login policy violations and then configure the limits as strict as your environment allows and apply it to all protocols. (Security | Dynamic Screening)
Require SMTP Authentication for all mail sent from a local account. (Security | SMTP Authentication)
SPF, DKIM, and DMARC should all be enabled and you should have the appropriate DNS records for your domain. This does not directly impact somebody trying to figure out all of your email addresses, but it is very important for email security and often over looked.
Host Screening should be enabled with at least the default list of patterns. (Security | Screening | Host Screening) if you do not have the default list, or you want to make sure its up to date, delete the MDaemon\app\hostscreen.dat file and then restart MDaemon. After doing this you'll need to re-add any entries that you have manually added. Be sure to enable Drop connection after EHLO (do not wait for authentication).
SMTP screening should have every limit configured as strict as your environment allows. If you have users using IMAP, some clients will open a connection for every folder they have. How low you can set this value can vary greatly, and may require some experimentation.
Hijack detection should be configured as strict as your environment allows.
Location Screening should be configured to Prevent Authentication from every country that should not be attempting to authenticate with your server.
Make sure you have a valid and trusted certificate and SSL/TLS is required. (Setup | Server Settings | Servers). Uncheck Allow plain text passwords and Enable APOP and CRAM-MD5, this will reject all authentication attempts that are using non SSL connections.
Enable tarpitting and configure it as secure as your environment allows. (Security | Other | Tarpitting) Be sure to configure a reasonable SMTP EHLO/HELO delay. I'm sure there are varying opinions on the effectiveness of this setting, configure it and see if it helps in your environment. We are using 10 seconds and it seems to work well. If you go too high, valid senders will give up before a session completes. If you go to low it will not deter malicious connections. The RCPT threshold, delay, and scaling factor are also important to slow progress for a connection attempted to harvest data.
BackScatter Protection should also be configured.(Security | Other | Backscatter)
I didn't try to cover everything, just the basics and I'm sure I missed some thing. If you have questions or want to know more, just let us know.
English
Chinese (Simplified)
French
German
Italian
Japanese
Russian
Spanish
Vietnamese
