Barracuda Spam / Virus appliance

[TMPadmin]

I'm looking into getting one of THESE. We so far have 3 domains to filter. Currently one is being filtered off-site quite successfully but we still get each "blocked" message into a spam account to review for false positives. The other two are not filtered at this point since the off-site service is $1300 per year.

I can get a 200 model for that much and filter 50 domains.

Anyone have one of these? Any reviews that might be helpful in my decision? Is there anything better or just as good for less $$$?

Thanks for you input.

 

[gaidin123]

We have one of their eval units in our rack at the moment but have not implemented it yet. Another group in my organization uses one and they have had good results with it. It takes a little bit of setup and training but apparently for them it has worked out very well.

We are looking at the 300 model for its extra features rather than performance. The salesperson and engineer were actually friendly and were very open about the specs of the machine (commodity hardware, running linux with their custom code). We requested an eval unit and they were prompt.

The things are cheap for what they are. We're probably going to buy one sometime in the next month or so. The thing holding us back from testing is that we're also doing upgrades to the mail server.

Gaidin

 

[SagaLore]

I have evaluated Barracuda. It is an inexpensive appliance, running Linux with SpamAssasin (bayesian filtering) and Clam AV.

Another product around the same price level, is Solinus MailFoundry. It runs on Solaris. It uses spam signatures licensed from mailfilters.net and sophos antivirus. It also has great content filtering abilities.

Both use LDAP acceleration (lookups to confirm email address), and generate spam digests for the users (quarantine release).

MailFoundry can be used as an outbound relay to secure outgoing email, Barracuda cannot.

PM me if you want more info...

 

[Nothinman]

(commodity hardware, running linux with their custom code)

What part of it is custom?

 

[n0cmonkey]

Antispam software should start moving towards tarpits.

 

[VirtualLarry]

Originally posted by: n0cmonkey
Antispam software should start moving towards tarpits.

I'm not familiar with that term - is that basically the spam equivalent of a honeypot or something?

 

[n0cmonkey]

Originally posted by: VirtualLarry

Originally posted by: n0cmonkey
Antispam software should start moving towards tarpits.

I'm not familiar with that term - is that basically the spam equivalent of a honeypot or something?

A tarpit slows down the mail transfer considerably for messages it detects as spam. Instead of receiving the mail in seconds over a normal connection, the connection would take 10 minutes. Make the spammers pay, rejecting or accepting spam outright aren't doing anything to stop it, they just make it so you don't see the spam.

 

[SagaLore]

Originally posted by: n0cmonkey

Originally posted by: VirtualLarry

Originally posted by: n0cmonkey
Antispam software should start moving towards tarpits.

I'm not familiar with that term - is that basically the spam equivalent of a honeypot or something?

A tarpit slows down the mail transfer considerably for messages it detects as spam. Instead of receiving the mail in seconds over a normal connection, the connection would take 10 minutes. Make the spammers pay, rejecting or accepting spam outright aren't doing anything to stop it, they just make it so you don't see the spam.

I haven't come across that term yet, I'll have to add that to my spam techniques outline on my site. It sounds like it would work great for RBL's (which are strictly IP and host based), but you can't run any other kind of analysis on the email until you've already received it.

 

[n0cmonkey]

Originally posted by: SagaLore

Originally posted by: n0cmonkey

Originally posted by: VirtualLarry

Originally posted by: n0cmonkey
Antispam software should start moving towards tarpits.

I'm not familiar with that term - is that basically the spam equivalent of a honeypot or something?

A tarpit slows down the mail transfer considerably for messages it detects as spam. Instead of receiving the mail in seconds over a normal connection, the connection would take 10 minutes. Make the spammers pay, rejecting or accepting spam outright aren't doing anything to stop it, they just make it so you don't see the spam.

I haven't come across that term yet, I'll have to add that to my spam techniques outline on my site. It sounds like it would work great for RBL's (which are strictly IP and host based), but you can't run any other kind of analysis on the email until you've already received it.

