X-Spam 5.5 for SMTP Servers

Transcription

1 This document provides information to install and use X-Spam 5.5 for SMTP Servers User Guide for X-Spam 5.5 for SMTP Servers X - Spam for SMTP Servers User Guide 1

2 X-Spam for SMTP Servers User Guide Copyright Notice The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Document Number : 1MSSMTP Copyright Notice Copyright (C) All rights Reserved. Portions (C) by Kaspersky Labs International Limited. Any technical documentation that is made available by MicroWorld is the copyrighted work of MicroWorld and is owned by MicroWorld. NO WARRANTY. The technical documentation is being delivered to you AS-IS and MicroWorld makes no warranty as to its accuracy or use. Any use of the technical documentation or the information contained therein is at the risk of the user. Documentation may include technical or other inaccuracies or typographical errors. MicroWorld reserves the right to make change without prior notice. No part of this publication may be copied without the express written permission of MicroWorld. Trademarks. MicroWorld, MicroWorld Logo, escan, escan logo, MWL, X-Spam are trademarks of MicroWorld. Windows is a registered trademark of Microsoft Corporation; Kaspersky is a registered trademark of Kaspersky Labs. All product names referenced herein are trademarks or registered trademarks of their respective companies. MicroWorld Software Services Pvt. Ltd. (MicroWorld) disclaims proprietary interest in the marks and names of others. Although MicroWorld makes every effort to ensure that this information is accurate, MicroWorld will not be liable for any errors or omission of facts contained herein. MicroWorld Software Services Pvt. Ltd. reserves the right to modify specifications cited in this document without prior notice. Companies, names and data used in examples herein are fictitious unless otherwise noted. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of MicroWorld Software Services Pvt. Ltd. Other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies and are hereby acknowledged. Technical Support: Sales: Printed : MicroWorld May, 2008 support@mwti.net sales@mwti.net X - Spam for SMTP Servers User Guide 2

3 Table of Contents Welcome 5 ABOUT THIS GUIDE...5 HOW THIS GUIDE IS ORGANIZED...5 TYPOGRAPHICAL CONVENTIONS...5 CONTACT US...6 About MicroWorld 7 X-SPAM FOR DIFFERENT MAILSEVERS... ERROR! BOOKMARK NOT DEFINED. FEATURES OF X-SPAM...7 About X-Spam for SMTP Servers 9 COMPONENTS OF X-SPAM FOR SMTP SERVERS... ERROR! BOOKMARK NOT DEFINED. HOW X-SPAM FOR SMTP SERVER WORKS... ERROR! BOOKMARK NOT DEFINED. HOW POP3 DOWNLOADER WORKS... ERROR! BOOKMARK NOT DEFINED. X-SPAM FOR SMTP SERVER DEPLOYMENT...9 INSTALLATION ON A NETWORK WITHOUT FIREWALL...9 INSTALLATION ON NETWORK WITH FIREWALL...11 Installation 14 TOPICS IN INSTALLATION...15 SOFTWARE AND HARDWARE REQUIREMENTS...15 PREREQUISITES FOR INSTALLATION INSTALLATION PROCESS...16 X-Spam Tasks 19 TOPICS IN X-SPAM TASKS...19 TO LAUNCH X-SPAM TASKS...19 DETAILS OF X-SPAM TASKS...19 Getting Started 22 USER INTERFACE... ERROR! BOOKMARK NOT DEFINED. SCREEN COMPONENTS... ERROR! BOOKMARK NOT DEFINED. X-Spam SMTP Server Monitor 22 TO LAUNCH X-SPAM ADMINISTRATOR...25 TOP MENU OPTIONS IN X-SPAM ADMINISTRATOR...26 ADMIN...26 SCANNER ADMINISTRATION...26 CONTENT CONTROL...36 X - Spam for SMTP Servers User Guide 3

4 COMPRESSION CONTROL...45 X-SPAM MESSAGES...47 SCAN CONTROL...48 VIRUS TEST MAIL... ERROR! BOOKMARK NOT DEFINED. LICENSE INFORMATION...50 EXIT ADMINISTRATOR...50 TOPICS IN VIEW...50 VIEW LOG FILES...51 FLUSH LOGS...53 X-SPAM REPORTS...54 SPLASH SCREEN ENABLED...58 HELP...58 SEND EICAR VIRUS TEST MAIL... ERROR! BOOKMARK NOT DEFINED. X-SPAM HELP...58 CHANGE PASSWORD...59 ABOUT US...60 SMTP Administrator 60 INTERNET...63 RESTRICTION FROM USERS...65 RESTRICTION TO USERS...66 SPAM CONTROL...67 USER BASED RULE SETS...69 MAILS FROM USER...69 MAILS TO USER...70 ACKNOWLEDGEMENT & ROUTING BY USERS...70 AUTHENTICATION...72 SMTP SETTINGS...73 SMTP CONTROLS...75 SUBSTITUTE DOMAINS...77 CLUSTER SETTINGS...78 POP3 Configuration 79 TOPICS IN POP3 CONFIG...80 TO LAUNCH POP3 CONFIG...80 ACCOUNTS...81 HOSTS...82 CONFIG...84 Frequently Asked Questions 88 KNOWLEDGE BASE...97 Index 99 X - Spam for SMTP Servers User Guide 4

5 Welcome X-Spam 5.5 for SMTP Servers is the world s most advanced AntiVirus, Content Security and Mail Management Solution at the Mail Gateway, for Mail Servers working on different Operating Systems and platforms like Windows, Unix, Linux, Novell and Solaris. Installed on a Windows machine, X-Spam comes with an inbuilt, multi-threaded SMTP Server and a POP3 Downloader, and acts as a Security Gateway between your Mail Server and the Internet. At the Mail Gateway, X-Spam for SMTP Servers scans and cleans mails that flow between all local users and mails between the Internet and Mail Server. It protects organizations against Viruses, Worms, Trojans, Backdoors and many other malware, blocks Spam and Phishing mails, while providing total Content Security for traffic. About this Guide This chapter provides details about the following topics: How this guide is organized Typographical Conventions Contact Us How this guide is organized This guide is organized into different chapters. The initial chapters describe basic tasks like getting started, navigation, Installation etc. X-Spam Administrator provides all details to run X-Spam. Each screen and field occurring in the user interface is explained in detail along with the relevant screen shots. Overview: Provides details of MWL technology (MicroWorld Winsock Layer) technology on which our products are built and X-Spam Products, which gives a break up of different X-Spam products and modules available with them. Also listed are detailed Features of X-Spam. Installation: Gives the Software and Hardware requirements to run the application along with Prerequisites you have to complete before the installation. Details of Installation Process are given along with screen shots. Getting Started gives information about a typical screen, its components, types of fields, dialog boxes, tab pages and how to validate them. Typographical Conventions X - Spam for SMTP Servers User Guide 5

6 The following typographical conventions are used in this guide. This Bold SMALL CAPS Italics Type Hyperlink Tasks Represents A Menu or a menu option. When enclosed in, the name is as displayed in the screen. A long name is denoted by the first few words and. It is enclosed in. Buttons on dialog boxes/child windows. Entry Fields in dialog boxes/child windows. Information you need to enter. Is a hyperlink. Click to access related topics. Represents a key task of feature. When you have to navigate between menus the following convention is used: menu > menu > For e.g.. X-Spam For SMTP Server > X-Spam Administrator. Means: in X-Spam, select (click) the X-Spam Administrator Contact Us We offer 24x7 support to our customers through , telephone and Chat. Chat Support Chat with our support team at escanchat using: MSN or Yahoo messenger service. Support If you have any queries about our products or have suggestions and comments about this guide, please send them to support@mwti.net: Head Office: MicroWorld Technologies Inc Hamilton Court East, Suite 105 Farmington Hills, MI Tel: (248) / Fax: (248) Asia Pacific: MicroWorld Software Services Pvt Ltd.. Plot No 80, Road 15, MIDC, Marol, Andheri (E), Mumbai, INDIA. Tel (91) Fax (91) X - Spam for SMTP Servers User Guide 6

7 For sales enquiry, For more information about our products, please visit About MicroWorld MicroWorld Technologies () is the developer of advanced AntiVirus, Content Security and Firewall software products escan, MailScan, X-Spam and econceal. MicroWorld Winsock Layer (MWL) is the revolutionary technology that powers most of MicroWorld products, enabling them to achieve several certifications and awards by some of the most prestigious testing bodies. Notable among them are Virus Bulletin, Checkmark, TUCOWS, Red Hat Ready and Novell Ready. X-Spam for SMTP Servers X-Spam for SMTP Servers is total Content Security and Traffic Scanning software for SMTP Servers that checks the content in s and its attachments for viruses. Checks are done for viruses, restricted words and phrases, embedded objects such as Java applets, etc, before the e- mails are downloaded. X-Spam Administration Console can be accessed using a browser thereby enabling the Remote Administration of the application. Using the web interface you can perform tasks like Gateway Configuration, User and Mail Restrictions, Mail Authentication, plugging vulnerabilities in Internet explorer to protect Mail Clients like Outlook Express which use IE plug-ins for displaying web pages, compression control, RBL checks, sending messages and notifications and accessing logs and detailed reports. Features of X-Spam Web Based Administration X-Spam Administration Console can be accessed using a browser, to enable Remote Administration of the application. Integrated Mail Security Policy Enforcement The software works on policy-based Rule-Sets. They have been categorized as universal and company specific. Blocks Spamming and Phishing X-Spam stops Spamming and Phishing using a combination of highly powerful technologies. Non Intrusive Learning Patterns (NILP) MicroWorld has developed a unique technology in Spam fighting, named as Non Intrusive Learning Patterns. It is an advanced Bayesian Filtering method with the intelligence to X - Spam for SMTP Servers User Guide 7

8 analyze each mail according to the Behavioral Patterns of the user and comes with a self learning capability. LDAP Authenticated Web Administration X-Spam is powered with LDAP Authenticated Web Administration. TCP Connections This option shows all TCP/UDP connections in the system, like Processes, Protocol, Local Address, Remote Address and Status. POP3 Downloader Module X-Spam acts as a SMTP/POP3 gateway that allows users to download messages from their Internet POP3 mailboxes to local folders. Attachment Control Powerful options to restrict certain attachments like EXE or COM from being sent or received from the Internet. Compression and Decompression Oversized files are compressed using standard file compressors with options for automatic decompression. Clustering This feature is greatly useful to those ISPs or Servers that handle a large number of mails regularly. Clustering enables you to distribute mails to multiple computers for scanning mails. Auto Updates for Spam Detection The system updates the Bayesian Spam Database with probable phrases and words. Logs and Extensive Reports X-Spam registers its activities into logs and generates consolidated reports on demand for review and analysis. 24x7 Free Technical Support Online, telephonic and technical support are available free of cost, round the clock for all MicroWorld products. X - Spam for SMTP Servers User Guide 8

