1. What advatages / side effects are there to setting a POP3 Lock time?
This is just how long the SMTP server will allow a message to relay off of it from the IP that the users authenticated via POP3 with. I usually set it somewhere between 15 and 20 minutes, typically our customers are fairly static so it's really not that much of a security issue. In all honesty, any worm that is using an SMTP server to send mail through could probably use the cached credentials to establish a pop3 session with that server as well to circumvent any of that. So I really don't see if being a tool that can help with that much, just prevents unauthorized users from relaying off of your server yet allowing authorized users to do just that. I prefer SMTP auth myself, but sometimes it's difficult to get users to configure it properly, and again if they are using cached credentials or actually using the mailer itself to propogate the worm it's not going to help. This is where a virus scanner on the SMTP server will come into play (at least stopping the spread of the worm).
2. I have a new client who want to host their mail with me, but they have been the victim several times of viruses that mass mail. Would it be advantageous to making them use their ISP's SMTP service, and my servers POP3 facility instead? What stops them guessing that the incoming and outgoing mail server names are the same though?
What's the intended benefit for this, and to who? Are you concerned that they may flood your server with spam or trojans? I would suggest probably using the anti-virus option from Plesk or from 4PSA. Depending on your size, it might be beneficial to have a dedicated mail gateway, we're implementing this now, plesk will forward all mail from qmail via SmartHost to our mail gateway which is a pretty high-end appliance that does mail filtering for Spam, Viruses, etc... All mail destined to the users in Plesk also go through this mail gateway.
I know ART was working on a Postfix solution to this, where postfix handles the relaying for Qmail, but I don't know the status of this.
3. Is there a way to monitor qmail queues and usage?
From what I know, it all has to be done in a shell:
Queue Statistics:
/var/qmail/bin/qmail-qstat
List messages in the queue, shows sender, recipient, date and message number:
/var/qmail/bin/qmail-qread
qmHandle - a tool for the qmail queue:
http://sourceforge.net/projects/qmhandle/
Pretty good all-in-one tool that will do most of the above plus more, I've not used it much in a Plesk environment, but I see no reason why it shouldn't work.
Hope this helps.
-Bill
Facebook
Twitter