Protection Blocking. Inspection. Web-Based

Transcription

1 Protection Blocking Inspection Web-Based Anti-Virus & removal of dangerous attachments. Prevent your server from being used as open-relay. Stop mail-loops. Blocks open relay sources. Isolate known spam signatures & domains. Evaluates contents of messages for blocking & non-blocking. Create white-lists of keywords/phrases & values to prevent false-positives. Add your own custom black-list keywords/phrases to work along with system provided dictionaries. Users can logon manually or utilize domain-integrated security to manage isolated messages. Network admins can manage service settings as well as managing isolated messages for entire domain.

2 Table of Contents FEATURES... 3 COMPATIBILITY... 3 HOW IT WORKS... 4 MAIL ROUTING... 4 ANTI-SPAM PROCESS... 5 GENERAL SYSTEM KNOWLEDGE PROCESSING ACTIONS... 5 RECORD LISTINGS... 5 Rows... 5 Columns... 6 Top Area... 6 Bottom Area... 6 Action Icons... 6 COMMONLY CAPTURED KEYSTROKES... 6 PREPARING THE SYSTEM... 7 MX RECORD (MAIL-EXCHANGER)... 7 FIREWALLS... 7 MAIL SERVER... 7 Configuring Exchange... 7 CONNECTING TO THE SYSTEM... 8 MANUAL LOGON... 8 AUTOMATIC LOGON (NOT YET AVAILABLE)... 8 Stand-Alone Website... 9 Integrating with Current Website... 9 MANAGING S IDENTIFYING S Summary Screen Mail Logs Isolation Queues Viewing Messages Query Action Selection Action ANTI-SPAM CONFIGURATION ALLOW FROM SENDER DICTIONARY Wildcards Allow Dictionary Block Dictionary Sperre Technologies, Inc. Page 2 of 14

3 Features Spam-Blocking via database of identified spam signatures. Spam-Blocking via keyword/phrase point value system. Anti-Virus Removal of dangerous attachment types Web-Based Administration Domain Authentication/Identification White-List Dictionary to prevent false-positives Black-List Dictionary Relay Source Blocking Identify Recipient Message Volume No Need to purchase Hardware or Software No "Customer Hostage" scenario. Compatibility Being that the system is a web-based solution, cross-platform & browser compatibility is tested in attempt to function with as many different clients as possible. However, it should be noted that the system is primarily designed to function on the market leading Intel with Microsoft platforms. At the time of this document, it is recommended that a minimum of Internet Explorer 5 or Netscape Navigator 6 be used. The system does pop-up windows of records and details. If you are running a pop-up protection application, this site should be added to a trusted list. Windows XP SP2 s pop-up protection by default does not affect this application since the pop-up windows are within the same site. Sperre Technologies, Inc. Page 3 of 14

4 How It Works Mail Routing By routing mail through our servers, we scan s for spam, virus, and dangerous attachments. After mail is scanned, s that pass our rules are then continued on to your mail server. s that appear to have spam content/signature are then isolated for 7 days. Known spam source domains are discarded and logged. Figure 1 is a simple illustration of the path will take via this service: Figure 1 Figure 2 is a more advanced illustration of how the service will function: 1 DNS Server Internet Anti-Spam Web-Interface 5 Figure 2 Computer User Customer Mail Server 1. Sender Server checks DNS server for MX record which points to our Anti-Spam Service: n1.as.sperretech.com ( ) 2. Sender Server sends to Anti-Spam Server Farm. 3. s that pass the rules are passed firewall s Name or IP. Be sure to allow TCP25 from the network: /27 (NETWORK: MASK: ) 4. Customer Firewall continues communication to server who needs to be configured to allow relay from the network: /27 (NETWORK: MASK: ) 5. End user receives User connects to the Anti-Spam Service Web Interface to check for any isolated messages that need to be received. 7. Anti-Spam Service Web Interface communicates with Anti-Spam Server Farm for mail logs & isolated message information. Sperre Technologies, Inc. Page 4 of 14

