Cisco Cisco Email Security Appliance C160 Mode D'Emploi

Submit and commit your changes.

Directory Harvest Attacks occur when a malicious sender attempts to send 
messages to recipients with common names, and the email gateway responds by 
verifying that a recipient has a valid mailbox at that location. When performed on 
a large scale, malicious senders can determine who to send mail to by 
“harvesting” these valid addresses for spamming. 

The IronPort Email Security appliance can detect and prevent Directory Harvest 
Attack (DHA) when using LDAP acceptance validation queries. You can 
configure LDAP acceptance to prevent directory harvest attacks within the SMTP 
conversation or within the work queue. 

You can prevent DHAs by entering only domains in the Recipient Access Table 
(RAT), and performing the LDAP acceptance validation in the SMTP 
conversation. 

To drop messages during the SMTP conversation, configure an LDAP server 
profile for LDAP acceptance. Then, configure the listener to perform an LDAP 
accept query during the SMTP conversation.