Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a Barracuda Antispam unit and look to use recipient validation with active directory to stop sending NDRs (non-delivery reports) when we are being spammed.

What I see on the web is people opening the port between the barracuda unit IP address in the DMZ and the active directory domain controller in the LAN.

As it is only allowed for the barracuda unit am I paranoid? Do you think I could do it, or is there a better way?

share|improve this question
    
Is the Barracuda unit only being used for SPAM or also for other firewall duties? Is there any particular reason it needs to be in the DMZ to begin with? If your mail server is in the DMZ as well, then can it simply talk to the mail server? –  AJ Henderson Apr 22 '13 at 20:02
add comment

2 Answers

up vote 1 down vote accepted

Like most such solutions, the Barracuda Antispam offers directory lookup (LDAP/LDAPS), SMTP "look-ahead" where each recipient is validated on the next SMTP hop before being accepted, and a manual recipient list -- see Solution #00003521. Only the directory lookup approach requires an additional port, you would need to permit LDAP/LDAPS (389/636) or more commonly the GC ports (3268/3269) from the Barracuda to a suitable AD server.

Domains > manage domain > Users > LDAP Configuration

You can configure a low-privilege AD user which only needs search access to user email attributes in your AD tree (then enable it for the domain on the Barracuda under the ''Valid Recipients'' tab). Assuming you do not permit anonymous search access to your directory (not recommended), you should use a dedicated search user and LDAPS, this will require a certificate on the AD server.

SMTP look-ahead only works if the next hop is able to authoritatively answer, i.e. it must reject invalid recipients (with an SMTP 550) or it will not be effective. You may need to configure it to do that (some SMTP servers inexplicably default to accepting anything, then generating a bounce for invalid recipients). Look ahead is implicitly enabled if LDAP is not used. If you're using MS-Exchange, this is quite likely what's preventing the default look-ahead from being effective, look at this approach first.

Otherwise, using LDAP is the next best approach, though not without some risk since you're allowing a device which accepts untrusted connections from the internet establish connections to your AD. More paranoid alternatives are an LDAP proxy in a DMZ (reasonably straightforward with OpenLDAP as a proxy); or a filtered replica in a DMZ (I believe this may not be easy to do with AD, though it's easy in a OpenLDAP environment).

(Also, if you're not using it already, try the Barracuda RBL, it's very effective at blocking unwanted connections, though expect a low number of false positives).

share|improve this answer
add comment

I'm wondering how to secure a similiar architecture. On my site i've decided to go for on of the two following opts:

1) use a RODC dc in DMZ ( limiting thus any WRITE risk to active directory ) 2) using ADAM as reverse LDAP Proxy ( see this article http://technet.microsoft.com/en-us/magazine/2008.12.proxy.aspx )

Hope it helps

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.