Email Security SonicWALL Email Security 6.0.1 Software Attention: Licensing is changed beginning in Email Security 6.0. Be sure to read the Upgrading section in this release note before upgrading from Email Security 4.7.x, 4.8.x, or 5.0.x. Contents This document includes the following sections: System Compatibility...1 What s New in SonicWALL Email Security 6.0.1?...2 Known Issues...3 Resolved Known Issues...4 Resolved Known Issues in 6.0...5 Upgrading Email Security Procedures...6 Key Features in Email Security 6.0...11 Related Technical Documentation...20 System Compatibility SonicWALL Email Security 6.0.1 Software is supported on systems with the following: Operating Systems Windows 2000, SP4 Windows 2003, SP1 Hardware Requirements Intel Pentium: Celeron, P4 or compatible CPU 1 Gigabyte RAM minimum Hard Disk: 40GB minimum HTTPS Connectivity to SonicWALL License Manager Email Security products running version 6.0 and above communicate with the SonicWALL License Manager servers using the default HTTPS port. The Upstream firewalls in the network where this Email Security system is deployed must allow HTTPS communication on port 443 that is initiated from the 6.0.x upgrade process. Note: To test connectivity in SonicWALL Email Security 6.0.1, click the Test Connectivity to SonicWALL button on the System > License Management page in the user interface. If the test fails, check your firewall to be sure that outbound HTTPS communication is allowed.
What s New in SonicWALL Email Security 6.0.1? SonicWALL Email Security 6.0.1 adds new technology and enhances existing systems to continue to improve effectiveness. The Image Inference Engine has improved profiling capabilities for image attributes including image positioning. It also contains enhancements in detecting animated images. Multi-language support has been enhanced overall with particular enhancement in German and Spanish. SonicWALL Email Security SMART Network effectiveness is improved with enhancements to thumbprinting for additional languages and new attachment thumbprinting capabilities. Improvements have also been added for processing spam feeds. Image-thumbprinting is a SonicWALL technology that helps catch image-based spam, or email with text messages hidden inside an image that evade traditional spam filters. SonicWall collects feedback from the 1-million-user global SMART network about which of these emails are spam, and then blocks them accordingly. Effectiveness is improved for email text content analysis, including better detection of gibberish and sexual terms. Email header analysis is improved with changes to interpretation of the send-date in context with other factors. Email Security 6.0.1 supports SonicWALL Technical Support Report functionality with a new TSR button on the System > License Management page that allows you to send data to SonicWALL Support with one click. The TSR feature generates a detailed report of the SonicWALL Email Security configuration and status, and sends it directly to SonicWALL Technical Support. Email Security 6.0.1 now provides a Test Connectivity to SonicWALL button on the System > License Management page in the user interface. This button allows you to test connectivity to the SonicWALL License and Registration servers. If the test is successful, you are notified with the following screen: If SonicWALL Email Security is unable to communicate with the server, you will see the following screen: 2
Known Issues The following is a list of known issues in the SonicWALL Email Security 6.0.1 Software release: Administration 45012: Symptom: Audit page shows Header From, but search is on Envelope RCPT TO. Condition: Occurs in messages where the Envelope MAIL FROM field does not match the Header From field. Installation SMTP 45011: Symptom: When you launch an auto update over HTTPS w/a self signed cert, the Java applet that we run on your local machine will ask you if you want to trust the certificate. Then a second dialog appears asking if you want to proceed because the name on the self signed cert does not match the name in the URL for the server. You must answer Yes to both dialogs. Condition: Occurs when the certificate is not in the local keystore file for the JRE or JDK. 49350: Symptom: A single, slow TLS client or connection can impact other TLS or non-tls sessions. Any TLS messages that time out may hold up other email connections causing problems for mailflow. Condition: Occurs when a TLS read/write retry happens at a low level. 45985: Symptom: Good recipients mail is delayed for delivery when the DHA option is enabled. Condition: Occurs when an incoming mail with several recipients is sent and one of the recipients is not a member of Active Directory. 3