5 Anti-Spam Process The order in which mail is processed by the system. With the exception of Anti-Virus & Attachment Stripping, the message is checked against Allow dictionary before the blocking dictionaries. Some of the steps can be configured as optional components of the process. The process order is as follows: 1. Mail Loop Check System checks to see if message is looping between our server and the sending server. Detects if same message is bouncing more than 5 times. 2. Discard To Permanently deletes sent to particular user address 3. Discard From Permanently deletes from a particular address or domain. 4. Anti-Virus System scans for virus 5. Attachment Protection Strips off attachments identified as dangerous (EXE, COM, VBS, etc) 6. Allow To Always Allows the message to bypass spam filtering by address. 7. Extreme Abuse Discard (Optional) When score exceeds 2000 message is permanently deleted. 8. Check Allow Dictionary 9. Check Allow From address/domain 10. Anti-Spam Dictionary Check 11. URL Check (Optional) Isolate based on identified URLs in s 12. Foreign Check (Optional) Checks message on a reduced dictionary scoring of 50 points if message is from a foreign domain suffix (.ru,.ch,.fr,.uk). 13. Invalid Format Checks if message conforms to standards. 14. Message released of passes all rules. General System Knowledge Processing Actions The following terms define the action the system or user takes on an ALLOWED Passed all system rules and passed on the server. RELEASED Isolated passed on to server from Isolation. ISOLATED Blocked due to content/source/virus held in Isolation or 7 days. DELETED Isolated permanently removed from Isolation. DISCARDED System deleted due to extreme content limit or source. Record Listings Most lists & queries will have the same look and feel to them. Most records are displayed in a listing with actions being taken from these screens. When the number of pages exceeds 1, a page navigation element is displayed (1 st Page, Next, Previous, Last Page). You can navigate through the pages of record by clicking on the appropriate arrows or pressing Home, PGUP, UPDN, or the END keys. Should you find that the keys are not working, be sure to click in any open space in the list frame. Figure 3 The above shows a typical record listing. In this case, this is the view of an Isolation Queue listing as it provides the most options. Some items in this listing may not be available on other record listings. Rows From a top-down perspective, a definition of the row is as follows: Top Area Typical record action buttons as well as page navigation. 1 st row Column headings as well as the option for setting list properties. 2 nd row Sorting row with the icon being used to reset the sort order. Sperre Technologies, Inc. Page 5 of 14

6 Columns 3 rd row Query (filter) row. Record Listing Area Record details & actions. Bottom Area Complete record action buttons as well as page navigation. Anti-Spam Documentation From a Left to Right perspective, a definition of the columns is as follows: 1 st column Selection boxes to perform Selection Action on one or more records. The top-most checkbox in the Query row selects/unselects all displayed records. 2 nd column Record action buttons. In Figure 3, the only option is View record. Remaining columns These are the record field details. You can customize what columns are displayed by clicking on the list properties option. Top Area Bottom Area Action Icons Starts with the paging key (1 st Page/Previous Page, Next Page, Last Page) illustrating the current shown page out of the number of pages available. Display [XX] of XX Records allows you to change the number of records displayed per page as well as informing you of the total number of records available based on the query. Customer drop-down available to Resellers to view records of their subscribed customers. Starts with the paging key & record count. (See Top Area for definition) Query Action Release/Delete/Export ALL records available based on shown record count. Selection Action - Release/Delete/Export records with checkboxes selected. Commonly Captured Keystrokes View Record Edit Record Delete Record Release Message Since web-sites are generally click based, special JavaScript code needs to be incorporated to capture and act upon keystrokes. Some generally common keystrokes are: ESCAPE Closes any active detail window. (pop-up) HOME Navigate to first page of a record listing. END Navigate to the last page of a record listing. PGUP Navigate to the previous page of a record listing. PGDN Navigate to the next page of a record listing. Sperre Technologies, Inc. Page 6 of 14

