User s GUIDE. Webwasher Spam Reporter Version 1.0.

Transcription

1 User s GUIDE Webwasher Spam Reporter Version 1.0

2 Edition November 2006 All Rights Reserved, Published and Printed in Germany 2006 Secure Computing Corporation. This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior consent in writing from Secure Computing Corporation. Every effort has been made to ensure the accuracy of this manual. However, Secure Computing Corporation makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Secure Computing Corporation shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this document is subject to change without notice. Webwasher, MethodMix, AV PreScan, Live Reporting, Content Reporter, ContentReporter, Real-Time Classifier are all trademarks or registered trademarks of Secure Computing Corporation in Germany and/or other countries. Microsoft, Windows NT, Windows 2000 are registered trademarks of Microsoft Corporation in the United States and/or other countries. McAfee is a business unit of Network Associates, Inc. CheckPoint, OPSEC, and FireWall-1 are trademarks or registered trademarks of CheckPoint Software Technologies Ltd. or its affiliates. Sun and Solaris are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries. Squid is copyrighted by the University of California, San Diego. Squid uses some code developed by others. Squid is Free Software, licensed under the terms of the GNU General Public License. The Mozilla SpiderMonkey and NSPR libraries distributed with Webwasher are built from the original Mozilla source code, without modifications (MPL section 1.9). The source code is available under the terms of the Mozilla Public License, Version 1.1. NetCache is a registered trademark of Network Appliances, Inc. in the United States and other countries. Linux is a registered trademark of Linus Torvalds. Other product names mentioned in this guide may be trademarks or registered trademarks of their respective companies and are the sole property of their respective manufacturers. Secure Computing Corporation Webwasher A Secure Computing Brand Vattmannstrasse 3, Paderborn, Germany Phone: +49 (0) Fax: +49 (0) info@webwasher.com European Hotline Phone: +49 (0) US Hotline Phone: ,

3 Contents Chapter 1 Introduction About This Guide The Spam Reporter Product Prerequisites Chapter 2 Using Spam Reporter Installation Configuration Configuring Confirmation and Deletion Options Configuring Recipient Addresses Reporting s with Spam Reporter Uninstalling the Product i

4

5 Introduction Chapter 1 Welcome to the Webwasher User s Guide Spam Reporter 1.0. This guide provides you with the information needed to install, configure and use Spam Reporter. This is an additional product developed for use with Webwasher in order to allow you to categorize s and report them to the Secure Computing feedback service. 1.1 About This Guide The following topics are dealt with in this guide: Introduction General description of the product and prerequisites for its use, see 1.2 and 1.3. Using Spam Reporter Installing and uninstalling the product, configuring the product and using it for reporting s, see Chapter

6 Introduction 1.2 The Spam Reporter Product The Spam reporter product is installed as a plug-in tool on your system. It allows you to categorize the s that are in your Outlook inbox as Spam, No Spam or Phishing and report them to the Secure Computing feedback service, i. e. send them there for further processing. After receiving these s, the feedback service will process them and modify the configuration of the Webwasher filters accordingly. The modification will make sure that the s in question are recognized according to the way they were categorized, so the actions configured under your corporate security policies for handling spam, no-spam and phishing s, e. g. Block, Allow or Quarantine, can be applied to them,. In order to send them to the feedback service, s are first directed to a recipient address, which you can configure according to your own requirements. Webwasher reads this address and inserts the corresponding s in the feedback queues that are maintained for the purpose of collecting feedback information on spam s. From these queues, the s are forwarded to the feedback service. 1.3 Prerequisites There are a number of prerequisites for using Spam Reporter on your system. These include the following: Version 6.0 of the Webwasher software must be installed. A license for Webwasher Anti-Spam must be obtained and activated. Webwasher must be configured as gateway. For a description of the corresponding configuration procedure, see section 4.5, Gateway, of the Webwasher System Configuration Guide. The feedback queues provided within Webwasher must be configured and activated. For a description of the corresponding procedures, see section 4.2.4, Feedback Queues, of the Webwasher User s Guide Anti-Spam. 1 2

