We're looking forward to bringing you some entertaining little things.
We are part of the Heinlein group and we'll show you some of our things that we are.
The talk is going to be about lessons learned and some interesting tools.
Yeah, I think we'll do the intro just after us.
Yeah, part of Heinlein group, we had a talk from Pascal earlier who was introduced already,
so we have a couple of different compartments here and we are part of the Heinlein
itself and they're the IT baratung baratung means consulting, so yeah, that's us and we also
have a couple of other things, services from various from academy to open talk, which I think
is holding talks and wells and yeah, definitely open cloud, we're really eagerly waiting
as well for it to release as this is a nicely asked and yeah, as well as mailbox, email provider,
also part of the thing and so I would say, yeah, do pass by, have a look, especially now and here
we are at our talk. So we've been doing mail at Heinlein, I've been there since 2019,
Linux, I'm doing since the end of the 90s and we are putting large scale or various kind of email
infrastructures out there and yeah, would like to share something, so maybe you want to introduce
yourself? Yeah, hi, I'm casting, I'm doing nearly the same two years longer at Heinlein
Heinlein, I would say. So the infrastructures were small sometimes, sometimes big, so they are
growing more and more, so we have some pictures from the old times at least one, yeah, let's see.
Yeah, so Jaymap, yay, we are looking forward, but in our day today, there's it's not there yet,
we're looking forward for the 100 this year, soon, soon and then yeah, a lot of things are
bound to that, so maybe next year, I hope this year. Yeah, that would be Jaymap and
that's where it all started, we had our critical infrastructure below our desk and that's what the
mail admins were taking care of and it was all, you know, in your own control, but times have
changed. So this was one of my first experiences as a coinciding, so an appointment out of the house
called from from a customer, okay, yes, it's email, server under his desk, it's not
booting anymore, so I've grabbed a car and was driving to to this customer to fix this email server.
More or less, since then, we we have done a little bit more for a high availability and, yeah.
Yeah, but still, we still have infrastructures where we completely redesigned everything,
and still we have popsary mail boxes or software or customers who use popsary,
and it's sometimes only popsary, it's completely fine.
Because, for like phone ISP, they sometimes have customers which have a contract
over 20 to 25 years, and now when they say, okay, we want to drop popsary as a support,
they were all called the company and saying, what's going on, what to do now, and they
may be see that also the price, the prices are better at the companies currently.
The other is about old software. You all know this SFTP is a transactional real-time protocol for
exchanging data. Yeah, it's still the case, so we have some infrastructures where data
is sent with SMPP, fetched with pop. Do you know the staff cards MD box and the feature
that you have to purchase the mailbox from time to time? Do you know what happens when you don't
purchase? You did it emails, but you don't purchase, so it will not be deleted from the
MD box fire, and then what's happening when you forgot it and had millions of emails?
And your monitoring is not up to date. Did we mention that this is critical infrastructure?
Yeah, so we do see things that, yeah, we can't name names, but the systems are still out there.
Yeah, another thing is about freedom of speech and the science, and here we are looking at
the difficulty, for example, how to enforce the market SFTP policies. I have been sending my mail
through Gmail all the time, so I need to do that. I'll have to send it out via Gmail or or or.
So when we are coming to infrastructure and we're saying, okay, we can put SPS out there and we
can do, and then suddenly we see how many actual clients are still not or would be rejected if
this is actually then put into place hard. Yeah, these are day-to-day problems that we are
often interfacing. The other thing is also on the inbound is that, oh, it is super, super
important for me that I get all the email, but we have a little bit longer one,
if we're kind of the topic of the chapter. Yeah, for this, we can always say there are 10 types
of postmasters, also know what to do in those who do, but not really, it's always about resources
about the power of other people, so if a local prof at the university has good connections to the
port of directors and so on and that they're nice stories inside. There are also companies,
also universities which are doing completely fine, was was all of the security stuff was D-Mark
SFF and so on. There was a talk announced from the University of Bond, Peter Veneman,
it's a pity he's ill, so that it was set was one of our very, very good projects,
but there, as you can see, there are those where the prof still using his Gmail and sending
was a university address. This is also one of the things, there seems to be a good agreement
of postmasters who don't have enough resources to do it in a good way, so that they have to
manage not only made but also storage and databases and maybe also the idea. And the funny thing
is when there was a pushing wave inside the university, one or two weeks later, there's a
maze bike beginning on Friday, 6 p.m. and ending on Monday, maybe 4 a.m.
