Securing SMTP server and its logs [closed]

Question

Looking for general mail server security best practices here.

I did some research and it's really hard to find the information out there.

1. How do you safeguard a smtp server log? Are there any encryption tools out there? Our reason is if the server is compromised, at least the logs are not in plaint text format for attackers to see without obtaining our tool/keys.

2. It seems like most SMTP servers out there store recipient information in the log files. How can we ensure these informations are not stored or at a minimum are scrambled. Is that possible?

Thank you and I'm still researching on the subject.

==== Edit

The context here is we are a gov agency trying to use a third party mail server for sending out mass emails. We are concerned with "client" email addresses being revealed or be read by third parties. How do we safe guard the recipient info as well as the mail content?

Answer 1

The context here is we are a gov agency trying to use a third party mail server for sending out mass emails. We are concerned with "client" email addresses being revealed or be read by third parties. How do we safe guard the recipient info as well as the mail content?

You can't. Since you are using a third party server to send the email the third party server must of course know the target email. And every other server on the way to the recipient must know it too since otherwise the mail cannot be delivered. This is like with snail mail - you need to put the recipient email on the envelope and whoever delivers the mail can see it.

As for protecting the content: unless you have already established a way with the client to exchange encrypted mail you cannot encrypt the mail and everyone involved in delivery of the mail can read it. It is like a postcard in snail mail. And it is very unlikely that you have some encryption setup with the client since this would involve exchanging keys or certificates associated with the person and most senders and recipients don't have these in the first place.

Answer 2

If you want to verify that the information on the SMTP logs is correctly and has not been tampered probably you will need to implement extra functionality on your M TA. On the past, I worked on a project and we got the same problem, basically we implement some functions with PKI and Hashing (SHA1) to prevent any one could modify a log file (malicious admin). Not sure if opensource MTAs have that functionality.

Answer 3

I think one simple solution to this would be to use some tool like logrotate and add a script in the postrotate section that uses a public key to encrypt the data. Note that this does not prevent tampering and it leaves the data since the last logrotate run unprotected. However, I think it is a good step in the right direction.

If you want to protect the files from tampering logrotate also has options for mailing the logs or you can have a similar script that will copy them to a remote server to some kind of write-once storage.

If you are using syslog you could also generally use a remote syslog facility. This is supported by exim, for example. I have no experience with it so there might be hidden caveats but in general it sounds like an interesting solution to the problem.

And this is only vaguely related to your question but I always like to advertise https://bettercrypto.org/ which has information for good setup defaults for a wide variety of software.