Mayo 2005 Versión 4.0 Departamento Técnico Trend Micro España. Buenas Prácticas IMSS Windows NT/2K/2003

Size: px

Start display at page:

Download "Mayo 2005 Versión 4.0 Departamento Técnico Trend Micro España. Buenas Prácticas IMSS Windows NT/2K/2003"

Garry Jefferson
6 years ago
Views:

1 Mayo 2005 Versión 4.0 Departamento Técnico Trend Micro España Buenas Prácticas IMSS Windows NT/2K/2003

2 TREND MICRO Buenas Prácticas IMSS Windows 2 Indice 1 DEFINICIONES ORDEN DE INSTALACIÓN IMSS 5.5 PARA WINDOWS BUENAS PRÁCTICAS FILTRADO OPCIÓN WHOLE FILE SCAN FIRMA DIGITAL Nº MÁXIMO DE DESTINATARIOS PARA EVITAR MALFORMED MAILS ADVANCED SETTINGS EVITAR NDRS EN LA MTA DE IMSS HELLO COMMAND REJECTED....12

TREND MICRO Buenas Prácticas IMSS Windows 3 1 Definiciones. Definiciones: Hotfix: Parche (Patch): Service Pack: Actualización para una incidencia individual.

3 TREND MICRO Buenas Prácticas IMSS Windows 3 1 Definiciones. Definiciones: Hotfix: Parche (Patch): Service Pack: Actualización para una incidencia individual. Actualización para un problema general. Acumulación de actualizaciones. Podemos conocer el nivel de actualización en la pantalla de configuración Web

4 TREND MICRO Buenas Prácticas IMSS Windows 4 2 Orden de instalación IMSS 5.5 para Windows. 1.- DESCARGA DE PRODUCTO Build ACTUALIZACIÓN SP3 Windows build HACER UPDATE NOW para asegurarnos de que la versión de SPS es la APLICAR EL SIGUIENTE PARCHE,

5 TREND MICRO Buenas Prácticas IMSS Windows 5 3 Buenas prácticas. 3.1 FILTRADO OPCIÓN WHOLE FILE SCAN. SB CASE, To activate the Whole Mail Scan option in IMSS, do the following: 1. In the Windows desktop, click Start > Run. 2. Type "regedit" in the Open: field. 3. Press ENTER or click the OK button. This opens the Windows Registry Editor. Important: Before editing the registry, make sure you understand how to restore it if a problem occurs. For more information, view the Restoring the Registry Help topic in Regedit.exe or Restoring a Registry Key Help topic in Regedt32.exe. Making incorrect changes to your registry can cause serious system problems. Always make a back up copy before making any registry changes. 4. Create the following registry key under the following : HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ISNT\registry\config\FilterManager\0001\0001\. Name Type Default Setting / Explanation "DoWholeScan" Dword 1 = Activate the Whole Mail Scan option 5. You can also create here the following additional keys related with the DoWholeScan option: Name Type Default Setting / Explanation "DoWholeScanKeepTempFile" DWORD default=0 (1=Keep TempFile) "WholeScanVirusAlert" STRING default string: "A virus (% VIRUSNAME%) was detected in the file (%FILENAME%)" 6. Close regedit.exe. 7. Restart the following services o o Trend Micro InterScan Messaging Security Suite Trend Micro InterScan MSS System Monitor

6 TREND MICRO Buenas Prácticas IMSS Windows FIRMA DIGITAL. After applying SP3, do the following (taken from SP3 readme.txt) To preserve the signature, set the registry as follows: [HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ISNT5\registry\config \RemoveSignature]=0

7 TREND MICRO Buenas Prácticas IMSS Windows Nº MÁXIMO DE DESTINATARIOS PARA EVITAR MALFORMED MAILS. Modify the ISNTSmtp.ini file under /Trend/IMSS folder to reflect the following values : A LimitHeaderParams entry can be added in the [MessageModule] section of the imss.ini file. To prevent a malformed message, increase the limitation of the header parameters in specific mail headers, ie. content-type. The default setting is 100. [Message] LimitMessageNumberPerConnectionTo=20 LimitRecipientNumberPerMessageTo=500 [MessageModule] LimitHeaders=500 LimitHeaderParams=500 LimitRecipients=500 Note: The entries under [MessageModule] should be added manually and after saving the changes, stop and restart the IMSS services.

8 TREND MICRO Buenas Prácticas IMSS Windows ADVANCED SETTINGS. [General-Performance] ISNTPerformance=low This parameter can be modified to increase the number of threads used by IMSS in scanning and delivering s. low = uses the number of threads as defined in [ -Scan] section med = doubles the thread settings defined in [ -Scan] section high = quadruples the thread settings defined in [ -Scan] section Note: It is advised to leave this parameter to default unless instructed. [ -Scan] ScanningThread=10 Number of threads dedicated to perform virus and policy scanning. This value may be increased to improve performance. PickupDeliverThread=3 If a user chooses to deliver mails from the quarantine area [Policy Manager Quarantine Area Deliver], those mail files will be moved from the designated quarantine folder to pickup_deliver folder. This setting defines the number of threads used to deliver those mails. PickupScanThread=3 If a user chooses to reprocess mails from the quarantine area [Policy Manager Quarantine Area Reprocess], these threads will move the mail files to IMSS mail queue directory and register them to the mail queue manager in memory. Afterwards, regular scanning and delivery threads will process those mails. MailQueueThread=20 Number of threads used to deliver scanned mail files (af/df) in IMSS mail queue directory (mqueue). Bounc QueueThread=5 If for some reason, delivery of scanned mail files (af/df pairs in mqueue) fail, they are moved to the retry queue folder (bmqueue). This setting defines the number of threads used to redeliver mails in the bmqueue folder. Delivery retry for each mail would depend on the timestamp (as configured in [SMTP Routing Delivery Advanced Deferrals]). [Receiver-Connection] PerformReverseDNSLookup=no