9 About X-Spam for SMTP Servers X-Spam for SMTP Server Deployment Two types of networks are considered for SMTP deployment: Network without a firewall. Network with a firewall. Note: It may be necessary to first install X-Spam and know about its features, before attempting to execute tasks provided in the next sections. Installation on a network without firewall There are two options: Install X-Spam between SMTP Server and Internet and Install X-Spam on the SMTP Server. OPTION 1: INSTALL X-SPAM BETWEEN SMTP SERVER AND INTERNET Following points are considered for the example in the illustration shown in Figure 1.1. SMTP Server has NIC1 (LAN-side) with TCP-IP address SMTP Server has NIC2 (Internet-side) with TCP-IP address only acts like MailServer. SMTP Server acts like a MailServer for domain, mail.company.com. The installation steps are: 1. Install a Windows OS machine on the network with two NICs. 2. Change the TCP-IP address of NIC2 on the SMTP-Server to Set the TCP-IP address of the NIC1 (LAN side) on the 4. X-Spam PC to Set the TCP-IP address of the 5. NIC2 (Internet side) on the X-Spam PC to Install X-Spam for SMTP-Servers on this X-Spam machine. X - Spam for SMTP Servers User Guide 9

10 7. During installation, assume the following details: Primary Local Domain Name: mail.company.com Local Mail-Server IP Address: Port: 25 Primary DNS Server IP: your ISP s DNS Server. Configure the SMTP-Server ( ) to forward all outgoing mail to the X- Spam machine ( ). Figure 1.4 Installation on Network without Firewall Option1 OPTION 2: INSTALL X-SPAM ON SMTP SERVER (Applicable only for Win 95/98/NT based SMTP Servers) Following points are considered as an example in the illustration shown in Figure 1.2. SMTP Server has NIC1 (LAN-side) with TCP-IP address SMTP Server has NIC2 (Internet-side) with TCP-IP address acts only like Mail-Server. SMTP Server acts like a mail-server for domain mail.company.com. The installation steps are: 1. Install X-Spam for SMTP Server on the machine with IP Other details are: Local Mail-Server IP Address: Port: 26 Primary DNS Server IP: your ISP s DNS Server. 1. Configure the SMTP-Server installed on this machine to listen on port 26 (instead of port 25). 2. Configure the SMTP-Server to forward all outgoing mails to localhost. X - Spam for SMTP Servers User Guide 10

11 Figure 1.5 Install on Network without Firewall Option2 Installation on network with firewall On Network with a firewall, X-Spam can be installed at 3 key positions as shown in Figure 1.3. I. Position A - on the Firewall PC (Packet Filtering Firewall or Proxy based Firewall) II. Position B (between your SMTP-Server and the Firewall) III. Position C (on the SMTP Server). Assume your company domain is mail.company.com. Figure 1.6 Install on a Network with Firewall X - Spam for SMTP Servers User Guide 11

12 IA. INSTALL X-SPAM ON PACKET FILTERING FIREWALL POSITION A 1. Install X-Spam for SMTP-Servers on the firewall machine. 2. During installation, assume the following details: A. Primary Local Domain Name: mail.company.com B. Local Mail-Server IP Address: TCP-IP of SMTP Server C. Port: 25 D. Primary DNS Server IP: your ISP s DNS Server. 3. Configure the firewall to direct all SMTP traffic through X-Spam. Source Destination Service Action SMTP-Server Localhost SMTP ACCEPT Internet localhost Localhost SMTP ACCEPT Any Other Any SMTP STOP IB. INSTALL X-SPAM ON PROXY BASED FIREWALL POSITION A On a Proxy-based firewall: 1. Install X-Spam for SMTP-Servers on the firewall machine. 2. During installation, assume the following details: A. Primary Local Domain Name: mail.company.com B. Local Mail-Server IP Address: TCP-IP of SMTP Server C. Port: 25 D. Primary DNS Server IP: your ISP s DNS Server. 3. Disable the firewall s SMTP Proxy 4. Ensure that SMTP Server is configured to forward outgoing mails to the firewall. II. INSTALL X-SPAM BETWEEN SMTP SERVER AND FIREWALL - POSITION B To deploy X-Spam for SMTP Servers between Firewall and SMTP-Server/Gateway, perform the following steps: X - Spam for SMTP Servers User Guide 12

13 1. Install a Windows machine on the clean network. 2. Install X-Spam for SMTP-Servers on this machine. 3. During Installation, presume: E. Primary Local Domain Name: mail.company.com F. Local Mail-Server IP Address: TCP-IP of SMTP Server G. Port: 25 H. Primary DNS Server IP: your ISP s DNS Server. 4. Configure the SMTP-Server to forward all outgoing mail to the X-Spam machine. 5. Run X-Spam Administrator 6. Click on Admin Click on Gateway Administration 7. In Configuration of Inbound Mails, (a) Put * in Mails for Local Domain & press tab (b) Put the TCP-IP number of your ISP s mail-server, /OR/ the TCP-IP address of the firewall PC (in case it is a proxy-based firewall with the SMTP-Service enabled) in the Forward_to_host box and press tab (c) Put 25 in Port and press tab (d) Click on Space bar; Click on Save & Exit Admin. III. INSTALL X-SPAM ON SMTP SERVER - POSITION C To deploy X-Spam for SMTP Servers on the SMTP-Server, perform the following steps: 1. Install X-Spam for SMTP-Servers on this machine. At 2. During installation presume: Primary Local Domain Name: mail.company.com Local Mail-Server IP Address: TCP-IP of SMTP Server Port: 26 Primary DNS Server IP: your ISP s DNS Server. 3. Configure the SMTP-Server installed on this machine to listen on port 26 (instead of port 25). 4. Configure the SMTP-Server to forward all outgoing mails to localhost 5. Run X-Spam Administrator 6. Click on Admin Click on Gateway Administration 7. In Configuration of Inbound Mails: X - Spam for SMTP Servers User Guide 13

14 a) Put * in Mails for Local Domain & press tab b) Put the TCP-IP number of your ISP s mail-server/or/ the TCP-IP address of the firewall PC (in case it is a proxy-based firewall with the SMTP-Service enabled) in the Forward_to_host box and press tab c) Put 25 in Port and press tab d) Click on Space bar; Click on Save & Exit Admin. Installation This chapter provides information about the software and hardware requirements of your machine for using our products and provides step-by-step instructions on installation. All Components of X-Spam for SMTP Servers are auto installed during the installation process. Certain default settings are set by the application that optimizes the performance. Change them only if required. X-Spam Administrator. SMTP Administrator. POP3 Download administration Web admin X - Spam for SMTP Servers User Guide 14

15 Topics in Installation This chapter provides details about the following topics: Software and Hardware Requirements Prerequisites for Installation X-Spam SMTP-Server deployment Installation on a network without firewall. Installation on network with firewall Installation Process Software and Hardware Requirements Your system should have Windows 95 (II nd Edition)/NT or above installed. Your system should have minimum of 64 MB RAM, 90 MB of free hard disk space and a CD ROM player. Prerequisites for Installation Before installing the software ensure that the following are done: Find your operating system version and service pack number. Ensure that MailServer is installed and configured. Uninstall other Anti-Virus applications. Check for the largest drive/partition and install X-Spam on that drive/partition. Valid Username and Password for Log In on the PC and Net Connectivity. Primary Domain name of the Mail Server Administrator Login Other software like Proxy; Firewall, DHCP installed on your system and third party software used for downloading. X - Spam for SMTP Servers User Guide 15

16 Related Topics Components of X-Spam for SMTP Servers Installation Process Installation is a simple, point and click operation that s done using the built-in install wizard. A user-friendly interface prompts you and presents you with a range of choices. Instructions are displayed in the screens that give you specific information. To abort installation, select Cancel in any of the screens. This section gives the step-by-step installation process. The software is sent to you in a CD. Load the CD in the player and open the CD Rom directory. Select autorun icon. Screen in Figure 2.1 is displayed. This is the start up screen for installing the application. Figure 2.1 Install Opening Screen Following table provides details of each step for installation. Step 1 In Figure 2.1, select Next, to begin installation. Screen in Figure 2.2 is displayed. This screen shows the license agreement between you and MicroWorld. Read the instructions and select Yes to accept the terms. Select No if you do not accept the terms in which case the installation process is aborted. X - Spam for SMTP Servers User Guide 16

17 Figure 2.2 License Agreement Step 2 If you select Yes, screen in Figure 2.3 is displayed. You select the directory to install the application. The default path is displayed. To change the location, browse your PC and select the directory. Select Next. Figure 2.3 Select Destination Directory Step 3 The application is ready to be installed. Select Install. Figure 2.4 Begin Installation Step 4 The software is copied and uploaded into the directory you have selected. A folder with the applications name is created. A progress bar showing status of installation is displayed. Figure 2.5 Extracting Files X - Spam for SMTP Servers User Guide 17

18 Step 5 If you had installed the application earlier, the system asks if the earlier settings should be retained. Select Yes to retain and No to initiate fresh settings Clicking on No button will display a password window. Once you key in the password it will ask you to confirm the password by reentering it. Figure 2.6 Prompting for retaining old configuration Step 6 You must configure your domain settings. Enter your primary local domain, admin ID, local mail server IP address and the primary DNS server IP. The next screen uploads the evaluation details. Figure 2.7 Domain Configuration Step 7 Evaluation license updated Step 8 Go through the important information before clicking on Next X - Spam for SMTP Servers User Guide 18

19 Step 9 Installation is complete X-Spam for SMTP Server is installed on your machine. The following icons are added to the task bar at the bottom of your screen X-Spam Tasks X-Spam for SMTP Servers has a group of tasks for Spam Control and Content Security. The application is configured to execute them automatically. You can run some of the tasks manually. This section provides a list of different tasks, manually run with X-Spam. Detailed explanations of the tasks, meanings of fields etc are described in successive individual chapters. Topics in X-Spam Tasks The chapter provides details about the following topics: To launch X-Spam tasks Details of X-Spam tasks To launch X-Spam tasks After the application is installed, in the application status bar, right click Pop up menu shown is displayed. Tasks are displayed as links. Click on the link to open it. Details of X-Spam tasks X - Spam for SMTP Servers User Guide 19

20 To access the tasks, please refer to To launch X-Spam tasks Details of each item are explained in the following table. Task Name X-Spam Administrator SMTP Administrator Download POP3 Mails Download X-Spam Update Function Window contains all admin task like content control, group policy etc. Window contains all SMTP task like gateway configuration, spam controls etc Option remains invisible in default mode. To make this option visible, go to Start > Programs > X-Spam for SMTP Server > POPDownload Administration.> Config > POP Downloader active Select the button to begin auto download of updates from MicroWorld download site. Your system must have Internet access. Refer General Config for details. Mail Debug Information View Log Files X-Spam is Active Disable X-Spam Auto-Download is Enabled View SMTP queue TCP Connection System Information Helps you send information of logs, ini files and other concerns to the system administrator via . Allows you to view log files that display details of X-Spam activity in your system. For details, refer View Log Files. Button is disabled by default and indicates that X-Spam is active and running. To disable X-Spam, select Disable X-Spam. Disables or stops X-Spam from running. MicroWorld recommends that you exercise this option with forethought, as your mail server is unguarded when X-Spam is disabled. Button is disabled and signifies that auto download of updates is enabled. Opens a View Queue window. Opens a View TCP window showing all TCP/IP connections. Displays details of system where X-Spam is installed. Following screen is displayed. There are two links in the left frame: Details and Sharepoints. X - Spam for SMTP Servers User Guide 20