Resolved Known Issues The following is a list of resolved known issues in the SonicWALL Email Security 6.0.1 Software release: Administration 51041: Symptom: Email Security cannot contact the SonicWALL License Manager if the LAN is using a Web proxy. Condition: Occurs when you click the "Test Connectivity to SonicWALL" button on the License Manager page while your browser is configured to use the Web proxy and can access https://licensemanager.sonicwall.com directly. 50310: Symptom: Anti-Virus Techniques can become inactive in the user interface after upgrading to Email Security 6.0. Condition: Occurs when the Kaspersky license is still valid, but the McAfee license is expired before upgrading. Workaround: Enable the McAfee free trial after upgrading. Auto-Update 48396: Symptom: The administrator is not currently notified when a server or appliance is going to reboot after an upgrade. Condition: Reboot occurs automatically when the administrator clicks the Upgrade now button and the autoupdate is complete. Installation 51127: Symptom: During installation, the Kaspersky key file is not updated. Condition: Occurs during the installation of an upgrade patch. Memory Symptom: Rapid memory growth when using some attachment policies. Condition: Occurs when a policy is used to look for strings in Attachment Name using the condition Contains or Does Not Contain based on terms in a Dictionary. Also occurred in Email Security 5.0.2 and 5.0.3. Workaround: Turn off policy or modify to look for Ends With or other alternative search criteria. If few terms, use individual policy terms separated by commas instead of using a Dictionary. Symptom: Rapid memory growth when using full Get Rich Quick. Condition: Occurs when the radio button for Anti- Spam Aggressiveness > Get Rich Quick is set to position 5. Also occurred in Email Security 5.0.2 and 5.0.3. Workaround: Change to an alternate radio button setting such as position 3 or 4. Policy and Compliance 51416: Symptom: The SMTP process restarts or stops completely while processing specific empty body messages. Condition: Occurs when the policy uses a filter that evaluates the body content rather than evaluating empty body content against the dictionary. 51143: S ymptom: A policy condition using the specialized nowordsfound clause to search the message body part did not trigger the configured action. Condition: Occurs when the message body is empty. 51135: Symptom: A policy condition that scans attachments could cause the SMTP process to stop in some cases. Condition: Occurs when processing specific corrupted PDF attachments. SMTP 50334: Symptom: The SMTP process could stop when certain characters appear in the From field of a message header. Condition: Occurs when the characters ("%s") occur in the From field. 4
Resolved Known Issues in 6.0 The following is a list of resolved known issues in the SonicWALL Email Security 6.0 Software release: Administration 48102: Symptom: Junk box summaries are sometimes delivered an hour later than scheduled, and in some cases not delivered at all. Condition: Occurs when Daylight Savings Time is in effect three weeks earlier than in previous years. Non-delivery occurs when outdated junk box templates are created when restoring Email Security 5.0.2 or earlier, and then the system is upgraded to 5.0.3 or later and junk box summaries are scheduled to be sent on a daily basis. 47868: Symptom: User can receive multiple junk box summaries. Condition: Occurs when the safe option is used when running sweeps of the junk box, which waits only a short time interval before expecting a successful return. Policy and Compliance SMTP 47539: Symptom: Policy filters based on a dictionary containing words with the German umlaut character do not catch all emails that contain the characters. Condition: Occurs when German words with umlauts are included in the email subject line. 47454: Symptom: Some RTF multi-part mime emails may be corrupted in transit to the recipient. Condition: Occurs when using Thunderbird email client to send an RTF-formatted email with an attachment when the email client is preconfigured with a policy that appends text to every email. Workaround: Turn off the disclaimer option. 47296: Symptom: Certain email message/policy combinations may cause the SMTP service to stop. Condition: Occurs when a specific email or email-type is sent through a certain policy containing actions on the email attachment(s). Workaround: Remove the policy that causes the SMTP service to stop. 48045/46636: Symptom: In some cases, emails or email attachments can become garbled. Condition: Occurs when the system has been running for a long time and may have a memory leak related to SMTP. 5