Universities are often very good in targets and infrastructures to sending pushing
teams, because there's always has perfect resources network connection and so on.
So yeah, for the last one also, you'll come back on Monday and you see you're on the outbound
servers, there's a mail queue of several hundred thousand, you'll know something went wrong.
The next thing is our real-world experience and to end encryption. So we're very much for it
and we really love it and we would love everybody to include PGP and so on. In big corporations or
bigger establishments, it becomes very difficult for the management of all those certificates.
So what we see is that if you want to have it end encrypted, you can also say, okay,
if we can ensure that every part is actually TLS encrypted on the way, we have basically an
end-to-end encryption, but that is not sufficient according to some German official policies,
yeah, that is okay, okay, then of some interpretations of German policies, this is not sufficient,
sorry, I'm stand corrected. And so what we need to then do is to enforce this is to implement
S-mime gateway. So ideally it would look like like the first base, but now so the problem is that
you cannot have the users every one their own certificates, so you use something like a domain
certificate and the user sends to the MTA, the MTA sends it to the encryption gateway, the encryption
aches it back to the MTA, then it leaves the site and on the other side you have the same thing
and goes to the user. Would you call this end-to-end encryption? No, thank you. But there's
are the crimes we have to deal with in the real world and so this is what then is being built.
And then sometimes some of these gateways are not multi-tenant able and then you have within the same
organization is from one client to send to the other and then it does that, yeah, so the user sends to the
MTA, the MTA to the encryption gateway, encryption back to the MTA to this heck hand encryption gateway because
that's for that domain and sends it back to the MTA and then to the second user. And did I mention that
we are not able to always enforce TLS internally? Okay, yeah, so sometimes you just wonder why
things are the way they are, but again you have to deal with the realities of life.
Yeah, but then it's how it's meant to be, so it was enter entered the encrypted in between
for two seconds, maybe. Yeah, another thing, the fear of missing email, not formal for me,
this is sometimes we redeploy complete infrastructures and then we get those questions
what will happen to an email? I don't want to send bounces back, it looks bad to the send
I've heard about if I send bounces back. What if if I want this email and it was rejected,
what should I do? I want it. And sometimes it's a bit like this last question, what if my
connection will break and then I don't have this email locally? It sounds a bit like it is
from this time here, so it's really even today we are sometimes we sometimes still do things where
emails are discarded, where they're ground time or something. We don't love ground time,
we hate this card at this point and we always would, would favour reject everywhere, but sometimes
it customers says I need it, please please do so. Yeah, also a nice thing, we have protocols for
for email authentication. We all know that they have their problems,
with SPF was forwarding and everything, but is it possible to enforce those?
Yes, it's possible. No, no, it's not. If I've worked in the company, was it say it's team?
Yes. No, it's time for the experience that someone from the state teams came out. Okay,
this got this email back. Why have we talked to me? Yeah, our SPF was, this email was forwarded and
our SPF was not correct. Well, and the guy said, I don't care. It makes that it works. Put
of the records. There are always those two types. One of them says they want to have
every email. They have those forwarders, they have those email addresses, they have their,
not only WordPress, but let's say in the first structure, which is sending out emails in their
name, and they still want to get them. Yeah, and the other type, best, best, since you have
in the, on the same server, they say, okay, I really want those policies applied because it's
part of the May security, and we really would love to do so, but it's not possible. Often,
it's not possible. You can do per user. Let's say it would be perfect.
Yeah, ARC is awesome, and I wish everyone would employ it, and would employ it well.
Yes, yes, yes, yes, yes. Perfect. All right, all right, we're waiting for it, we're waiting for it.
