Application Inspection and Control for SMTP

The Application Inspection and Control for SMTP feature provides the following benefits:

• E-mail senders and user accounts are restricted to filter spam e-mail from suspected domains.
• An action can be specified, which occurs when a number of invalid recipients appears on an SMTP connection. This action helps identify spammers who are looking for valid user accounts.
• The number of invalid SMTP recipients can be restricted by specifying a maximum number for invalid recipients on an SMTP connection.
• A pattern can be specified that identifies e-mail addressed to a particular recipient or domain in cases where a server is functioning as a relay.
• A provisioning mechanism that provides masks specified verbs in an SMTP connection to block potentially dangerous SMTP commands.
• The maximum length value for the SMTP e-mail header can be specified to prevent a Denial of Service (DoS) attack (also called a buffer overflow attack). A DoS attack occurs when the attacker continuously sends a large number of incomplete IP fragments, causing the firewall to lose time and memory while trying to reassemble the fake packets.
• The maximum length of an SMTP command line can be specified to prevent a DoS attack.
• Multipurpose Internet Mail Extension (MIME) content file-types (text, HTML, images, applications, documents,and so on) can be restricted in the body of the e-mail from being transmitted over SMTP.
• Unknown content-encoding types can be restricted from being transmitted over SMTP.
• Specified content-types and content encoding types can be restricted in the SMTP e-mail body.
• Monitor arbitrary patterns (text strings) in the SMTP e-mail message header (subject field) or body.
• A parameter in an EHLO server reply and mask can be specified to prevent a sender (client) from using the service extension in the server reply.
• An SMTP connection can be dropped with an SMTP sender (client) if the SMTP connection violates the specified policy.
• SMTP commands or the parameters returned by the server in response to an EHLO command can be explicitly masked by specifying these SMTP commands.
• An action can be logged for a class type in an SMTP policy-map.

The Cisco Common Classification Policy Language (C3PL) CLI structure is used to provision ESMTP inspection. ESMTP is provisioned by defining a match criterion on an SMTP class-map and associate actions to the match criterion defined in the SMTP policy-map. The Application Inspection and Control for SMTP feature adds new match criteria and actions to the existing SMTP policy maps that are discussed in the Zone-Based Policy Firewall module, which describes the Cisco IOS unidirectional firewall policy between groups of interfaces known as zones.

Figure 1

ESMTP Communication Between a Sender and Receiver

The Common Classification Engine (CCE) SMTP database is the site at which manually configured policy information is processed and converted into signatures. The information in these signatures is put into regular expression tables, which are then used to parse packets as they are switched by a router.

The SMTP database has two interfaces. One interface has the control plane, which is used to accept user configured policies, and the other interface has the CCE data-plane engine, which is used to classify a packet.

An action module is used as a part of the Context-Based Access Control (CBAC) SMTP inspection module to organize and trigger SMTP inspection. CBAC is used to detect and block SMTP attacks (illegal SMTP commands) and sends notifications when SMTP attacks occur.

1.    enable

2.    configure terminal

3.    class-map type inspect smtp class-map-name

4.    match protocol smtp

1.    enable

2.    configure terminal

3.    parameter-map type regex parameter-map-name

4.    pattern traffic-pattern

5.    exit

6.    class-map type inspect smtp match-any class-map-name

7.    match sender address regex parameter-map-name

8.    exit

9.    policy-map type inspect smtp policy-map-name

10.    class type inspect smtp class-map-name

11.    log

12.    reset

Spammers who search for a large number of user accounts in a domain typically send the same e-mail to all the user accounts they find in this domain. Spammers can be identified and restricted from searching for user accounts in a domain by using the match recipient count gt command to specify an action that occurs when a number of invalid recipients appear on an SMTP connection.

Note	The match recipient count gt command does not count the number of recipients specified in the To or Cc fields in the e-mail header.

1.    enable

2.    configure terminal

3.    class-map type inspect smtp class-map-name

4.    match recipient count gt value

5.    exit

6.    policy-map type inspect smtp policy-map-name

7.    class type inspect smtp class-map-name

8.    reset

1.    enable

2.    configure terminal

3.    class-map type inspect smtp class-map-name

4.    match recipient invalid count gt value

5.    exit

6.    policy-map type inspect smtp policy-map-name

7.    class type inspect smtp class-map-name

8.    reset

A nonexistent e-mail recipient pattern can be specified to learn about spam senders and their domain information by luring them to use this nonexistent e-mail recipient pattern. This pattern is a regular-expression (regex) that can be specified to identify an e-mail addressed to a particular recipient or domain when a server is functioning as a relay. The specified pattern is checked in the SMTP RCPT command (SMTP envelope) parameter to identify if the recipient is either used as an argument or a source-list to forward mail in the route specified in the list.

Note	The match recipient address regex command does not operate on the To or Cc fields in the e-mail header.