7 Preparing the System MX records need to be modified for mail routing and firewalls & servers need to be configured to accept message from Anti-Spam Service Servers. Since this system is offered as an Internet service (ASP-Application Service Provider), some of the settings resolve around getting your clients connected to the system with the least interaction on their part for seamless service. MX Record (Mail-Exchanger) You will need to modify your domain MX records in DNS to point to the Anti-Spam Servers. Configure your MX record with a weight of 10 to point to n1.as.sperretech.com ( ). At the time of this documentation, there is only 1 receiving address. Expansion may be added in the future; however, the current model does not call for secondary MX records. The reason for this is that load balancing is actually done from the firewall. Our firewall receives the message and evenly distributes the processing messages to the anti-spam server farm. This is illustrated in Figure 1. The following are advantages to this model: o Load balancing is evenly controlled for optimal performance. o No Secondary MX Reason 1: Some spammers send to highest MX record. (This is why you should NEVER put a safe-guard MX20 to bypass our service. They will bypass the MX10 that directs to our service and go straight for your non-protected MX record.) o No Secondary MX Reason 2: Some spammers will send the message to all MX records hoping you have one that bypasses virus/spam filters. Firewalls If you are running a firewall, you need to configure it to allow TCP port 25 originating from /27 (NETWORK: MASK: ). In many cases, it s suggested that you configure the firewall to allow ONLY from our server IP(s). Mail Server You will need to configure your server accept relay from our server IP(s). This is because the is not appearing to originate from its original source. All mail to your domain will be routed from our server(s). Because of this, you can configure your server to only accept from our IP(s) to prevent your server from becoming a relay-host. If requested, our service can be configured to provide a username & password to authenticate our relaying. Configuring Exchange To configure an Exchange server to accept relay from our anti-spam servers, you will need to perform the following: Open the Exchange System Manager and expand the tree as shown in Figure 4. Right-click on the Default SMTP Virtual Server and select Properties. Figure 4 In the Default SMTP Virtual Server Properties, click the Relay button. In the Relay Restrictions window (Figure 5), add that you will accept relay from NETWORK: SUBNET MASK: Sperre Technologies, Inc. Page 7 of 14

8 Figure 5 Connecting to the System This system provides for many different methods of logon to suit your environment and the users you are supporting. These different means of logging on are meant to make connecting and checking isolation queues as easy as possible for your users. As you configure each of the logon configurations, keep in mind that all logon methods are available at the same time allowing you to support users who may not be able to take advantage of certain automated methods. Manual Logon The most basic connection is the manual logon. Without any configuration, the customer is prompted for an Address and Password. This is also the method of logon a user will be reverted to if all methods of detection fail. In a properly configured and controlled environment, this method of logon will not be seen by customers unless the select Switch User from the Log Off menu which triggers the manual logon screen. If it is a user s first time connecting to the system, and the system can find that it has received from the entered address, they will receive the following prompt: The system will generate a random password and it to the user; thereby, authenticating them as the legitimate recipient of that address. Should a user forget their password, they can click the Forgot Password link and upon entering their address, the password will be ed to them. Automatic Logon (NOT YET AVAILABLE) Having your clients log onto the system automatically is primarily for use with clients on your internal network. It requires the use of the script, AutoLogon.asp, available for download in Logon & Registration Settings. This script will retrieve the client s network username and append your domain. Sperre Technologies, Inc. Page 8 of 14

9 This script needs to be hosted on a NT Server running IIS 4.0 or later on a NT/2000/2003 domain. Any of the following methods will make connecting to this service easy and without much user interaction. An optimal environment will utilize both the Stand-Alone and Integrated website methods explained below. Stand-Alone Website You can redirect clients who type simple words in their browser by combining the configuration of a website and DNS. The following instructions illustrate how to configure an environment where a user merely needs to type help or support in their browser and instantly be connected to the HelpDesk System to request support. Create a website in IIS that answers to a static/reserved IP address. ( in this example) Under the Documents tab in the website properties, add index.asp as a default document. Under the Directory Security tab in the properties of the website, disable Anonymous connections and enable Digest and/or Integrated Windows Authentication. Place the AutoLogon.asp script in the root of the website and rename it to index.asp. Edit index.asp and enter your domain (company.com) where it says, CustDom = CUSTOMERDOMAIN. Add entries in your DNS server for AntiSpam, Anti-Spam, and/or Spam which will point to the address of the website. ( in this example) Change the NTFS permissions of the home directory to allow only READ access to the NT domain group who will be permitted to connect to the system. You can use Domain Users if you want all users to be permitted to use the ticket system or create a group of accounts who will be permitted. Remember, with IIS, the group must be given Log On Locally permissions. When the user types antispam in their browser, DNS will give them the IP of the website to which they will proceed to connect to. Since the website does not allow anonymous access, it will want to authenticate the user. On NT 4.0 networks, the user will be prompted for a username & password while on a 2000 Active Directory network with IIS5.0 or later the website may, if all is configured properly, be able to use the username of the client logged on to the machine. Once authenticated, the script will kick in removing the domain from the username and detecting the clients IP address and determining if it knows of a location with that IP range. After all data is collected, the script will forward the user to the Anti-Spam System automatically logging them on and creating the account if it is their first time connecting. Integrating with Current Website If the website already requires and uses NT authentication, the concepts in the Stand Alone Website instructions can be used. Instead of the DNS and separate website, you can just add a link to the script file and achieve the same results. If the existing website does not use NT authentication, you can create a virtual directory with non-inherited website security & NTFS permissions. This is very similar to the Stand-Alone Website instructions without the DNS entries. If you intend on make both the Stand-Alone Website and a link on your website available to your users, you may as well just have the link direct the users to the same website your DNS entries will be directing users to. Custom logon screens can be created allowing you to truly make this system a visual part of your network and website s design. Creating this independent logon will require modification to the AutoLogon.asp script as shown in the directions below: Open the AutoLogon.asp file for editing. Place your domain in the appropriate setting Replace the line Username = LogonUsername() with Username = Request.QueryString( U ) If desired, modify the DestWin setting to have the redirection to the Anti-Spam System overwrite the whole browser window, stay in the same frame, or open in a new window. Save & Close file. Create your custom form on your site having it do a GET to the script file and having the username field be called U. Password checking will NOT be done via this custom logon screen method! Therefore, it is recommended that you verify the username and password through some other means, or just operate on the honor system. Keep in mind that the AutoLogon script file is designed to be used with NT/2000/2003 domain level security. Because of this, the system will assume any user who connects via the AutoLogon script is legitimate. Sperre Technologies, Inc. Page 9 of 14