21 Task Name Function Details Provides details of individual system components. Select the link to see Figure Details of System. There are different tabs pages. A brief description of each is given. Machine All your system details are displayed. These include: machine identification, BIOS info, boot information etc. Network Displays network details like: Network adapters, IP addresses, protocols, services, clients, and details of Winsock etc. Devices Displays all software and hardware devices connected to the system. Printers Displays all printer devices like hard copy printers, pdf writers etc and the port they connect. Engines Shows names of all database engines, drivers and devices on your system. Drives Details of drives on the machine, CPU size and free space, pattern of use etc. are displayed. Windows 98 Displays operating system details like name, version, etc. Also listed are the default application folders of the system, their path and location, environment, etc. CPU Displays details of the central processing unit of your system. Details like identification, features, cache, etc are given. Media Lists names of available devices and sound devices. Time Zone Displays time zone details where the system is located. Processes Displays list of all active applications running on your system. Startup Displays applications loaded at start up. Software Lists all software s, installed and available on the system. Memory Shows details of system memory like: memory measuring, memory utilization memory properties, etc. are displayed. Display Gives details of adapters, its properties, capabilities etc. APM Shows status of advance power management, battery status, etc. X - Spam for SMTP Servers User Guide 21

22 Task Name Function Sharepoints Provides details of components of your system, accessed by other systems. Select link to see following screen. The features are only enabled for Win NT/2000/ XP. There are three tab sheets. Shares There are two frames. Top frame, displays all folders shared by your system with other machines. Bottom frame shows all list of all machines connected to your system. Open Files Displays list of all files that are accessed, name of machine accessing the file etc. About X-Spam Sessions Displays list of machines connected to your system. Details like username, type, files accessed etc. are shown. Displays splash screen of X-Spam installed on your system. Exit Select the link to exit. Getting Started This chapter gives details of standard conventions used in this guide. Also included are components of a typical user interface, how to navigate the screens, meanings of various symbols and buttons, types of fields and how to enter values in them. X-Spam SMTP Server Monitor X-Spam SMTP Server Monitor shows the status of the different services in the application. Screen. There are two frames: a) Services, which lists the services running in X-Spam and the status b) Log displays details of X-Spam activity. Action buttons at the bottom of the screen open configuration windows. Related Topics X - Spam for SMTP Servers User Guide 22

23 X-Spam for SMTP Server Deployment Components of Mail Scan for SMTP Servers How X-Spam for SMTP Server works How POP3 Downloader works To launch X-Spam SMTP Server Monitor: In the Windows application status bar, right click. The following popup is displayed: Elements of the popup are briefly described below: X-Spam SMTP Server Monitor: Click the link to see SMTP Server Monitor, shown in Figure 3.2 X-Spam SMTP Server Administration: Click the link to see X-Spam Administrator, shown in figure 3.1 View SMTP Log Shows the SMTP activity View Router Shows details of Router activity About X-Spam SMTP Server: Click the link to see a screen giving version and website information about X-Spam for SMTP Server. Shutdown X-Spam SMTP Server: Shuts down the X-Spam SMTP Server. X - Spam for SMTP Servers User Guide 23

24 Figure 3.2 SMTP Server Monitor Services Function Processes of X-Spam, allowed on your system are listed in this frame as a menu tree. Click on to expand the tree and view all the processes. Process name is given along with a colored square indicating status of the process. Green rectangle indicates the process is UP and running. Red rectangle indicates the process is Down and inactive. Log SMTP Config POP3 Config Download Frame displays list of X-Spam SMTP Server activity. Activities like: completed thread details, SMTP server activity, SMTP connection details, etc. The frame also shows date, time, router name, etc. when the actions are run. Opens screen for SMTP [gateway-configuration ]menus. You can configure settings for SMTP configuration. Opens POP3 Download Administration window. POP3 downloader collects mails from Remote Servers and forwards them to the SMTP Servers. Select the button to begin downloading mails. Dialog box RASPOP3 DOWNLOADER is displayed. The values for the field are generated by X - Spam for SMTP Servers User Guide 24

25 Account POP3 Account of user. Messages Total Number of messages. the system and indicate: Function Downloading Msg Number of messages downloaded. Msg Size Size in Kb of the message being downloaded. Message No Number of the message being downloaded. Add Button allows you to block user. Details Displays a progress bar of download status. Hide Subject Displays subject line of message. Some e- mails viruses have a known subject line. Mails with such subject lines can be blocked. Select Add button and add it to the list. Hides SMTP Server Monitor. The monitor remains active and runs in the background. To view the monitor, right click on and select X-Spam Server Monitor from the menu. Shutdown Shuts down X-Spam for SMTP Server. If X- Spam is shut down, mails are not scanned. To start X-Spam again, go to Start > Programs > X-Spam for SMTP Server and click X-Spam SMTP Server. To launch X-Spam Administrator Go to Start > Programs > X-Spam for SMTP Server > X-Spam Administrator Screen in Figure 4.1 is displayed. This is the opening screen of Content Administrator. There are menus or tasks displayed in the left panel. Select the menus, to view screens related to these menus. To execute tasks, select the respective buttons. The related screen is displayed. The menu bar has three menus Admin, View and Help. Click on a menu to view the pop up list of related sub-menus. Brief description of the menus or tasks follows: The next sections describe in detail about different tasks and how to validate fields. X - Spam for SMTP Servers User Guide 25

26 Top Menu options in X-Spam Administrator Options in the top menu are : Admin View Help Admin This section provides details about the following tasks: Scanner Administration Content Control and Spam Killer Compression Control X-Spam Message Scan Control License Information Virus Test Mail Scanner Administration The menu allows you to perform crucial tasks like adding local primary domain, configure settings for auto-download of updates and plug Internet Explorer vulnerabilities that allow Virus to enter your system. Certain types of attachments are more prone to Virus infections than others. This feature allows you to block or allow such attachments, from entering and leaving your system. Topics in Scanner Administration To block attachments Auto-Download Updates To set time for updates auto download Set auto actions after update downloads X - Spam for SMTP Servers User Guide 26

27 General Config FTP Config HTTP Config UNC Config To Plug Internet Explorer Vulnerabilities To archive mails/attachments To Launch Scanner Administration In Figure 4.1, select You configure settings as explained in the following table. Figure 4.1 Scanner Administration Scanner Administration This frame allows you to specify Scanner Administration settings. Message Input Path Report File Path Displays folder path and name to store incoming mails that need to be scanned. Folder path where log files and reports are stored in your system is X - Spam for SMTP Servers User Guide 27

28 Max Size (kb) displayed in the field. Select Browse to choose a new location. Maximum size of the log file. Default value 0 signifies that the log file size is unlimited. Block Attachments You specify attachments that can be blocked from entering or leaving your system. To block attachments: Block List Key in the type of attachments that you want to block in the top field and click add. Added file types will be displayed in the box below. Select the button to view Advanced dialog box shown below. You can perform advanced tasks with it. Delete all Attachments in s having nondisinfectable. You can delete all attachments if the Virus cannot be removed. To delete the item, click on it and select Delete. Select Save and Exit. Delete entire if found non-disinfectable Select the check box to allow the software to delete the entire mail if the Virus cannot be removed. Delete entire if found any Select the check box to allow the software to delete the entire mail if any Virus is found. Quarantine blocked attachments You can Quarantine blocked attachment types using this option. Delete All Reserved...You can delete all reserved attachments. Quarantine s having unscanned. Quarantine s with unscanned attachments like password protected files. Quarantine unscanned attachments Select the option to Quarantine unscanned attachments. Attachments Excluded You can whitelist certain attachment types using this X - Spam for SMTP Servers User Guide 28

29 option. The whitelisted attachments will be exempted from scanning. Forward Attachments of following Types to Admin: When violations regarding barred attachments occur, this frame allows you to specify actions to be taken. Send Original Mail to User Add Delete Select the check box to forward the mail that has restricted attachments to the person sending it. The list box allows you to specify type of restricted attachments that are forwarded to the system administrators. There are two frames in the box. The top frame allows you to enter names of attachment types and the bottom frame displays attachment types that are already included in the list. To add an attachment type: Enter name in the top frame and select Add. It is displayed in the bottom frame. To delete a name from the list, click on the name in the display box and select Delete. Select the button to add the attachment type name, entered in the above field. The item is now added to either the block or allow list. Select the button to delete the attachment type name, displayed in the display box. The button allows you to specify if checks should be run on outgoing e- mails with attachments. Reserved Attachments Check for Outgoing Mails Also: Select the check box to check outgoing s for any restricted attachments. Reserved Attachments check excluded for s To/From: The list box allows you to enter e- mail IDs, whose outgoing mails can include restricted attachment types. Add. The name is displayed in the list box. To delete an ID from the list, click on the name and select Delete To specify ID whose attachments can be allowed: Enter the ID in the field above the list box and select Save to close the list box and return to the main screen. X - Spam for SMTP Servers User Guide 29

30 Action: The frame allows you to specify actions to be run when infected s or attachments are detected. Quarantine infected Files Select the check box to quarantine infected files. Such files are encrypted and stored in a safe location. Quarantine Path Infected and attachment that cannot be cleaned is stored in a quarantine folder, whose path is displayed in the editable display field. Select the button to view the Select Path dialog box. The box allows you to specify a new folder to store quarantined s and attachments. Max Size (kb) Disinfect Delete Maximum size of the log file. Default value 0 signifies that the log file size is unlimited. Select the radio button to disinfect infected files. Select the radio button to delete infected files. Anti-Virus Update: The frame allows you to specify how and from where to download vaccine updates, actions run after updates are successfully downloaded, interval for down loads, etc. Auto-Download Updates Enable Auto Download Enable Update Notification Query Interval Select the check box to enable auto download of updates. The system initiates automatic downloads of updates as per the settings you enable using Update config and Query Interval Select the check box to notify system administrator when updates are downloaded. To set time for updates auto download: You can specify the time interval at which X-Spam should initiate automatic down load of updates Select the appropriate query interval in minutes from the drop-down list. Download begins automatically as per this frequency. For example: If 480 is selected then X-Spam connects to the site every 480 minutes to begin downloads. Set auto actions after update downloads: Button is enabled only if X - Spam for SMTP Servers User Guide 30

31 Enable Autodownload check box is selected. Dialog box shown below is displayed. You assign program files to be executed after updates are downloaded. Execute this : Select the check box if the update is to be launched automatically after download. Other fields in this dialog box are enabled only if the checkbox is selected. Program Name : Enter program to be run after update is downloaded You can select the Browse button to browse your system and select the executable program. The name and path are displayed in the field. Start in : Specify directory or folder of the program. You can select the Browse button to browse your system and select the executable program. The name and path are displayed in the field. Parameters : Enter the parameter for the program to be run, in this field. The parameter in the screen shown above is a file name. Run : Select the manner in which the file should run, from the drop-down list. Select Normal Windows to run it in the windows mode. Select Minimized to run it in minimized mode. Select Hidden to hide it from view. Select Maximized to run it in the maximized mode Force Process to terminate : Select the radio button if the download process should terminate the launched program after waiting for the set time interval. Don t wait for process to complete : The download process will complete and wait for the set interval time even if the program has not completed. While this. : While the program is running, all other PC operations will be suspended as per the time interval selected from the spin button. Select Ok to accept changes or Cancel to discard them. After settings are modified, select the button to begin downloading updates. Progress bar shown below displays download progress. The button provides details on setting up and configuring the settings for Update configuration. You assign the access mode your system uses to X - Spam for SMTP Servers User Guide 31