Of course you're going to do it in layers. spamd, spam assassin, tunderbird.

 

[ShuChow]

Disclaimer: 1) I am merely an end user of this system. I do not admin the machine in any way, although I've spoken to the admins on many occasions. 2) I am a programmer. Networking and box sitting is not my specialty. 3) I was doing research on how how this thing works when I ran across this forum and thread and felt that I had to chime in.

That being said, this appliance is a piece of junk, and I'm openly advocating that my ISP (also my user group) dump it.

Here are my gripes:

1) Whitelist doesn't whitelist. Barracuda apparently uses some sort of global whitelist feature, which apparently overrules your personal whitelist. So, you can Bayesian train all day long, but in the end, if the global whitelist doesn't agree with you, you're out of luck.

2) Same thing for the blacklist, although I haven't been able to confirm this 100%.

3) DUPLICATE EMAILS. For some reason, it's not uncommon for me to get 5-6 copies of emails that Barracuda analyzes as potential spam. If it triggers its scoring, and *doesn't* quarantine it, it will send you multiple copies of that email. According to our admins, Barracuda thinks it's some sort of conflict with our Cisco firewall. To me, this is crazy and they better fix this quick. If you have a networking product and it doesn't work with Cisco equipment, you must not want to sell a lot of units.

4) I suspect that the rate control settings are ignored. Our admins are insisting that the settings are very generous, but during certain times, it's not uncommon to get 30 minute delays. For the past two days, there's been a few instances where it's 20 HOURS.

In short, I hate the thing. I'll give them credit for selling open source products, but in my opinion, these Barracuda units are a lousy implementation.

 

[SagaLore]

Originally posted by: ShuChow
3) DUPLICATE EMAILS. For some reason, it's not uncommon for me to get 5-6 copies of emails that Barracuda analyzes as potential spam. If it triggers its scoring, and *doesn't* quarantine it, it will send you multiple copies of that email. According to our admins, Barracuda thinks it's some sort of conflict with our Cisco firewall. To me, this is crazy and they better fix this quick. If you have a networking product and it doesn't work with Cisco equipment, you must not want to sell a lot of units.

Make sure the FIXUP protocol is disabled for SMTP on the PIX.

 

[toddlohenry]

Originally posted by: ShuChow
Disclaimer: 1) I am merely an end user of this system. I do not admin the machine in any way, although I've spoken to the admins on many occasions. 2) I am a programmer. Networking and box sitting is not my specialty. 3) I was doing research on how how this thing works when I ran across this forum and thread and felt that I had to chime in.

That being said, this appliance is a piece of junk, and I'm openly advocating that my ISP (also my user group) dump it.

Here are my gripes:

1) Whitelist doesn't whitelist. Barracuda apparently uses some sort of global whitelist feature, which apparently overrules your personal whitelist. So, you can Bayesian train all day long, but in the end, if the global whitelist doesn't agree with you, you're out of luck.

2) Same thing for the blacklist, although I haven't been able to confirm this 100%.

3) DUPLICATE EMAILS. For some reason, it's not uncommon for me to get 5-6 copies of emails that Barracuda analyzes as potential spam. If it triggers its scoring, and *doesn't* quarantine it, it will send you multiple copies of that email. According to our admins, Barracuda thinks it's some sort of conflict with our Cisco firewall. To me, this is crazy and they better fix this quick. If you have a networking product and it doesn't work with Cisco equipment, you must not want to sell a lot of units.

4) I suspect that the rate control settings are ignored. Our admins are insisting that the settings are very generous, but during certain times, it's not uncommon to get 30 minute delays. For the past two days, there's been a few instances where it's 20 HOURS.

In short, I hate the thing. I'll give them credit for selling open source products, but in my opinion, these Barracuda units are a lousy implementation.

Sagalore is right. The MailFoundry box is a better buy, although his information is a little outdated. Solinus rumored to be moving off Sun and on to Linux and there are no latency problems like you described. They have also dropped Sophos, but include open source anti-virus at no cost. I'd check them out -- seems like they address most of your issues...