9 TREND MICRO Buenas Prácticas IMSS Windows 9 NumberOfQueueSizeSteps=5 This parameter is used in conjunction with the QueueSize parameters below to define when IMSS gives out a 421 (server busy) reply. The value defined in this parameter specifies the number of QueueSize steps where the maximum number of connections are recalculated. More QueueSize steps can be created to customize this mechanism. By default there are five steps. QueueSize_0=0;250 QueueSize_1=250;100 QueueSize_2=1000;20 QueueSize_3=10000;5 QueueSize_4=25000;1 Each QueueSize parameter holds two values and is separated by a semicolon. The first value defines the number of mails queued for processing. The second value defines the number of connections allowed. To get the effective value, both parameters should be multiplied by the number of processors. Therefore, the parameter QueueSize_2=1000;20 on a dual processor server will actually be QueueSize_2=2000;40. [Message] LimitInboundMessageSizeTo=0 This parameter defines the allowed size for a single message. Size checking is done realtime during SMTP session. When smtp DATA session exceeds limit, IMSS replies with a 552 smtp error code. "552 <hostname>: your message size exceeds maximum inbound size of X kilobytes." My recommendation is to set this value a little higher than their company's message size limit in the sub-policies. Example: Set this parameter to 6 MB if - Domain_1 was enforced to have 5 MB message size limit - Domain_2 was enforced to have 3 MB message size limit. LimitDataSizePerSessionTo=10240 Allowed total size of the messages transferred in one smtp session. Recommended value is at least twice the LimitInboundMessageSizeTo parameter. IMSS gives out a 552 smtp reply when this value is exceeded 552 <hostname>: your total session size exceeds maximum inbound size of 1 kilobytes" LimitMessageNumberPerConnectionTo=20 Allowed total number of messages in one smtp session. Example: If in this parameter you specified a value of 20, the SMTP reply of IMSS when this is exceeded would be:

10 TREND MICRO Buenas Prácticas IMSS Windows 10 "552 <hostname>: your message counts in one session of 21 exceeds maximum setting 20." LimitRecipientNumberPerMessageTo=100 Allowed number of recipients per message. If exceeded, IMSS replies with a 552 Too many recipients error code. Mail is then delivered to the accepted recipients. It is now the responsibility of the sending MTA to resend the same to recipients not accepted in the first session. RFC 821/2821 recommends that an MTA would accept at least 100 recipients per SMTP session. Note: All four parameters above are checked in real-time during mail transfer (smtp session). [ -Other] RestrictInDomain=yes This function is used for advanced anti-relay function and works in conjunction with RestrictInDomainList parameter. When enabled, each character listed in RestrictInDomainList is checked against the characters preceding the of an address. RestrictInDomainMeta=%$!&# Each character in the list is evaluated separately. The examples below would be rejected: roberty%melabs@trend.com roberty#melabs@trend.com roberty!melabs@trend.com QueueBad =no Enabling this parameter saves undeliverable messages in \Trend\IMSS\isntsmtp\badmail directory after the retry period has elapsed. [SysMonitor] NotificationInterval=30 The system monitor can be configured to send an notification if service stops for a specified number of minutes. Configure this parameter so that IMSS sends a notification in the specified interval. Unit is in minutes.

11 TREND MICRO Buenas Prácticas IMSS Windows EVITAR NDRS EN LA MTA DE IMSS. Add an entry in the IsntSmtp.ini file under the section [Receiver-Connection] RejectIncomingMailWithEmptyMailFromParameter=1. This will stop the null sender at the SMTP session.

12 TREND MICRO Buenas Prácticas IMSS Windows HELLO COMMAND REJECTED. Origen del problema, IMSS-NT 5.5 was refused connection by the MTA while delivering the message. The following message is seen on the log file: helo command rejected: need fully-qualified hostname Unable to deliver message to IMSS used a NETBIOS name instead of a FQDN (Fully Qualified Domain Name) in the helo/ehlo command to the MTA and the MTA did not accept it. So the connection was refused. Solución: Look for and edit the IsntSmtp.ini file: a. Search for the string "HelloDomainName". You will find the section where you can customize the helo/ehlo command string going to the MTA for delivery of message. ;## ;## customize the helo/ehlo domain string ;## ;##HelloDomainName= b. Just below the line ';##HelloDomainName=' add the following line if it does not exist. HelloDomainName=<your FQDN> Replace '<your FQDN>' with the FQDN (fully qualified domain name) of the machine. For example: HelloDomainName=imss_server1.mydomain.com

13 TREND MICRO Buenas Prácticas IMSS Windows 13

Installation & Configuration Guide Version 1.4

TekSMTP Installation & Configuration Guide Version 1.4 Document Revision 1.7 https://www.kaplansoft.com/ TekSMTP is built by Yasin KAPLAN Read Readme.txt for last minute changes and updates which can be