32 connect to the Internet, proxy IP addresses There are four tab pages that allow you to select the mode of download and configure the settings for the selected download mode. General Config The tab page allows you to select access mode, enable and assign the IP address of server from which downloads are done. You connect to the mirror Websites and download updates using one of the connectivity modes. The three modes are: HTTP, FTP and UNC. FTP: (File Transfer Protocol) FTP offers the most stable means to transfer data. Use this mode when you have problems connecting using HTTP. Advantage with FTP protocol is that if connection breaks during download, it commences from the point where it broke. Configuring FTP for a proxy server is more complicated when compared to configuring HTTP with the proxy-server. These are known to be slower than HTTP. Select the radio button to download using FTP protocol. Tab page "FTP Config" is enabled only if this radio button is selected HTTP: (Hyper Text Transfer Protocol): HTTP is the most commonly used access mechanism. The software selects it as the default mode. If connection is broken during download, you have to start from the beginning. HTTP downloads are faster than other types. Select the radio button to download using HTTP mode. Tab page "HTTP Config" is enabled only if this radio button is selected. Network: (Universal Naming Convention) UNC is the standard for naming network drives. For example, UNC directory path has the following form: \\server\folder\subfolder\filename. In a multi X-Spam Server environment, when only one system has Internet connectivity and updates are to be transferred to many machines, choose this mode. If your machine does not have Internet access, you can choose any machine in the LAN and assign it to download updates. This ensures that updates are transferred to individual machines. Select the radio button to download using Network mode. Tab page "UNC Config" is enabled only if this radio button is selected Update Notification Mails to User: Enter e- mail of user to whom update notification mails are sent. Enable Download Via Proxy: Select the check box if your X-Spam server is behind a proxy server. HTTP Proxy Server IP: Enter the TCP/IP address on which your proxy server listens for Login name: Enter login name of the user, in this field. System allows access only for this login name. Password: Password ensures that only the above login name is allowed access. It can be alphanumeric and must be of minimum six characters. Select Save to save and return to the main screen. X - Spam for SMTP Servers User Guide 32

33 HTTP requests, in this field. Port: Enter the port number on which the proxy server listens for HTTP requests, in this field. FTP Config The tab page allows you to change the default settings for FTP mode of download. The fields are enabled only if FTP is selected as the mode and Enable Download via Proxy check box is selected in General Config tab page FTP Download Site: Select update download FTP site. MicroWorld stores updates in dedicated FTP servers. The sites are defined in the software and displayed in the drop-down list. Select the appropriate FTP site from the drop-down list. The application connects to this site to download updates. The default site is displayed in the field. Port: Enter the port number of the FTP download site, from which updates are downloaded. Download Directory Updates are stored in the FTP sites in a specific directory. Based on the selection done in "FTP Download Site" the relevant directory name is displayed in the noneditable display field. Default directory name is displayed in the field. Enter the FTP proxy server Enter the FTP Proxy Server IP address in this field. The application uses this proxy to download updates. The field is enabled only when "Enable Download via Proxy' check box is selected in "General Config" tab page. Login Name: Enter the login name for proxy authentication. System allows access only for this login name. If your proxy server does not require authentication, then retain the displayed default name "Anonymous". Password: Password ensures that only the above login name is allowed access the application. Enter the password in this field. Port: Enter port number on which you re your proxy server listens for FTP requests. Logon Type When a client connects to the Internet) via a proxy server, additional configuration is required to download the updates. Via Proxy check box is selected in General Config tab page. Select FTP Logon type: User@siteaddress: This is the format the proxy or the firewall between the client and the Internet, expects the logon command. Select the radio button if proxy used is WinGate, Winproxy, etc. By using the passive or PASV mode, the server opens a random port, unsecured by the firewall and allows you to connect. Select the radio button if logon type is of Firewall type. X - Spam for SMTP Servers User Guide 33

34 OPEN siteaddress: This is the format the proxy or the firewall between the client and the Internet, expects the logon command. Select the radio button if logon type is Cproxy, etc. PASV Mode: When you connect to a serve with a firewall, the firewall filters unwanted data and access may not be granted. HTTP Config Socks: Select the radio button if Socks proxy is used as the logon type. The drop-down list box is enabled only if the radio button is selected. Version specification numbers for the Socks Server are displayed in the drop-down list. Select the appropriate value. The tab page allows you to change the default settings for HTTP mode of download. The fields are enabled only if HTTP is selected as the mode in General Config tab page. HTTP Download Site: A list of HTTP download sites for updates is displayed in the drop-down list. Select the appropriate site. The default HTTP site ate is displayed in the field. Select Save to save and return to the main screen. UNC Config UNC mode of download is required when only a single server has Internet access in a X-Spam environment with multiple X-Spam servers and updates need to be transferred to them. This tab page allows you to change the default settings for Network mode of download. The fields are enabled only if Network is selected as the mode in General Config tab page. Source UNC Path: Enter the name and the shared drive path of the network server in this field. For example: \\qa6\c\pub\update IE Vulnerabilities I To Plug Internet Explorer Vulnerabilities: IE has certain loopholes or vulnerabilities, through which viruses are delivered. Since Outlook Express and other mail clients are from the same product stable, delivery of viruses into your system becomes easier. The tab page allows you to auto delete mails Select Save to save and return to the main screen. The button allows you to specify advanced settings to plug Internet Vulnerabilities and archive s and attachments. Select the button to view the following dialog box. There are three tab pages that allow you to configure settings for IE Vulnerabilities and Archive s. X - Spam for SMTP Servers User Guide 34

35 with CLSID extension and HTML embedded script tags. Delete Files with CLSID Extension Attachments that end with a Class ID (CLSID) file extension do not show the actual file extension with Internet Explorer. This allows dangerous file types to look harmless. Select the check box to auto delete such files. Delete HTML with Scripts HTML s can be used to transmit virus through embedded scripts. Above selection box displays a few known script tags. Select the check box to delete all mails with such scripts. Script Tags Enter the new script tag in this field and select Add. The script tag is added to the list in the selection box. Mails with the tag are deleted. This field is enabled only when Delete HTML with Scripts check box is selected. To remove script from the list, click on the tag and select Delete. IE Vulnerabilities II Script Check and Content Disabled for mails From You can specify that mails from specific e- mail IDs be allowed, even though they have the banned script. Enter the ID in the field and select Add. To remove, select ID and choose Delete. Script Check and Content Disabled For Mails having To As: You can specify that mails to specific IDs be allowed, even though they have the banned script. Enter the ID in the field and select Add. To remove, select ID and choose Delete. Some virus-infected files can have multiple extensions like. doc.exe Clean compressed files can also have double extension (e.g... pdf.zip). The tab page allows you to specify actions for such files. No Action Select the radio button to allow free entry for mails with Multiple extensions. Delete Mail Select the radio button to delete mails with double extensions. Forward to Admin Select the radio button to forward files with double extension to the system administrator. Allow Multiple Extension Attachments to ZIP Clean compressed files like.zip that have multiple extensions can be allowed entry. Select the check box and enter the extension name in the field and select Add. The extension is displayed in the list box. To remove the name, select it and choose Delete.This field is enabled only if either of delete mail n forward to admin checkboxes is selected. X - Spam for SMTP Servers User Guide 35

36 Archival To archive mails/attachments: All s and attachments flowing in or out of the system can be archived or saved into a specified location. The tab page allows you to specify the location for s and attachments and also exclude specific attachment types from being archived. Archive s Select the check box to archive s. Enter the path where the s should be saved. You can browse and select the location using the adjacent browse button. The field and button are enabled only when Archive s check box is selected. Archive Attachments Select the check box to allow attachments to be archived. Enter the path where the attachments should be saved. You can browse and select the location using the adjacent browse button. The field and button are enabled only when Archive Attachments check box is selected. Attachments Archive Directory:Here we specify the path to store archive attachments. Do not Archive Attachments of type Enter the attachment type that should not be archived and select Add. The name is displayed in the list box. To remove the name, select it and choose Delete. Select Refresh to view the updated list and select Save. Content Control This menu allows you to specify restricted words or phrases in s that should be detected in your system. Spam s with such words anywhere in the subject, body, and tags can be deleted or quarantined. You can add a customized disclaimer for outgoing or incoming attachments. They key tasks are: To Add an offensive Phrase To set Actions for s with offensive Phrase To Add Disclaimer to s To select Disclaimers To Launch Content Control X - Spam for SMTP Servers User Guide 36

37 In Figure 4.1, select Screen in Figure 4.2 is displayed. Figure 4.2 Content Control Fields and their meanings are described in the following table Phrase To Check: This frame allows you to specify offensive words and phrases that should be checked in s. You can specify the action: Quarantine, Delete or Forward s that have such phrases or words. Enable Content Checking Phrase Action Select the check box to allow X-Spam to run its content checking. Enter the restricted phrase or word that should be checked in all s entering or leaving your system. If the word occurs anywhere in the body or subject of the , further action can be specified. The field is enabled only if Enable Content Checking box is selected. To add a restricted phrase or word, right click on Display List and click on Add Rule. Enter the Phrase or Word in the field provided. Action Select the action to be done when restricted words or phrases are X - Spam for SMTP Servers User Guide 37

38 detected in s.to set action for offensive mails: Quarantine The Mail: Select the radio button to quarantine the mails with the restricted Word or Phase entered. Delete The Mail : Select the radio button to delete the mails with the restricted Word or Phase entered. Forward Mail To Admin: s with offensive phrases are forwarded to system administrators. The list box displays all phrases or words that are restricted and the action associated with them. There are five columns: first column displays the serial number, second displays the phrases or words. Next three columns show the action specified. The x sign identifies the action. Frame allows you to set action for s that have the offensive phrases displayed in the list box. Radio button allows you to assign the associated action. Whitelisting If a Word in the whitelist appears in the mail, the mail will be allowed automatically, irrespective of the presence of other restricted words in it. Discarding: Words in this list will exempted from scanning. Default Whitelist of word/phrases: Clicking on this label displays words and phrases whitelisted by default. Entries in the list are represented with a Yellow background. User specified whitelist of words/phrases Clicking on this label displays words and phrases whitelisted by the administrator. Entries in the list are represented with a light blue background. Clicking on this displays phrases Whitelisted by User.By default it is blank. Words/phrases discarded by default: Clicking on this displays phrases Deleted by MicroWorld. Entries in the list are represented with a light purple background. Words/phrases discarded by User: Clicking on this displays phrases Deleted by User. By default it is blank. Entries in the list are represented with a light green background. X - Spam for SMTP Servers User Guide 38