Upgrading Email Security Procedures See the following sections for instructions on upgrading to SonicWALL Email Security 6.0.1 from the indicated versions: Upgrading Email Security 4.7 / 4.8 / 5.0 / 5.0.1 / 5.0.2 / 5.0.3 to Email Security 6.0.1...6 Upgrading Email Security 6.0 to Email Security 6.0.1...9 Upgrading Email Security 4.7 / 4.8 / 5.0 / 5.0.1 / 5.0.2 / 5.0.3 to Email Security 6.0.1 This section describes the process for upgrading an existing Email Security 4.7.x, 4.8.x, or 5.0.x image to Email Security 6.0.1. Note: If you are currently running Email Security version 4.7.x, 4.8.x, or 5.0.x, before upgrading to Email Security 6.0.1, ensure that the upstream Firewall/Gateway device allows outbound HTTPS communication from the Email Security system. This HTTPS outbound communication from the Email Security system is required to get the proper licensing information from the SonicWALL Licensing and Registration servers. Note: Customers that were originally with MailFrontier should take one extra step BEFORE they upgrade to 6.0 or 6.0.1: Log into MySonicWALL, copy the 27 character license key for Email Security, and paste that into the license field under License Management in the pre-6.0 user interface. Dynamic Licensing Support Licensing changed in SonicWALL Email Security 6.0 to allow the Email Security system to interact directly with mysonicwall.com to dynamically license all services. Starting with Email Security 6.0, you do not need to input individual license keys. The new licensing system synchronizes with MySonicWALL to enable simplified license key management. Because of dynamic licensing in SonicWALL Email Security 6.0 and 6.0.1, before upgrading to these releases from a previous version you must verify that your Email Security product is registered to your mysonicwall.com account, and that your existing licenses are not expired. You can log into your account at https://www.mysonicwall.com/. To see all of your SonicWALL products, click My Products in the left navigation pane. To view the existing licenses for your Email Security product, click the product link. For example, the user interface of your Email Security system might display the information shown below: 6
On mysonicwall.com you should see the same status and expiration dates for the same services: Consider and verify the following: Check that the Customer ID in your Email Security 5.0 or earlier product is registered as a Serial Number in your MySonicWALL account Verify that each system has the appropriate subscriptions Services that you believe you have should not be expired If your Email Security product is not listed, or if your licenses are expired or do not show the status that you expected, you should contact SonicWALL support before upgrading to Email Security 6.0 or 6.0.1. To perform the upgrade, follow the procedure in the next section. For more information on Dynamic Licensing, see the SonicWALL Email Security Getting Started Guide for your product. Upgrading to Email Security 6.0.1 with Dynamic Licensing The following procedure is for upgrading an existing Email Security 4.7.x, 4.8.x, or 5.0.x image to Email Security 6.0.1. To upgrade to SonicWALL Email Security 6.0.1 and activate the upgraded license subscriptions: 1. On your Email Security management system, log into your mysonicwall.com account and confirm that your Email Security licenses are up to date. Note: If the licenses or subscriptions appear to be expired, contact SonicWALL support before upgrading to Email Security 6.0. Your current software will continue to function. 2. To obtain a new Email Security software image file on mysonicwall.com, click Download Center in the left navigation pane under Downloads. 3. In the Activate Service Software Download dialog box, select a language from the Select Language drop-down list. 4. Select the checkbox to agree to the terms and conditions, and then click Submit. 5. In the Download Center screen, select Email Security Software from the Type drop-down list. If not already on this selection, the screen will refresh to show links to the available Email Security software versions and release notes. 6. Click the link for the version that you want and then select Save in the dialog box. Save the file to a convenient location on your Email Security management system. 7. Log into the Email Security user interface using the admin account. 7
8. Navigate to the System > Advanced page and scroll down to the Upload Patch section. 9. Click Browse to locate the Email Security image file on your management system, and then click Apply Patch. As part of the upgrade process, the Email Security appliance will reboot. All the settings and data will be preserved. After the appliance restarts, you must synchronize your licenses with the SonicWALL License Manager. 10. Launch the Email Security user interface and log in as the administrator. 11. In the System > License Management screen, type your mysonicwall.com user name and password into the appropriate fields. 12. Click Submit. You will be directed to the Registration Completion screen. 8