10 Managing s Identifying s Summary Screen The initial screen provides statistics on the logged on individuals activity and domain-wide statistics if user is classified as an administrator. Typical User Summary: Administrator Summary: Mail Logs Figure 3 The Mail Logs screen as seen in Figure 3 provides a complete list of all s processed. No action can be taken on items listed here as it is merely a list of the processing logs. Viewing an item from this list will only provide additional details about the entry beyond the columns being viewed. See Record Listings for usage details. Standard users will only see My Mail Logs in the menu allowing them to view the only s processed for their address and aliases. Users with Mail Manage rights can view logs for all users in the domain. Reseller users with Mail Manage rights can view the logs of customers. The list can contain s from not only their domain, but all customer domains and can be filtered by customer with the customer drop-down on the top row of the listing. Sperre Technologies, Inc. Page 10 of 14

11 This is primarily useful in diagnosing issues or lost messages since it will show ALL s processed and the action the system took on it. See Processing Actions for more details. Isolation Queues Standard users will only see My Isolation Queue in the menu allowing them to view, release, and delete s isolated for their address and aliases. Users with Mail Manage rights can view, release, and delete s for all users in the domain. Reseller users with Mail Manage rights can view and perform actions on customer e- mails. The list can contain s from not only their domain, but all customer domains and can be filtered by customer with the customer drop-down on the top row of the listing. The (FP) in the menu is for a False-Positive listing of the Isolation Queue. This will list isolated messages with the following characteristics: Time Received between 6AM and 11:59PM Dictionary Score is greater than 0 (0 score is domain or signature-based block) Dictionary Score is less than Isolation Break-Point (the score that blocks the message) Does not contain a virus Figure 6 The Isolation Queue as seen in Figure 6 provides a listing of s identified as spam or virus infected. Virus infected s are identified by a. The items listed here are held on the server for a 7 day period. You can customize what columns are displayed by clicking on the list properties option. The following columns are available for this view: Address (Recipient) The individual the message was sent to. Date Time When the message was received by the system. Sender Source address of the message. When Shorten Long Values is selected in list properties, only the last 25 characters are displayed in italics. If you hold the mouse over this cell, it will pop-up the entire contents of the field. Subject Single line description of the as specified by the sender. When Shorten Long Values is selected in list properties, any subject longer than 30 characters is truncated after the 30 th character from the left and displayed in italics. If you hold the mouse over this cell, it will pop-up the entire contents of the field. Dictionary Score Tally of the words that isolated the message. NOTE: When the score is 0, this means the message was isolated by known spam source domain/address or a spam-snapshot which identifies the items as spam without content checking. Size Total bytes of message including header, body, and attachments. Action What was done with the message. In the Isolation Queue, this column is almost always Isolate. Viewing Messages To view an isolated message, you can either click on the This will open a window as seen in Figure 7. action button or double-click on the row of the item. Sperre Technologies, Inc. Page 11 of 14