39 If you want to change the action, then click on the phrase. It appears in the Phrase: field. Next select the appropriate action radio button. Select Refresh to view the updated list. Add Rule: Right Click on the phrase list to add the phrase or word entered in the Phrase: field. The word or phrase is displayed in the list box. Edit Rule: Right Click on the phrase list to edit the phrase or word displayed in the list box. Enable Rule: Right Click on the phrase list to Enable the rule. This option is enabled only if the selected phrase is listed in White list or Discarded list Disable Rule : Right Click on the pharse list to Disable the rule. This option is enabled only for Restricted Phrases or words. Block list : Right click on the phrase list to Block the rule. This option is enabled only for phrases in default White list. White list: Right click on the phrase list to add to white list This option is enabled only for phrases in Words/phrases discarded by default Select the button to view the Advanced Content Options dialog box. The box allows you to set advanced content checking options. Select the check box for the option to enable it. Send Original Mail to User Also: The offensive mail is sent to receiver also. Check HTML Mails for Content: s in HTML format are also checked. X - Spam for SMTP Servers User Guide 39

40 Content Check Disabled for Replied or Forwarded Mails: Select the check box to disable content checking for s that are sent in reply or forwarded. Check HTML Mails for Content: HTML types of s are scanned. HTML mails with "SRC" string to be tagged as SPAM: HTML mails sent by Spammers can have links to banned images or URLs. Links to banned content is enclosed in SRC string. Mails with such strings are regarded as Spam. e.g...<td><img src=" width="302" height="1" border="0"></td> <td><img src=" width="82" height="1" border="0"></td> Quarantine Advertisement s: Deletes advertisement s Treat Subject with more than 5 whitespaces as SPAM: Subject lines in Spam mails sometimes have blank spaces. Any mail with more than 5 continuous white spaces is regarded as Spam. Treat Mails with Chinese/Korean character set as SPAM: Mails containing Chinese, Korean or any other far eastern characters are regarded as Spam. Select the button to view the Anti-Spam configuration Enable Non Intrusive Learning Pattern (NILP) Check Using this option you can enable NILP Technology in Spam Filtering. Non Intrusive Learning Patterns (NILP) is a revolutionary X - Spam for SMTP Servers User Guide 40

41 technology from MicroWorld that works on the principles of Artificial Intelligence to create an adaptive, self-learning mechanism in stopping Spam and Phishing mails General Header Tests X-Spam checks the validity of all the headers in the mail and if any of the headers are found to be invalid, the mail will be considered as Spam. X-Spam Rules Check X-Spam Rules are Rules that describe certain characteristics of a mail and they are matched against the mail header, body and attachment to generate a score for each mail. If the score crosses a threshold value, then the mail is considered as Spam. Sender Policy Framework (SPF) Check Sender Policy Framework is a world standard that helps to prevent forgery of sender address and works as a powerful mechanism to stop Phishing mails. Verify Sender Mail ID This option verifies whether the sender s ID is a valid entity within the Domain. SURBL Check Unlike normal RBLs, SURBL Check works by scanning for the presence of names or URLs of Spam websites in the message body. RBL Servers Shows a list of RBL servers. You can add or remove entries in the list. Auto Spam Whitelist You can add addresses to this list so that they will be accepted without content checking. Select the button to view the Ip-Whitelisting features. Using this feature you can skip RBL look ups for Local IP addresses. It allows you to specify IP addresses of mail senders that you want to exclude from RBL filtering. Select the button to view the advanced option i.e Mail tagging option X - Spam for SMTP Servers User Guide 41

42 Do Not change at all : is passed without any changes. Both subject and body is changed. : In this case both the subject and body undergoes changes. While the actual spam content is embedded in the body, a SPAM tag is added in subject. Only [Spam] tag is added in : In this case only SPAM tag is added in Subject without doing any changes in Body part of . X-X-Spam-Spam.. : A header line is added as X-X-Spam-Spam: 1 while the body and Subject remain unchanged. X-X-Spam-Spam.. : A header line is added as X-X-Spam-Spam: 1 While the actual spam content is embedded in the body. Disclaimer You can add customized disclaimers to outgoing and incoming mails. To Add Disclaimer to s: Select the check box to add disclaimer in outgoing mails. Click in the dialog box and type the disclaimer. Select the button to view the Advanced dialog box. You can configure advanced settings for disclaimers. X - Spam for SMTP Servers User Guide 42

43 Disclaimer disabled for replied or forwarded mail: This option helps disable the disclaimer feature in reply mails and forwarded mails. Disclaimer for Incoming Add disclaimer to all incoming s. Do not send disclaimer for Mails to: You can specify s IDs, whose s should not carry the disclaimer. Enter the ID in the field and select Add. The ID is listed in the display box. Domain Specific Disclaimer: You can specify customized disclaimers for specific domains. Local domains are displayed in the list box. Right click on the domain to view the following pop-up. The check box for Add Disclaimer To Out Bound Mails must be selected for this option to enabled. Add list of local domain in Local Domain list for this option to enabled. Enable: Click on the link to allow disclaimers to be sent. Disable: Click on the link to disable disclaimers. Edit Disclaimer: Allows you to edit an existing disclaimer. You can also create a new disclaimer file. Select the button to view Open selection box. The box allows you to select disclaimer files. To select Disclaimers: Browse to the required directory and select the file. Contents of the selected file are sent as disclaimers. The button is enabled only when Add Disclaimer To Out Bound Mails check box is selected. X - Spam for SMTP Servers User Guide 43

44 Click on this button to go to the Quarantined Mails folder You get 5 options when you right-click on any mails in the Quarantine folder. View Opens Mails in default mail client Delete -To delete quarantined mails Message Source - The header is displayed in a notepad Add Sender s -id to White List You can add the Id top the Whitelist Release this mail Clicking on the option releases the mail from the quarantine folder. Click on this button to view authentic Mails Refresh Save Select the button to refresh the screen Select the button to save the entries. X - Spam for SMTP Servers User Guide 44

45 Compression Control Auto compression of attachments is a feature that allows automatic compression of outgoing and incoming attachments. This feature allows you to specify if outbound/inbound attachments should be automatically compressed or decompressed; exclude and include specific attachments from auto compression and specify the minimum attachment size that should be auto compressed. To Launch Compression Control In Figure 4.1, select Screen in Figure 4.3 is displayed. You configure settings as explained in the following table Figure 4.3 Compression Control Compress outbound attachments Create selfextracting zips Select the check box to allow auto compression of all outgoing attachments. Select the check box to create self-extracting zip files of outgoing attachments. This is useful when the recipient does not have the software to uncompress attachments. This field is enabled only if Compress outbound X - Spam for SMTP Servers User Guide 45

46 Uncompress inbound attachments Uncompress inbound attachments (Local Domain) Compression Options: Compress ONLY if compression % is greater than Compress if Attachment is above (Kb) Select Compression Level to use attachments check box is selected. Select the checkbox to allow auto uncompress of all incoming attachments. All incoming attachments are automatically uncompressed and scanned for virus before they are sent to the receiver. Currently only.zip formats are supported. Select the checkbox to allow auto uncompress of incoming attachments from the local domain. This field is enabled only if Uncompress inbound attachments check box is selected. Details are given below: Some files cannot be compressed beyond a limit. You can specify the minimum compress percentage in the adjacent field. Any file, which cannot be compressed beyond the specified value, is not left as is. You can specify that attachments only beyond a certain size should be compressed. Enter the value in the field. Select the appropriate compression from the drop-down list. The available values are: Default, Best Compression and Best Speed. Default Ensures the optimum balance between speed and compression quality. Best Compression Ensures the maximum amount of compression but may take more time on a slower machine. Best Speed Ensures the best speed of compression. Quality of compression may not be optimized. There are three frames that allow you to add/exclude specific attachments for auto compress. Each frame has a field and a list box that displays selection you make or previously entered values. To add a value, enter it in the field and select Add. The value is displayed in the list box. To remove a value from the list box, select it and click Delete. DO NOT compress attachments of extensions Compress Mail Attachments For Following Domains Don t Compress Mail Attachments For Following Domains Specify the type of attachments that should be excluded from autocompression. Specify domain names for which attachments should be compressed. Specify domain names for which attachments should not be compressed. X - Spam for SMTP Servers User Guide 46

47 Select Refresh to view the updated list and select Save. X-Spam Messages When a virus is detected in s and attachment or restricted words and phrases are found in them that violate the security policy, the and attachment can be deleted, quarantined or disinfected. A customized notification message can be sent to the sender, receiver or others, informing them about the action taken. This section provides details on creating customized notification messages. To launch X-Spam Messages In Figure 4.1, select. Screen in Figure 4.4 is displayed. Field meanings are described in the following table Figure 4..4 X-Spam Messages Mail Notification The frame allows you to specify s ID that sends and receives warning messages Warning messages are sent when violations occur. Different types X - Spam for SMTP Servers User Guide 47

48 of warning messages are listed in the adjacent list box. Warning Mails From User Address to Notify Messages Enter ID from which warning messages are sent. Enter ID that receives warning messages. A list of warning message types is displayed here. These are hard coded by MicroWorld. There is a check box on the left side, which shows icon by default. This means that the message is sent to the specified ID. Details of the message are displayed in the list box. Select Refresh to view the updated list and select Save. Scan Control This feature allows you to specify s IDs whose s should be scanned or exempted for virus scanning. You can also specify IDs whose s should be deleted. To Launch Scan Control In Figure 4.1, select. Screen in Figure 4.4 is displayed. X - Spam for SMTP Servers User Guide 48

49 Figure 4.5 Scan Control There are four frames that allow you to perform specific tasks. Each frame has a field and a list box below it. The list box displays the available IDs assigned to the frame. To add a new value: Enter the name in the field and select Add. The value is displayed in the list box. To remove the value, select it from the list box and click Delete. Remove All clears the list box. Scan Mails Only From User Scan Mails Only To User Do Not Scan Mails To User Do Not Scan Mails From User Delete Mails from Following Users Advanced All mails from the user are scanned. All mails to the user are scanned Mails sent to the user are not scanned. s from the user are not scanned. All s from the ID entered in the frame are deleted if the check box is selected. Select the button to view Advanced Options dialog box shown below. There are two frames that allow you to set Scan control policy for users whose mails are scanned and for users whose mails are not scanned. The screen has check boxes that allow you to choose options for scanning. s in both frames remains the same. Virus Checking: s are scanned for virus. Reserved Attachments Checking: Restricted attachments are scanned. X - Spam for SMTP Servers User Guide 49

50 Content Checking: contents are checked for offensive words and phrases. Dangerous Attachments Checking: Checks dangerous attachments for virus. Select Refresh and Save. License Information License key allows you to use the software for the duration set by MicroWorld. If you are using an evaluation version of the software, then the key is mandatory to run the application beyond the period. To obtain your License key, please contact Exit Administrator Closes the interface and exits. X-Spam for SMTP Server continues to run in the background. Topics in View You can view Logs of X-Spam activity. The following topics are explained: View Log Files View X-Spam Log X - Spam for SMTP Servers User Guide 50

51 View Auto Update Log View Download Log View SMTP Log Flush Logs X-Spam Reports Web Admin configuration Splash Screen Enabled View Log Files X-Spam generates a variety of log files that gives system administrators an overview and detailed information of X-Spam activity in the network. The following log files are generated: View X-Spam Log View Auto Update Log View Download Log View SMTP Log View X-Spam Log The log provides details of X-Spam activity for a period. Details displayed include: Version of X- Spam currently running, total size of s sent in a period, IDs of sender and receiver, attachment details, port configuration and other details through which s are sent, information about warning message like sender/receiver and subject information, etc. Following Figure shows a typical X-Spam Log file. X - Spam for SMTP Servers User Guide 51