13. In the Registration Completion screen, click Continue. You will be directed to the License Summary page. Licensing is now complete. The License Summary screen displays the status, expiration date, and other information about your Email Security licenses. Upgrading Email Security 6.0 to Email Security 6.0.1 The following procedures are for upgrading an existing Email Security 6.0 image to a newer version. OBTAINING THE LATEST SONICWALL EMAIL SECURITY IMAGE VERSION UPGRADING YOUR SONICWALL EMAIL SECURITY IMAGE USING THE LITE INSTALLER UPGRADING YOUR SONICWALL EMAIL SECURITY IMAGE USING THE FULL INSTALLER Obtaining the Latest SonicWALL Email Security Image Version 1. On your Email Security management system, log into your mysonicwall.com account at http://www.mysonicwall.com. 2. In the left navigation pane under Downloads, click Download Center. 3. In the Activate Service Software Download dialog box, select a language from the Select Language drop-down list. 4. Select the checkbox to agree to the terms and conditions, and then click Submit. 5. In the Download Center screen, select Email Security Software from the Type drop-down list. If not already on this selection, the screen will refresh to show links to the available Email Security software versions and release notes. 6. Click the link for the version that you want and then select Save in the dialog box. Save the file to a convenient location on your Email Security management system. Your management system does not have to be the system where Email Security is installed and running. 7. You can use the Lite Installer or the Full Installer to upgrade from Email Security 6.0 to 6.0.1. See the following sections for the installation instructions. 9
Upgrading Your SonicWALL Email Security Image Using the Lite Installer 1. After downloading the file from mysonicwall.com, log into the Email Security user interface using the admin account. 2. Navigate to the System > Advanced page and scroll down to the Upload Patch section. 3. Click Browse to locate the Email Security image file, and then click Apply Patch. Upgrading Your SonicWALL Email Security Image Using the Full Installer The full-installer includes installation of Apache Tomcat, the Java Runtime Environment (JRE), and Firebird as well as the base Email Security software. 1. Double-click the downloaded Email Security installation file and then click Run in the dialog box. 2. In the Welcome page of the installation wizard, click Next. 3. Read the License Agreement and then click Next to accept the agreement. 4. An alert is displayed if the system does not have Asian language packs installed. SonicWALL recommends that Asian language packs be installed. To proceed with the Email Security installation and install Asian language packs later, click Next. To install Asian language packs prior to proceeding, click Cancel. Note: Installing Asian language packs is optional, however, the spam prevention capabilities of SonicWALL Email Security may be diminished without them. Asian language packs can be installed before or after SonicWALL Email Security Software installation. 5. In the Destination Folder page, click Browse to select an alternate folder, or click Next to accept the default location. Alert: It is important that this folder is not scanned by an anti-virus engine. 6. In the Choose Data Folder page, click Browse to select an alternate folder, or click Next to accept the default location. If the data folder is on a different disk drive than the install directory, ensure that it has fast read/write access with less than 10 millisecond latency. You can test latency with the ping command. 7. In the Start Installation page, click Next. 8. If requested, allow the installation of Tomcat, Firebird, and the Java Runtime Environment (J2RE). If Tomcat is installed in this step, it prompts for the Apache Tomcat Web server port number. The default port is 80. If you are already running a Web server on port 80, you must change the port setting. SonicWALL recommends port 8080. Click Next to continue. Note: You can change the port number and configure HTTPS access after installation by using the Server Configuration > User View Setup page of the Email Security user interface. 9. After the installation finishes, click Finish in the Installation Complete page. A browser window is displayed with links to the Email Security user interface and documentation. 10
Key Features in Email Security 6.0 The Email Security 6.0 Software release includes new management and effectiveness features including enhancements in the following areas: Dynamic Licensing and a New User Interface Hosted / Managed Service Provider Enhancements Reporting Enhancements Enhanced Effectiveness Enhanced Reporting Effectiveness What s New in Management? A new user interface that represents the future of all SonicWALL products and licensing integrated with MySonicWALL are immediately noticeable, but Managed Service Providers will find significant enhancements to enable building a hosted service business, and reporting and appliance management round out the release. Dynamic Licensing and the New User Interface Dynamic Licensing Support Licensing has changed in SonicWALL Email Security 6.0. As