But at least it helps us for all these forwarding stuff, but then you have these big pairs,
and you're really surprised. This is just from the logs of a couple of days ago, and one would
assume they can do it. So they sign and then they change the mail. And this is not the one off.
Yeah, so yeah, we're, we're sometimes just surprised. And yeah, I think,
yeah, without words. This one for you.
This is mine. Yeah. What to tell here? Yeah, it's only what we said on others' slides.
We have, with Postmasters, we have, at least they like to do the old way, and when we
deploy the infrastructure, we nearly do the same infrastructure as I had before. So working with
files everywhere. Yeah, staying was, was handwritten, whitelist, blacklist, and everything.
And yeah, it's, it's a bit of a generation change list, let's say, to, to bring new
storages. So there are black boxes now. So S3, things like that, when you're talking about
foundation to be Cassandra or everything, it's not a file anymore.
Can maybe cut this short. Yeah, we also tried AI was, it took, it took sometimes,
sometimes what faster, sometimes. Yeah, that's some emojis.
Yeah, so there's other thing that we've come into that, so before we were often
helping admins on their local setup, and we just kind of came in, did some consulting,
and then they run it. And there's a whole kind of team, and we just kind of do a little part with
mail. But more and more, we are now tasked to set up the whole infrastructure. Not just the
the multifactor authentication, but with everything, with, yeah. So here, you have your
ODC connection, log on, that's your resources, make a work. And yeah, this is the infrastructure
that we deploy in, in our scale, and these are where all the tools that many of you are writing,
and providing that we are kind of putting together to cover the needs of these
institutes. And so these are not just some tools, but they are actual things.
So we're really looking forward to start with as one of the center, who has seen our talks,
knows that we're working a lot with ARSBIMD, and as the for us, the core for all of the security
needs. And we're looking forward to implementing, not to this, that is, I'm being developed.
And yeah, for ARSBIMD, why we still think that that's such an important part in this,
because it has the possibility to actually orchestrate a lot of the other tools that are
rounded from file analysis, sandboxing to the antivirus, and we can't even maybe have an
export to seem. So all of these things are actually being asked. So that's why we always look
nicer when you just have one server kind of thing, and that takes care of my email, but in the end,
we all know at one scale that won't do it anymore. And what we really would love is that the
outgoing internet proxy can also then inform us about when the link was clicked that we saw earlier,
and if it was good or bad. So then afterwards the value of the email. But we're not there yet.
Yeah, you want to intro? Yeah, not to lose is one of those components. And so we have seen the
the need for an IDP and for brute force. And so we're seeing this project coming up. And it
really really looks promising. We have not integrated it yet in our production infrastructure,
but yeah, do check it out. It's really, really, really, really interesting. And yeah, we we see this
as the other core component that will be part of that. And yeah, it does a lot from brute force,
real-time RBL's network security, and has these custom API endpoints, and as well. Now open
telemetry support. And I think, in the next version, I talked to the developer,
they want to also have IDP as an IDP, so that you can also do authentication against it. So that's
fun and interesting. And we're looking forward. Yeah, here.
Is that mine? Yeah, we've talked about the email security and the whole infrastructure.
So if you want to have a big enterprise and everything, you can pay hundreds of thousands of
dollars to get one of those. We know Sandboxes to from one of the big
antivirus supplies. There's also an open source community project there. They're nice.
Sandboxing tools. Pick a boo-a-v is a like a wrapper or
evaluation service for all the outputs of those Sandboxes. And we have integrated it into
us from B. So it's not an official plug-in, it's a bit under the line still, but it runs
productive for several years at a project. So we also have to give it some time. We have
rejected the email waited five minutes, so that's the Sandboxing was fine. We have this pre-precure
everything. If you'd like to have something like Sandboxing included, they definitely search for
some new project. There's some challenging things mostly on the side of the Sandboxing.
Because Sandboxing is a problem that those tools like Kuku are only capable to do
Windows 7 and all the following one. Yeah, needs still some development.
Thank you.
Perfect. Thank you.