52 View Auto Update Log Figure 4.6. X-Spam Log File The log provides details of updates downloaded by X-Spam. Details displayed include: X-Spam build version currently started, proxy IP used to download updates, whether new Anti-Virus Version matches found in MicroWorld s download site, etc. Screen in Figure 4.6 displays a typical Auto Update Log. View Download Log Figure 4.7 Auto Update Log File The log provides details of updates downloaded from MicroWorld updates download sites. Details displayed include: date and time when download was initiated, MicroWorld s download site URL, proxy IP, files downloaded (update.txt, remove.ini, avp.set, daily.avc) and file size, mode used for download (HTTP or FTP), etc. X - Spam for SMTP Servers User Guide 52

53 Screen in Figure 4.8 displays a typical Download Log file. View SMTP Log Figure 4.8 Download Log File Provides a log of SMTP activity. Details displayed include: Router details for stat and completed thread, SMTP incoming data, etc. Screen in Figure 4.8 shows a typical SMTP log. Flush Logs Figure 4.9 View SMTP log This feature allows you to clear all the log files that are built up over a period of time. MicroWorld strongly advises you to save the log files before flushing them. While the process is underway you are not presented any screen or dialog boxes. X - Spam for SMTP Servers User Guide 53

54 X-Spam Reports This feature provides a report of X-Spam activity for a period. There are five tab pages that provide reports about different X-Spam tasks. The tab pages are: Mails Sent From Local Domains, Mail Details, Alt. Details, Mails Received from Local Users, Mails Received from Foreign Domains and Daily Analysis X-Spam Reports X-Spam Reports Tab pages are briefly described below: Mails Sent From Local Domains: Select a date to obtain the details of mails sent from the local domains. Details displayed include: domain name from which s are sent, user or person sending s, total number and size of all s sent by the user. Mails Received from Foreign Domains: Select date to view details of mails received from Foreign Domains. Details displayed include: Foreign domain name from which s are received, total number and size of s sent to the user and attachment infected. Mail Details: Select date to view details of s sent to a user in your system. Details displayed 1include: date message is sent, senders name, domain name from which s is sent, message size in bytes, subject, recipient details, attachment name and originating IP. Att. Detail: Select date to view other details of s sent to a user in your system. Details displayed include: attachment file name, size, total number of infected attachments, deleted attachments and cleaned attachments. Mails Received by Local Users: Select a date to view details of mails received by local users. Details displayed include: domain name from which s are received, user or person sending s, total number and size of all s sent to the user and number of infections detected. Daily Analysis: Select date range to view details of mails received and sent through your system. For a date, details displayed include: total mails sent and received, total mails sent and size in bytes, X - Spam for SMTP Servers User Guide 54

55 total mails received and size in bytes, total number of infections and how many mails were cleaned and deleted. Mails Received from Foreign IP: Select date to view details of mails received from Foreign IP. Details displayed include: Originating IP from which s are sent, total number and size of e- mails sent to the user and number of attachments infected. Mails Received from local IP: Select date to view details of mails received from Foreign IP. Details displayed include: Originating IP from which s are sent, total number and size of e- mails sent to the user and number of attachments infected. Common features of X-Spam Reports tabs are described below. Not all Fields and features will appear in all tab pages. From Date/To Date Filter You can select the range of dates to be covered in the report. Click on the dropdown list to view the calendar and select the dates. Report will display details for the period that you select in the dropdown menus. Filters the report for the selected date range. S. No Represents the serial number of the activity. Msg Date Total Mails Mails Sent Mail Sent in Bytes Mails Received Total Infections Deleted Cleaned Foreign Domain Size Domain Name User Id Senders Name Options Date the message was sent. Total number of mails sent and received during the period Total number of s sent during the period. Size of sent mails in bytes Total s received Displays total number of infected mails Displays number of deleted mails Displays total number of mails that are cleaned Displays external domain name from which the were sent Displays total size of s received. Displays domain name from which local users received s. Displays the user names which received the s. Displays ID of person receiving s. Displays senders ID. Select the button to view Report Options dialog box, shown below. It allows you to select IDs to which they should be sent and the time of sending the reports. X - Spam for SMTP Servers User Guide 55

56 Today Allows you to generate reports for all tab pages for the current system date. Fields in all the tab pages are populated with relevant values. The process is run automatically. Print Refresh All Refresh Close You can print the report of the current screen or the open tab page. Page layout screen is displayed and you can set the page width, zoom to a detail, export the report to Excel, etc. Refreshes all tab pages. Refreshes current page. Closes the screen and displays X-Spam Administrator screen. Web Admin Configuration X - Spam for SMTP Servers User Guide 56

57 This feature gives you information on the IP address of the Web Server and the port on which the Web Server is running. It provides you options to stop/start Web Server and enable the LDAP Authentication. Authentication of ADS should be activated first, in order to enable LDAP Authentication and subsequently you can login to the Web Server using LDAP accounts only. Administrator account will have the rights for complete Management and Control, while normal user can view his s that are quarantined. Web Server Configuration Server IP Address Port Displays the IP address of the web server. Displays the port where the web server is active. Active Directory Service (ADS) Configuration IP address Port Base DN Administrator Account Name Administrator Password Fill the IP Address of your LDAP server Fill the port of your LDAP srver, that is 389. Base DN is the search criteria that the LDAP Server employs in searching the user. You can get the Base DN from gpresult output. The format of Base DN is CN=Users, DC=Domain name, DC=com. If your domain is TEST then Base DN is as follows CN=Users, DC=test, DC=com Enter the administrator account name. Enter the administrator password. Test By clicking this option you can check the validity of the data entered. If result of the test shows success, then the data is correct and if result of the test is invalid credentials, the data incorrect. X - Spam for SMTP Servers User Guide 57

58 Splash Screen Enabled Select the link to allow a splash screen to be displayed each time you start the application. Help This menu carries tools that allow you to: run the EICAR virus test mail, access the meticulous on-line help, enter the license key and change the password. This section provides information about the following topics: X-Spam Help License Information Change Password Check RBL About us X-Spam Help MicroWorld has provided an on-line help with the software. All features and menus are documented in the file. Select the menu to view the help file shown below X-Spam help There are three tab pages. Topics are displayed in the Contents tab page. Click on the icon. It expands and changes to. Individual topics in the books are displayed. A separate window for the topic is displayed. X - Spam for SMTP Servers User Guide 58

59 The Index tab page carries a list of all key words. Select the key word or type the phrase in the field and choose Display. Relevant topics are displayed in a pop up. License Information License key allows you to use the software for the duration set by MicroWorld. If you are using an evaluation version of the software, then the key is mandatory to run the application beyond the period. To obtain your License key, please contact sales@mwti.net. Change Password MicroWorld recommends that you change your password often. In the Help menu, select Change Password. Enter relevant information in the following dialog box. You must have the old password, to enter the new one. Select OK Change Password Check RBL Clicking on this link opens up You can check the RBL list here and validate domains and IPs. X - Spam for SMTP Servers User Guide 59

60 About Us Shows contact information about X-Spam for SMTP Server. SMTP Administrator Gateway Configuration You can configure inbound and outbound mails based on various parameters like users, domains and Ports. The option enables you to specify allowed domains, their IP address and the Port number. To Launch Gateway Configuration Right click on the dispatcher to get a pop up as below Select SMTP Administrator. Figure 5.1 Gateway Configuration configure settings as explained in the following table. X - Spam for SMTP Servers User Guide 60

61 General Configuration This frame allows you to specify settings for general configuration. Incoming Enabled Outgoing Enabled List of Local Domains SMTP is allowed to receive mails, if the check box is selected. SMTP is allowed to send mails, if the check box is selected. The frame allows you to specify local domain names for the MailServer. Enter the local domain name in the top field and select Add. The Edit Local Domain to IP Mapping box is displayed. Configuration for Inbound Mails: The frame allows you to specify domains, whose mails are allowed entry, its IP address and the port number. Mails can be received from local domain. To Add a local domain: Click in the fields and enter valid values for Mails for Local Domains, Forward to host (TCP-IP Address) and Port. Select Add button. Mails for Local Domains Forward to Host (TCP-IP Address) Port Display Box Enter the local domain names, managed by the SMTP Server. Enter IP address of Remote SMTP server. Local domains connect to the SMTP server through this IP. Enter port number used to connect to the SMTP server by the local domains. List box displays local domains names, SMTP server IP address they connect to and the port number. Double click in the list box to view a dialog box that allows you to enter values, which are displayed in this list box. Meanings of fields are given below: Local Domain Name of local domain is displayed. => Symbol shows that the local domain maps to the SMTP Server IP address, shown in the next field. SMTP Server IP Address Displays Remote SMTP Server IP. Mails to the local domain are sent to this IP address of SMTP server. Port Displays port number Authentication Displays flag for authentication to gain access. Number 1 means that authentication is enabled and Number 0 means that authentication is not enabled. User Name Name of user accessing SMTP server Password Displays password to gain access. X - Spam for SMTP Servers User Guide 61

62 Double click in the display box to view Edit Local Domain to IP Mapping. Enter values in the fields. Meanings of fields have been explained in the previous table. Flush DNS Select the button to flush dynamically resolved connections to the remote SMTP Servers. When a mail is sent to other domains, the SMTP server finds information like IP and Port numbers of the remote domains. These are stored in the registry before mails are sent. Configuration for Outbound Mails: Reject unauthorized relaying DNS Server IP Address Allow Relay from ONLY from User/IP Select the check box to prevent SMTP server from relaying mails other than those listed in the relay list. This enables you to block relay spamming. When mails are sent to Internet, SMTP server needs to find IP of domain. connect to a DNS server and find information about the domains. Display box shows a list of all DNS server IPs, selected for query. Enter the DNS server IP in the field, to which the SMTP server directs queries. Select Add. The name is displayed in the display box. This field allows you to specify a names or IP of users and domains that are allowed to relay mails through your SMTP server.list box displays names. To add a name: Enter value in the field and select Add. X - Spam for SMTP Servers User Guide 62

63 User and Mail Restrictions Figure 5.5 User and mail Restrictions You can specify those IDs in your network that need to be blocked from receiving or sending s via the Internet. You can also set mail size restrictions and mail parking time. Mail Parking allows users to stop a mail from being delivered, if it s been sent by accident or in case the sender has a change of mind. It can also used to ensure that mails that are large in size are scheduled to be sent when the usage of Internet bandwidth is at the lowest. Internet The tab page allows you to specify s IDs in your network that should be stopped from receiving or sending s through the Internet. Other features available in the screen include: setting size restriction for s, mail parking - where you set the mail parking time and size for s that need to be parked and mail delay - where you set the delay time after which s are forwarded. Do not allow the following users to send mails to the Internet Frame allows you to stop a user from sending s through Internet. Enter s IDs of users who should not be allowed to send s to the Internet, in the top field and select Add. The ID is displayed in the display box. To remove the name from the list, click on the name and select Delete. X - Spam for SMTP Servers User Guide 63

