FortiMail Gateway SMTP Authentication Technical Note

Transcription

1 FortiMail Gateway SMTP Authentication Technical Note FortiMail Gateway SMTP Authentication Technical Note Document Version: Version 2.0 Publication Date: 4 April, 2005 Description: This technical note describes how to configure FortiMail Gateway SMTP authentication. Product: FortiMail v2.0 Document Number: Fortinet Inc. Copyright 2005 Fortinet Inc. All rights reserved. No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of Fortinet Inc.

2 FortiMail Gateway Bayesian Training Technical Note FortiMail v2.0 4 April Trademarks Products mentioned in this document are trademarks or registered trademarks of their respective holders. Regulatory Compliance FCC Class A Part 15 CSA/CUS

3 Contents Table of Contents Introduction... 3 Configuring authentication profile... 3 Creating policies... 5 Connecting servers... 5 Creating policies for users... 6 Notifying users... 6 Technical Note

4 Contents Fortinet Inc.

5 FortiMail Gateway SMTP Authentication Introduction SMTP authentication is an SMTP service extension whereby an SMTP client may indicate an authentication mechanism to the server, perform an authentication protocol exchange, and optionally negotiate a security layer for subsequent protocol interactions. With SMTP authentication, you add a layer of security to you SMTP server. While allowing legitimate users to send through the server from any place in the world, you are preventing spamers and unauthorized users from using you SMTP server. In addition to protecting your mail server from spam and viruses, the FortiMail Gateway also supports SMTP authentication to allow remote users to send through the FortiMail Gateway. This technical note describes how to configure the FortiMail Gateway SMTP authentication to support remote users if they want to send through the FortiMail Gateway. This technical note includes: Configuring authentication profile Creating policies Notifying users Configuring authentication profile The FortiMail Gateway supports SMTP authentication by applying authentication settings. These settings are called profiles which become policies once they are grouped and applied to users. Because the FortiMail Gateway has no local user accounts, it uses external server authentication, including RADIUS, LDAP, POP3, and IMAP. You need to configure the authentication profile for your authentication server if it is a RADIUS, LDAP, POP3, or IMAP server. To add and edit a RADIUS server authentication profile - Web-based manager 1 Go to Profile > Authentication > Radius. 3 Enter the Profile Name, the name or IP address of the RADIUS server, and the key string of the RADIUS server. 4 Select OK. 4 April

6 FortiMail Gateway SMTP Authentication Configuring authentication profile 5 If you want to edit the profile, select the Edit icon for the profile that you want to edit and modify the profile as required. 6 Select OK. To add and edit a RADIUS server authentication profile - CLI set auth radius <server_name> secret <key_str> server {<domain_name_str> <ip_str>} To add and edit an LDAP server authentication profile - Web-based manager 1 Go to Profile > Authentication > LDAP. 3 Enter the Profile Name and the name or IP address of the LDAP server. 4 Enter the LDAP server port number. The default port number is Enter the LDAP server s Common Name and Distinguished Name. 6 Select OK. 7 If you want to edit the profile, select the Edit icon for the profile that you want to edit and modify the profile as required. 8 Select OK. To add and edit an LDAP server authentication profile - CLI set auth ldap <server_name> port <port_number> server {<domain_name_str> <ip_str>} cnid <cnid_str> dn <dn_str> To add and edit a POP3 server authentication profile - Web-based manager 1 Go to Profile > Authentication > POP3. 3 Enter the Profile Name and the name or IP address of the POP3 server. 4 Enter the POP3 server port number. The default port number is Enable Secure Sockets Layer (SSL) to secure message transmission, Secure Authentication to secure users passwords, or Transport Layer Security (TLS) to ensure privacy between communicating applications and their users on the Internet, as required. 6 Select OK. 7 If you want to edit the profile, select the Edit icon for the profile that you want to edit and modify the profile as required. 8 Select OK. To add and edit a POP3 server authentication profile - CLI set auth pop3 <server_name> server {<domain_name_str> <ip_str>} port <port_number> option {<ssl> <secure> <tls>} Fortinet Inc.

7 Creating policies FortiMail Gateway SMTP Authentication To add and edit an IMAP server authentication profile - Web-based manager 1 Go to Profile > Authentication > IMAP. 3 Enter the Profile Name and the name or IP address of the IMAP server. 4 Enter the IMAP server port number. The default port number is Enable Secure Sockets Layer (SSL) to secure message transmission, Secure Authentication to secure users passwords, or Transport Layer Security (TLS) to ensure privacy between communicating applications and their users on the Internet, as required. 6 Select OK. 7 If you want to edit the profile, select the Edit icon for the profile that you want to edit and modify the profile as required. 8 Select OK. To add and edit an IMAP server authentication profile - CLI set auth imap <server_name> server {<domain_name_str> <ip_str>} port <port_number> option {<ssl> <secure> <tls>} Creating policies You can protect your server and its users by connecting the server to the FortiMail Gateway. You can then apply authentication profiles to users to support SMTP authentication. By applying profiles to users, you create policies. Connecting servers Connect the server(s) to be protected by the FortiMail Gateway so that you can apply authentication profiles to users. To connect and edit an server - Web-based manager 1 Go to Policy > Policy. 3 Enter the FQDN and IP Address of your server. 4 Select OK. 5 If you want to edit an server, select the Modify icon of an server. 6 Modify the FQDN and IP Address of the server. 7 Select OK. To connect and edit an server - CLI set policy <server_fqdn> modify ip <ip_address> Technical Note

8 FortiMail Gateway SMTP Authentication Notifying users Creating policies for users After connecting the server(s) to the FortiMail Gateway, you can apply an authentication profile to users. When applying a profile for a user, you create a policy for the user. To create a policy for users - Web-based manager 1 Go to Policy > Policy. 2 Select the Edit icon of an server of which you want to add policies for the users. 3 Select Create New. 4 Enter the User Name. The user name you enter must match the same user s name on the server. Normally it is in the format of an address. You can also use an asterisk to represent a group of users, for example, *@example.com. 5 Enable Spam Retrieval/SMTP AUTH. This enables remote users to access the quarantined spam on the FortiMail Gateway using web mail or POP3. It also enables remote users to send through the FortiMail Gateway. 6 For Authentication, select your authentication server type and a profile. 7 If the selected authentication server requires domain names for authentication, select Requires Domain. 8 Select OK. To create a policy for users - CLI set spam retrieval policy <server_fqdn> user <user_name> status enable auth {<imap> <ldap> <pop3> <radius>} senddomain {<enable> <disable>} Notifying users After configuring profiles and creating policies, you need to notify users to do the following when configuring mail accounts on their clients: Enable SMTP authentication. Add their full domain names when setting logon account names if the FortiMail Gateway supports multiple domains Fortinet Inc.