7 Using Spam Reporter Chapter 2 The sections of this chapter provide information on how to use Spam Reporter and how to install and configure it for this use. The following topics are dealt with in these sections: Installation, see 2.1 Configuration, see 2.2 Reporting s with Spam Reporter, see 2.3 Uninstalling the product, see Installation There are several ways of installing Spam Reporter. You can perform an unattended installation, which is the recommended way, but also install the product manually. An unattended installation can be done over a package distribution system or using a Windows logon script. The Microsoft installer package provides you with two options that do not require user interaction during installation: SpamReporter.msi/passive With this option, no user interaction is required, but a progress bar is shown. The product will be installed under %ProgramFiles%\Secure Computing\Webwasher ExtendedListEditor\ Note that %ProgramFiles% is the default directory for applications under Windows. 2 1

8 Using Spam Reporter SpamReporter.msi/quiet With this option, the product is installed without further notice. The product will be installed under %ProgramFiles%\Secure Computing\Webwasher ExtendedListEditor\ Note that %ProgramFiles% is the default directory for applications under Windows. A double-click on the SpamReporter.msi package file will invoke the installation wizard. This wizard will guide you during the manual installation of the product. After using one of these methods for installing Spam Reporter, you need to restart Outlook. If the installation has been successful, you will see an additional options bar for Spam Reporter inserted on the Outlook page: 2.2 Configuration After installing the Spam Reporter, you can configure a number of settings in order to be able to use this tool according to your requirements. The following can be configured: Confirmation of reporting Deletion of s after reporting These settings are configured using the Options menu, which is provided on the Spam Reporter options bar, see Furthermore, you can configure the following: Recipient address for false negatives Recipient address for false positives These settings are configured by editing the Spam Reporter.ini file, see

9 Using Spam Reporter Configuring Confirmation and Deletion Options You can configure the Spam Reporter to open a confirmation window after selecting an for reporting. Furthermore, you can configure this tool to have an deleted after being reported to the feedback service. To configure these settings, proceed as follows: 1. Click on the Options menu of the Spam Reporter options bar. This will open the following window: 2. In this window, enable or disable the following options, which are provided under Misc: Confirm before Report If this option is enabled, a pop-up window will be displayed after you have selected an for reporting. In this window, you will be asked to confirm that you actually want to report the in question to the feedback service. This option is enabled by default. 2 3

10 Using Spam Reporter Delete after Report If this option is enabled, an will be deleted after being reported to the feedback service. 3. After specifying the appropriate settings, click on OK to make them effective Configuring Recipient Addresses You can also configure the recipient addresses that s are sent to when they have been selected for reporting. These addresses are entered in the.ini file of the Spam Reporter product. After modifying this file, you need to roll it out to all the clients you want to include in the process of reporting. The addresses are entered in the General section of the.ini file. The section looks like this [General] [ConfirmBeforeReport=1] [Delet AfterReport=0] Note that the default addresses are: for s that were classified as false negatives for s that were classified as false positives Note also that the recipient addresses you enter in the.ini file and those that youuseforconfigurationonthefeedback Queues tab of the Webwasher Web interface under Home > Feedback must be the same. 2 4

11 Using Spam Reporter 2.3 Reporting s with Spam Reporter After installing and configuring Spam Reporter, you can begin using this tool to report s. An can be reported to the Secure Computing feedback service as Spam or No Spam, orasphishing. To do this, proceed as follows: 1. Select the you want to report from the list provided by Outlook: 2. Click on the corresponding button of the Spam Reporter options bar: You can select more than one and report them at one go by clicking on the corresponding button. The or s will then be sent to the recipient addresses specified in the.ini file, see After reading the recipient address of an , Webwasher will take this out of the regular mail flow and will insert it in the Webwasher corresponding feedback queue, from where it is forwarded to the Secure Computing feedback service. The feedback service will process the and modify the filters used by Webwasher accordingly. 2 5

12 Using Spam Reporter 2.4 Uninstalling the Product In case you do no longer want to use Spam Reporter, you can uninstall this tool. This can be done in several ways. You can: Use the option provided for modifying and removing programs under Windows. Alternatively, you can: Double-click on the SpamReporter.msi package within your file manager. This will start the installation wizard, providing options for repairing and uninstalling the program. To uninstall the product in an unattended mode, use the following command: msiexec/uninstall/<path to>spamreporter.msi/quiet This will uninstall Spam Reporter without further notice. Note that under <path to> you need to specify the name of the path leading to the location where the SpamReporter.msi package file is stored. 2 6