64 Do not allow the following users to receive mails from the Internet Enable Mail Size Restriction Local to Internet Frame allows you to stop a user from receiving s through Internet. Enter s Ids of users who should not be allowed to send s to the Internet, in the top field and select Add. The ID is displayed in the display box. To remove the name from the list, click on the name and select Delete. Select the checkbox to allow size restriction for s sent or received in your network. Other fields in the frame are enabled only if the check box is selected. Select the check box to restrict size of s sent from your local domain to the Internet. Click to open the Individual Size Restriction box. This box allows you to restrict mail size of specific users. To add IDs, click Add and enter ID of the user in the Addition / Modification box. Set the max mail size that the user can send and select OK. In the Internet tab, in the adjacent spin box set the maximum size in Kb of the that can be allowed. Default value Zero, signifies that there is no restriction for size. Internet to Local Local to Local Select the check box to restrict size of s sent from the Internet to your local domain. Click to open the Individual Size Restriction box. This box allows you to restrict mail size of specific users. To add IDs, click Add and enter ID of the user in the Addition / Modification box. Set the max mail size that the user can send and select OK. In the Internet tab, in the adjacent spin box set the maximum size in Kb of the that can be allowed. Default value Zero, signifies that there is no restriction for size. Select the check box to restrict size of s sent from Local to Local domain. Click to open the Individual Size Restriction box. This box allows you to restrict mail size of specific users. To add IDs, click Add and enter ID of the user in the Addition / Modification box. Set the max mail size that the user can send and select OK. In the Internet tab, in the adjacent spin box set the maximum size in Kb of the that can be allowed. Default value Zero, signifies that there is no restriction for size. X - Spam for SMTP Servers User Guide 64

65 Mail Parking Select the button to view Mail Parking & Delay for Outbound Mails dialog box. The box allows you to select the size of s that should be parked or delayed and set the time duration for this action. There are two frames: Mail Parking and Mail Delay. Mail Parking The feature allows you to define settings for Mail Parking. Enable Mail Parking: Select the check box to allow mail parking in your mail server. Other fields in this frame are enabled only if the check box is selected. Mail Delay The feature allows you to set the Mail Delay time before is forwarded. Enable Mail Delay: Select the check box to allow mail to be delayed before they are forwarded. Other fields in this frame are enabled only if the check box is selected. Mails above size: Set the size of s that should be parked. Select the size in Kb from the spin box. All s, greater than the selected size will be parked. Send after time: Spin box allows you to set the time in hours and minutes for mail parking. Send outgoing mails after delay: Spin box allows you to set the mail delay time in minutes. Above options applicable for High-Priority s: Select the check box to apply above settings for s classified as high priority. Restriction From Users The tab allows you to specify s IDs or Hosts IP of users whose mails can be allowed or blocked to the SMTP Server. X - Spam for SMTP Servers User Guide 65

66 Figure 5.4 Set Restriction settings Do not accept mails for following Host/Users Accept mails ONLY for following IP/Host/Users Frame allows you to specify IP/Host or user s IDs whose s need to be blocked. Enter IP or s Ids of users in the top field and select Add. The IP/ID is displayed in the display box. To remove the name from the list, click on the name and select Delete. Frame allows you to specify IP/Host or user s IDs whose s are allowed. Enter IP or s Ids of users in the top field and select Add. The IP/ID is displayed in the display box. To remove the name from the list, click on the name and select Delete. Restriction To Users The tab allows you to specify s IDs or Hosts IP of users whose mails can be allowed or blocked. X - Spam for SMTP Servers User Guide 66

67 Figure 5.5 Set Restriction settings Do not accept mails for following Host/Users Accept mails ONLY for following Host/Users Frame allows you to specify IP/Host or user s IDs whose s need to be blocked. Enter IP or s Ids of users in the top field and select Add. The IP/ID is displayed in the display box. To remove the name from the list, click on the name and select Delete. Frame allows you to specify IP/Host or user s IDs whose s are allowed. Enter IP or s Ids of users in the top field and select Add. The IP/ID is displayed in the display box. To remove the name from the list, click on the name and select Delete. Spam Control X-Spam performs its first level of Spam Control at the SMTP level, based on internationally acknowledged lists of known spammers. Two such standards are RBL and DUL. Realtime Blackhole List (RBL) Organizations like MAPS (Mail Abuse Prevention System) provide a list of IP addresses of known Spammers, known as Realtime Blackhole List. When a suspicious client requests access to the SMTP server, you can send the IP address to the MAPS list, which returns the request after verifying the authenticity. Dial_Up Users List (DUL) Many spammers use a Dial-Up service to send Spam. IP addresses appearing in Dial_Up Users List are immediately blocked by X-Spam. X - Spam for SMTP Servers User Guide 67

68 Tab page allows you to configure settings that provide protection against Spam. Spammers can use your SMTP Server to launch Spam attacks. Checks can be run to verify if the user who requests access is listed in the Realtime Blackhole List and the Dial Up User list. Figure 5..6 Spam Control Check if Sender Domain is valid before accepting Select the check box to verify if the sender domain is valid, before accepting . Check A-Record: Checks all A type of records. Check MX-Record: Checks MX type of records. Check both A and MX-Records: Checks both types. Realtime Blackhole List (RBL) Organizations like MAPS (Mail Abuse Prevention System) provide a list of IP addresses that are known Spammers. This list is called Realtime Blackhole list. When a suspicious client requests access to the SMTP Server, you can send the IP address to the MAPS list, which returns the request after verifying the authenticity. Select the check box to check with the RBL and verify if the sender domain is valid, before accepting . A list of addresses which carry details of known Spammers is displayed. Enter the suffix to add to the IP address for queries and click Add. Dial_Up Users List (DUL) Spammers use a dial up service to send Spam. Organizations maintain a list of known Spammers. A list of addresses which carry details of known Spammers is displayed. Enter the suffix to add to the IP address for queries and click Add. Refer DUL. X - Spam for SMTP Servers User Guide 68

69 Do reverse DNS on connecting IP Check if HELO/EHELO domain matches connecting IP Check if Mail FROM domain matches connecting IP When other users try to connect to your server, you can run a reverse DNS to verify their IP. This is a request made to the SMTP server by a client. This allows SMTP Server and its client to verify each other s authenticity. The request from the client is in the form of a parameter with the clients name or IP address. Spammers send mails through another IP. This check verifies if the IP in the from field is the same as the connecting IP. User based Rule Sets User based Rule Sets allow you to send a copy of mails received from a user or domain to another ID or domain and specify the route or IP address to be used in sending the copy. Similar rules can be set for sent mails as well. Option is available to send an acknowledgment to users when mails are delivered or the SMTP Server fails to deliver the message. Mails from User Tab page allows you to send a copy of mails received from a user or domain to an ID or domain. You can also specify the route or IP address used to send the copy. Figure 5.7 Mails from User X - Spam for SMTP Servers User Guide 69

70 Mails from Users/Domain Send Copy To Mails from Users/Domain Route To Field allows you to enter user ID or domain, copy of mails received from them should be sent to another user or domain. Enter ID or domain IP to which copy of s are sent. Field allows you to enter user ID or domain, mails received from them are routed through the domain. Enter domain IP through which s are routed. Mails to User Tab page allows you to send a copy of mails sent to a user or domain to an ID or domain. You can also specify the route or IP address used to send the copy. Mails To Users/Domain Send Copy To Mails To Users/Domain Route To Field allows you to enter user ID or domain, copy of mails received by them, should be sent to another user or domain. Enter ID or domain IP to which copy of s are sent. Field allows you to enter user ID or domain, mails received by them are routed through the domain. Enter domain IP through which s are routed. Acknowledgement & Routing by Users Tab allows you to configure settings that send an acknowledgment to users when mails are delivered or the SMTP Server fails to deliver the message. X - Spam for SMTP Servers User Guide 70

71 Send Acknowledgment Acknowledgment for Non Local User Do Not Send Acknowledgement for the following user Enable Routing by User Figure 5.9 Acknowledgment and Routing by Users Select the check box, to send acknowledgment to users. The acknowledgement is sent when messages are delivered. To activate this check box, User should select Send Acknowledgment check box Select the check box, to send acknowledgment to non-local users who request access from another domain. The acknowledgement is sent when messages are delivered. List box displays the list of users exempted from receiving an acknowledgement. This field becomes active only if user has selected Send acknowledgment check box Select the check box to enable routing of mail by users. Display box lists all s IDs, their IP and port number of users that are allowed to use the routing feature.. Address: Enter ID of user who is allowed to route mails. IP: Enter IP address used for routing. Port: Enter port number used for routing.. X - Spam for SMTP Servers User Guide 71

72 Authentication Authentication is usually done only for mails with local sender ids and the ones whose To address is foreign. If authentication is enabled, relaying is disabled automatically. Using the authentication option, the Server can authenticate a client and permit the client to confirm if the SMTP Server is genuine or not. This will help the administrator curb opportunities for mail abuse and will enable to identify and block Spammers. Related topics Authentication Figure 5.10 Authentication Allow Client for Authentication Enable Proxy Authetication Enable Force Authentication Select the check box to allow client s authentication. If Allow Client For Authentication is set, then on EHLO, AUTH=LOGIN and AUTH LOGIN are sent to client. If "Enable Proxy Auth" (ProxyAuth=1) is set, then on getting auth login, a direct connection is made to the primary domains mail server and the connection authenticated. If ProxyAuth is not set, then authentication is done using the username/password put in the available user list If this is set, you have to add the list of client IPs which are forced to authenticate for every connection. X - Spam for SMTP Servers User Guide 72

73 Enable Proxy user verification Enable Proxy User Verification is done in order to verify that the local users are indeed present in the main server. This way, if the main SMTP server does not accept the mail from or rcpt to, the incoming connection is terminated Authentication IP Enter client the IP that needs to be authenticated. User can add/delete I.P that needs to be authenticated. Available User List User Name Password Import Use this Account as an Authentication User list can be used for authetication purpose. 0 means disabled and cant used for authentication where 1 is active account.display box lists all authenticated users, allowed access to the SMTP Server. User name and password are displayed. Process of adding users is explained in the next two fields. Enter user name in this field. The name is displayed in the Available User List. Enter password for user name, in this field. The password is displayed in the Available User List. This feature is useful when you add new users. Individual users first time login using the password you have assigned which can be changed later. Allows you to import a list of users from the earlier installation. Names are displayed in the list box. The first set of values have a suffix 1. In the display box, click the account to be used for authentication and select the check box. Server Settings Server Settings has five modules as given below, SMTP Settings This feature allows you to configure SMTP Settings for incoming and outgoing s. You can assign the maximum number of incoming threads, apply restrictions on the type of connections based on their sources and set retry levels for undelivered mails. X - Spam for SMTP Servers User Guide 73