1.    enable

2.    configure terminal

3.    parameter-map type regex parameter-map-name

4.    pattern traffic-pattern

5.    exit

6.    class-map type inspect smtp class-map-name

7.    match recipient address regex parameter-map-name

8.    exit

9.    policy-map type inspect smtp policy-map-name

10.    class type inspect smtp class-map-name

11.    log

12.    reset

Use this task to hide or "mask" commonly encountered SMTP verbs (SMTP commands) or specified private SMTP verbs used to provision an SMTP connection.

Specified verbs, such as the ATRN, ETRN, BDAT verbs may be considered vulnerable to exploitation if seen by a sender (client). The most commonly encountered SMTP verbs are listed along with the facility to specify a private verb as a string (using the WORD option).

Note	The BDAT verb (used as an alternative to DATA) is not used, so in its place, the CHUNKING keyword is masked in the EHLO response. However, if the sender (client) continues to send the BDAT command, it is masked.

Note	Using the mask command applies to certain match command filters like match cmd verb. Validations are performed to make this check and the configuration is not be accepted in case of invalid combinations.

1.    enable

2.    configure terminal

3.    class-map type inspect smtp class-map-name

4.    match cmd verb {verb-name | WORD}

5.    exit

6.    policy-map type inspect smtp policy-map-name

7.    class type inspect smtp class-map-name

8.    mask

1.    enable

2.    configure terminal

3.    class-map type inspect smtp class-map-name

4.    match header length gt bytes

5.    exit

6.    policy-map type inspect smtp policy-map-name

7.    class type inspect smtp class-map-name

8.    reset

1.    enable

2.    configure terminal

3.    class-map type inspect smtp {class-map-name | match-all class-map-name | match-any class-map-name}

4.    match cmd {line length gt length | verb {AUTH | DATA | EHLO | ETRN | EXPN | HELO | HELP | MAIL NOOP | QUIT | RCPT | RSET | SAML | SEND | SOML | STARTTLS | VERB | VRFY | WORD}}

5.    exit

6.    policy-map type inspect smtp policy-map-name

7.    class type inspect smtp class-map-name

8.    reset

class-map type inspect smtp match-all c2
  match cmd line length gt 256
  match cmd verb MAIL

1.    enable

2.    configure terminal

3.    parameter-map type regex parameter-map-name

4.    pattern traffic-pattern

5.    exit

6.    class-map type inspect smtp {class-map-name | match-all class-map-name | match-any class-map-name}

7.    match mime content-type regex content-type-regex

8.    exit

9.    policy-map type inspect smtp policy-map-name

10.    class type inspect smtp class-map-name

11.    log

1.    enable

2.    configure terminal

3.    class-map type inspect smtp {class-map-name | match-all class-map-name | match-any class-map-name}

4.    match mime encoding {unknown | WORD | encoding-type}

5.    exit

6.    policy-map type inspect smtp policy-map-name

7.    class type inspect smtp class-map-name

8.    log

The match body regex command can be used to specify an arbitrary text expression to restrict specified content-types and content encoding types for text and HTML in the body of the e-mail. The text or HTML pattern is scanned only if the encoding is 7-bit or 8-bit and the encoding is checked before attempting to match the pattern. If the pattern is of another encoding type (for example, base64, zip files, and so on), then the pattern cannot be scanned.

Note	Using this command can impact performance because the complete SMTP connection has to be scanned.

1.    enable

2.    configure terminal

3.    parameter-map type regex parameter-map-name

4.    pattern traffic-pattern

5.    exit

6.    class-map type inspect smtp {class-map-name | match-all class-map-name | match-any class-map-name}

7.    match body regex parameter-map-name

8.    exit

9.    policy-map type inspect smtp policy-map-name

10.    class type inspect smtp class-map-name

11.    log

1.    enable

2.    configure terminal

3.    parameter-map type regex parameter-map-name

4.    pattern traffic-pattern

5.    exit

6.    class-map type inspect smtp {class-map-name | match-all class-map-name | match-any class-map-name}

7.    match header regex parameter-map-name

8.    exit

9.    policy-map type inspect smtp policy-map-name

10.    class type inspect smtp class-map-name

11.    reset

1.    enable

2.    configure terminal

3.    class-map type inspect smtp {class-map-name | match-all class-map-name | match-any class-map-name}

4.    match reply ehlo {parameter | WORD}

5.    exit

6.    policy-map type inspect smtp policy-map-name

7.    class type inspect smtp class-map-name

8.    log

9.    mask

A logging action can be configured for a class type in an SMTP policy-map when conditions specified by the traffic class are met. The logging action results in a LOG_WARNING syslog message followed by the specific log message. The log message format is similar to other application firewall modules (for example, HTTP, IM, Peer-to-Peer (P2P)); session initiator/responder information, and zone-pair and class names.

Note	The log action currently exists for other types of policy-maps (http, pop3).

1.    enable

2.    configure terminal

3.    class-map type inspect smtp {class-map-name | match-all class-map-name | match-any class-map-name}

4.    match cmd verb {parameter | WORD}

5.    exit

6.    policy-map type inspect smtp policy-map-name

7.    class type inspect smtp class-map-name

8.    log