12 Figure 7 The top area of the message view window contains information about the message including Recipient, Sender, Subject, Date, Size, and Dictionary Score. The second area is the action row. From the action row you can perform the following: View Code The initial view of the message contents. This displays all the header information, body contents, and attachment binary. View HTML If HTML code is found in the message, this option will appear. By clicking this option, the body will be displayed in the HTML format that would be seen in your client. Download Allows you to download the message to file. Release Sends from the isolation queue to the recipient. Release Copy Same as Release; but, does not remove it from the isolation queue. Delete Permanently removes the item from the isolation queue. Set Sender This allows you to tell the system to always allow s from either the sender s address (user@company.com) or the sender s domain (@company.com). User must have Allow Domains rights. Close Closes the view message window. Query Action When utilizing the Query Row, you can filter the listing by column contents. For example, in Figure 8, the Address (Recipient) was filtered for z28* and the subject filtered for *free*. The query uses typical wild-cards like in DOS (* = anything;? = any character). Figure 8 After executing a query, you can select from the lower-right of the screen the Query Action drop-down list. From this list you can Release, Release Copy, Delete, and Export all the messages found by the query. This is not limited to the visual page. Selection Action By placing checkmarks in the left-most columns checkboxes, you can perform actions on a select few messages. To select all of the visible message, check the checkbox to the left of the Query button. The Selection Action drop-down, located at the lower-right of the screen, gives you the option to Release, Release Copy, Delete, or Export the presently select messages. Sperre Technologies, Inc. Page 12 of 14

13 Anti-Spam Configuration Allow From Sender Adding Senders (domains & addresses) to the system will prevent known valid sources that may send questionable content messages from being blocked. From the Allow From Sender screen, you will have a Customer drop-down if you are a reseller. This allows you to view and manage your customer s sender lists. The Address Type drop-down allows you to break down the list by full addresses or domains. When adding a domain, do not include symbol. The system reads addresses from right to left and is effective as in the following example: senddom.com a.senddom.com senddom.com a.senddom.com user@senddom.com user@a.senddom.com a.senddom.com user@a.senddom.com Senders can also be added from the Message View window using the Set Sender drop-down. Dictionary The dictionary is a database of words & phrases that are used to either identify an as to be allowed (white-list) or isolated (black-list). The words are assigned point values that are added up by the system reading the . This includes the header and body of the . The following is an example of how this works using a sample dictionary table: WORD VALUE Free 25 Come to our website 10 Viagra 75 Limited time offer 25 Body: Come to our website for a limited time offer of free Viagra. Score: = 135 Results: Message was blocked because score was greater than configured limit of 100 points. Wildcards The dictionary supports wildcards to assist in beating spammers and create words/phrases that are more diverse. The primary * and? are supported as used in DOS. The system also provides additional wildcards as well. Wildcards are as follows: Allow Dictionary * All preceding or following characters.? Any single character # Any number ^ One or more white-spaces Also, referred to as a White-List. Provides a database of words & phrases to classify an as good; so as not to be blocked. The concept of this is that it is better to receive hundreds of spam that say computer quote, than to block a potential computer sale. There is a system included white-list to work with your managed dictionary. Good items to put in this dictionary are: Full Street Address (Score: 50) Phone Number (Score: 25) Fully Written Company Name (Score: 75) Part Number Sequence {FRN####} (Score: 20) Service/Product/Material Descriptions Copyright phrases Disclosure phrases Sperre Technologies, Inc. Page 13 of 14

14 System Generated content lines 3-Part phrases - 3 lines from common at 34 score each means all 3 must be present to be accepted. Block Dictionary Also, referred to as a Black-List. Provides a database of words & phrases to classify an as spam. This list works along with the system maintained block dictionaries, some of which are viewable by clicking on the View System Dictionaries link in the upper-right of the Dictionaries screen. Any words added to your block dictionary that also exist in the system dictionary will produce a combined score. If FREE is worth 50 in your dictionary and 25 in the system dictionary, an occurrence of this word in an would actually be worth 75 points. Because this is a shared service, the system dictionary applies to many different customer & customer-types. Therefore, the system dictionary cannot block an with a single instance of a word such as Viagra. If you know nobody in your domain requires such an , you can add the word Viagra with a point value of 100. Sperre Technologies, Inc. Page 14 of 14