74 Figure 5.11 SMTP Settings SMTP Incoming: The Frame allows you to configure settings for SMTP incoming mails. Maximum Incoming Threads SMTP Server to Listen on Port : Defines number of simultaneous incoming connections from remote SMTP Server. Default value is set at 32. Use the spin button to increase or decrease incoming connections. Number of connections allowed depends on machine configuration. Enter port number of SMTP through which all mails are received. Allow Connections coming in on any interface Bind To IP A PC may have multiple IPs with a single network card or multiple IPs with multiple network cards. Select the radio button to allow any IP to interact with the remote SMTP Server. Select the radio button to bind an IP to the SMTP Server. Drop-down list box allows you to select an IP. Fields Allow Connections coming in on any interface and Bind To IP are mutually exclusive. SMTP Outgoing: The Frame allows you to configure settings for SMTP outgoing mails. Maximum outgoing Threads Send EHLO Defines number of simultaneous outgoing connections from remote SMTP Server. Default value is set at 32. Use the spin button to increase or decrease outgoing connections. Number of connections allowed depends on machine configuration. EHLO in Simple Authentication Security Layer (SASL) responds with a list of SMTP extensions that it supports. This allows SMTP server to authenticate a client. X - Spam for SMTP Servers User Guide 74

75 Retry Delays In Minutes While sending mails, if the connection is not successful, the SMTP Server retries to send mail as per the time interval in minutes, displayed in the display box. Display box shows the retry levels. Warning When Entering Level When SMTP Server shifts to the next retry level to send queued mails, a Warning is sent informing system administrators about it. SMTP Controls In SMTP control settings, you can specify that s should be sent line-by-line to retain the best accuracy in forwarded mails. You can also select the data size at which the progress bar for outgoing or incoming mails is refreshed. Figure 5.12 SMTP Controls Send Mail Line By Line Show Progress After Byte Select the check box to send s line-by-line. This ensures that the best accuracy is retained in the forwarded s but time taken is more. If the check box is not selected, then the data is sent in packets. Spin button allows you to select size in Kb after which the progress bar for outgoing or incoming mails is refreshed. X - Spam for SMTP Servers User Guide 75

76 RCPT Limit Tarpit Count Tarpit Delay No. of Connections Per IP Extra Char in id Set the RCPT Limit using the spin button. Zero value means that there is no limit. SMTP Tarpit slows down the SMTP server as the number of recipient s increases. Also once the number hits a fixed amount (e.g.. 100) it refuses to send the . This prevents local users, using your mail server as an exploder for SPAM. Defines the time of delay in seconds that the SMTP Servers applies, before relaying a mail. Select the number of connections allowed for an IP, using the spin button. The default value is 0. Mails that have any of these characters in the To address are rejected outright by the Server. This feature helps to fight Spam. ETRN Settings The ETRN Settings tab allows you to set the delay in minutes of mail relay for a specific domain. Figure 5.13 ETRN settings X - Spam for SMTP Servers User Guide 76

77 Substitute Domains The screen allows you to substitute a domain with another domain. This is used when you wish to redirect mails from one domain to another domain, especially when the current domain becomes invalid or needs to be replaced. Figure 5.14 Substitute Domains Available Domain List Domain Name Replace To Display box shows a list of source and replaced domain names. For e.g... virusinfo.com, latestvaccine.com means that you have replaced virusinfo.com with latestvaccine.com To substitute a domain name: Enter the domain name to be replaced in the Domain Name field. Next, enter the replacement name in the Replace To field. Select Add. The names appear in the display box. Enter the domain name you wish to replace. Enter domain name you wish to replace with. X - Spam for SMTP Servers User Guide 77

78 Cluster Settings This feature is useful to ISPs or Servers that receive a large number of mails. When a single machine is used to scan all these mails, it will result in huge delays in processing. To overcome this, you can designate other machines in your network to distribute the mails to them for scanning. This method of load balancing is called Clustering. The cluster of machines need not be connected to the Internet but they must have X-Spam for SMTP Server installed in them. They receive mails in their inbox, scan them and store them in their outbox. Figure 5.15 Cluster Settings Clustering Enabled Select the check box to enable clustering options. Fields in this frame are enabled only if the check box is selected. Cluster Input Enter details of input box for the cluster machine. Mails to be scanned mails are stored here. IP No. of Cluster PC Enter IP address of machine used in the cluster. Share Name Directory Name Cluster directory share name that is shared with the primary SMTP Server. Directory name where scanned mails are stored. Select the button to find the shared directory. Cluster Output: Enter details of output box for the cluster. Scanned mails are stored here. IP No. of Cluster Enter IP number of machine used in the cluster. X - Spam for SMTP Servers User Guide 78

79 PC Share Name Directory Name Cluster Pair Cluster directory share name that is shared with the primary SMTP Server. Directory name where scanned mails are stored. Select the button to find the shared directory. Display box shows lists of cluster pairs defined in the above fields. IP Whitelisting Using this feature you can skip RBL look ups for Local IP addresses. It allows you to specify IP addresses of mail senders that you want to exclude from RBL filtering. Figure 5.16 IP White listing POP3 Configuration POP3 is an electronic mail protocol used to retrieve messages stored on an Internet server. POP3 is a 'pull' protocol. Whenever a client wants to check for messages, it connects to its ISP and uses POP3 to login to its mailbox and 'pull' down its messages. X-Spam POP3 can work as a POP3 client on behalf of all your users. Every user in the organization is assigned their own address (e.g.. user@mwti.net). Each user is also assigned a mailbox or one mailbox is used by the entire organization. At scheduled intervals X-Spam POP3 logs into every mailbox and retrieves waiting messages. It then delivers them to the respective users on your SMTP Server/Gateway. X - Spam for SMTP Servers User Guide 79

80 Topics in POP3 Config This chapter provides details about the following topics: Accounts hosts Config Spam Control Restrictions From Users To launch POP3 Config In the application status bar, right click on the button POP3 Config. Screen in Figure 6.1 is displayed. Figure 6.1 POP3 Config This is the opening screen of POP3 Config. There are five tab pages: Accounts, Hosts, Config, Spam Control and Restrictions From Users. By default the tab page Config is displayed when you launch POP3 Config. The next sections describe in detail about different tasks and how to validate fields. X - Spam for SMTP Servers User Guide 80

81 Accounts Host for the user or mail recipient, resides with an account with your ISP. The tab allows you to assign for the mail recipient, a host, the POP3 account IP and the password. You can also select the method of download, Account, Wildcard or Mutli-POP. To start Configuring Accounts: Enter the Host Name or select host from the drop-down list and click New Account. Other fields in the tab are now enabled. Figure 6.2 POP3 Account New Account Host Name POP Account Password Active of Account Recipient Address (forward to) Select the button to configure a new account. Fields in this tab are enabled only if the button is selected. Select the host name from the drop-down list. Enter the POP account IP. Enter password to use the account Select check box to activate the account Enter a brief description of the account. Label of field changes as per selection made in Method field. Recipient Address is displayed when Account is selected in Method field. X - Spam for SMTP Servers User Guide 81

82 Wildcard Domain is displayed when Wildcard is selected in Method field. Multi-POP field name is displayed when Multi-POP is selected in Method field. Method Frame allows you to select the download method. Select the appropriate radio button: Account: Downloads mails for an account Wildcard: Allows a single account to download for multiple users. Priority Assign a priority for mail download. Largest Messages: Largest message is downloaded first. Feature is disabled. Smallest Messages: Smallest message is downloaded first. None: Messages are downloaded in the order they are stored. Remove After Max Msg Size Delete Account Save Account Set number of days to retain a mail in the SMTP Server by using the spin button. The mail is automatically purged from the server after the selected days. Set maximum size in kilobytes, of a message allowed in the server. Delete an account displayed in the list box. Save account information you have entered. Hosts You networks s are stored in a POP3 mailbox with your ISP. You can configure the host IP (user) for whom the mails are downloaded. X - Spam for SMTP Servers User Guide 82

83 Figure 6.3 POP3 Host New Host Host Active Host Name/IP Port Save Account Delete Account Select the button to configure a new host. Fields are enabled only when the button is selected. Select the check box to activate the host. The host will receive mails as they are downloaded. Enter host name or its IP address. Enter port number of the host. Mails are downloaded through this port. Saves information you have entered. Select host from the list and click the button to delete a host. X - Spam for SMTP Servers User Guide 83

84 Config Figure 6.4 POP3 Configuration Tab allows you to enable the POP3 Downloader and start downloading mails. Features in the screen allow you to block IDs of Spammers and Spam mail subject lines. The fields display values you have provided during installation or while navigating other menus. POP Download Active Wildcard Priority Start with Hidden Mode MS SMTP Path Select the check box to allow POP3 Downloader to download mails. Wild card priority allows a single mailbox to collect mails for multi users. Starts POP3 downloader in a hidden mode. Field displays path where the SMTP.ini file of X-Spam for SMTP Server is installed. If the application is installed at another location, enter the path. Select the button to select the folder where the SMTP.ini X- Spam for SMTP of X-Spam for SMTP Server is installed. This Domain Message Path The primary domain name is displayed. You have entered this name during installation Modify if needed. Field displays path and folder where downloaded mails are stored. Modify if needed. X - Spam for SMTP Servers User Guide 84

85 Log Path Archive s s Archive Directory Field displays path and folder where log files of X-Spam activity are stored. Modify if needed. Select the check box to archive s. All s will now be stored in an archive that you select in the next step. Enter the path and folder of the archive location. Select the button to view Select Path selection box. Select the folder and click OK. The folder and its path are displayed in the s Archive Directory field. Debug mode Max download No. of retries Time Out (Min) Download Time Add Mailid to Delete List Debug mode allows details of problems that occur in POP download activity to be displayed in a log file. Select maximum number of messages to download in one session. A session lasts for as long as you are connected to other servers in the Internet. Select the maximum number of times the server should try to download a message, before abandoning the process. This feature allows the SMTP Server to reduce idle time and also allows it to escape from hacking attempts. Select the time out period in minutes using the spin button. SMTP Server breaks the connection with a user if there is no activity or commands during this period. Select the download period in minutes using the spin button. SMTP Server breaks the connection with a user if the message is not downloaded by this time. Select the button to view Add mail-id to Delete List dialog box. The box allows you to create a list of Spammers and other people who abuse mails. Mails from the users are automatically deleted without being downloaded Enter the ID in the top field and select Add. The name is displayed in the list box. X - Spam for SMTP Servers User Guide 85

86 Add Subject to Delete List Save Configuration Select the button to view Add Subject to Delete List dialog box. Spam mails have an enticing subject line like Earn Millions, etc. You can create a list of such subject lines. Mails with a subject line from the list are automatically deleted and not downloaded. Select button to save new values you have entered. Spam Control Figure 6.5 Spam Control X - Spam for SMTP Servers User Guide 86

87 Realtime Blackhole List (RBL) Organizations like MAPS (Mail Abuse Prevention System) provide a list of IP addresses of known Spammers, termed as Realtime Blackhole List. Mails coming from the IP address in the Backlist will be rejected. Only after clicking Realtime Blackhole List checkbox, other fields become active. Suffix to add the IP address for queries Using this field you can add or remove entries in the RBL list. IP addresses of sites that are exempt from Spam Blocker RBL lookups Here you can add the Local IP Addresses in order to white list them. Action You can set the action to be followed once an from an IP listed in RBL is detected. They are, Quarantine the files Delete the file on the Server Add the to Subject and Pass Mail Restrictions from users Figure 6.6 Restrictions from users You can block certain user Ids from sending mails to users. Once such an id is added to the list, s from that id will not be downloaded by the POP3 downloader. X - Spam for SMTP Servers User Guide 87