part of this upgrade, the Email Security system interacts directly with mysonicwall.com to dynamically license all services. You do not need to input individual license keys. The new licensing system synchronizes with MySonicWALL to enable simplified license key management. To use dynamic licensing during an upgrade of Email Security, see the Upgrading section in this document. Left-hand Expandable Navigation in the New User Interface SonicWALL Email Security 6.0 features a new User Interface (UI) that represents the future of all SonicWALL products. A navigation bar is now displayed in the left pane, with expandable entries. Band Upgrades SonicWALL Email Security 6.0 provides a method for customers to upgrade their user band licenses to protect more users when their organizations outgrow their current licenses. Band upgrades apply to all subscriptions, but do not change subscription expiration dates. 11
Hosted/Managed Service Provider (MSP) Enhancements SonicWALL Email Security 6.0 introduces several features that are useful in a Managed Service Provider environment. The following features are available: User import Per-domain directory harvest attack protection management Per-domain reporting Per-path MTA queue management Zero-management remote access for junk box management User Import User Import in Email Security 6.0 gives the administrator the ability to import a list of non-ldap users for spam filtering and DHA protection. Administrators can import, export, add, and delete the non-ldap users to Email Security from the Users and Groups > Users screen. To add a number of users, an administrator can use an Excel spread sheet or text editor to generate a user list and save it as a tab-delimited file. The entries can be appended to the existing non-ldap user list, or the administrator can overwrite the list by selecting either append or overwrite in the Import Users dialog box. The modified list is imported to Email Security when you click Import. When the Import button is clicked, the Import Users dialog box displays: 12
Per-Domain Directory Harvest Attack (DHA) Protection Management In Email Security 6.0 you can manage Directory Harvest Attack (DHA) protection by specifying a single domain or a group of domains to be protected. Per-domain settings for DHA protection are available on the System > Connection Management screen. You can select from the following domain settings: Apply to all recipient domains This option provides the most comprehensive protection, and is recommended by SonicWALL for all domains where users are mapped into the product either via LDAP or User Import. Apply only to the recipient domains listed Use this option to specify one or more domains to protect. Apply to all recipient domains except those listed Use this option to exclude one or more domains from DHA protection. Per-Domain Reporting Email Security 6.0 Per-Domain Reporting allows a Managed Service Provider (MSP) to see how much value is being provided to hosted customers. Several new reports are available for showing per-domain MSP related data. Email breakdown (custom/scheduled report only) Bandwidth (custom/scheduled report only) Good versus Junk per domain (custom/scheduled report only) 13
Per-Path MTA Queue Management SonicWALL Email Security 6.0 provides information about the number of messages in the Mail Transfer Agent (MTA) queue for each path that is configured to use the MTA. A path specifies how the data is sent through the SonicWALL Email Security solution. Of the five path types that can be configured, one is to act as a proxy which sends messages in real time and so does not maintain a queue. The other four path choices allow messages to be queued, and can now be individually monitored. These four path configurations are: MTA with SmartHost routing MTA with SmartHost routing and load balancing MTA with MX record routing MTA with MX record routing (with exceptions) In deployments where multiple MTA SmartHost or Mail Exchange (MX) paths use the same MTA, the per-path queue information can help the administrator monitor and balance the load on the MTA. The per-path MTA queue information is available in the Reports & Monitoring > Monitoring > MTA Status screen. Zero Management Remote User Login SonicWALL Email Security 6.0 allows you to configure remote Junk Box Summary access to individual junk boxes and settings. When this feature is enabled, users can login and gain full access by simply clicking a link in their Junk Box Summary. This allows organizations whose users are not authenticated by LDAP to access their junk boxes and settings without being required to enter their username and password. This feature can be enabled on the System > Junk Box Summary page: 14
Reporting Enhancements SonicWALL Email Security 6.0 provides several enhancements to reporting, including real-time system monitoring reports, the ability to download report data into a file using comma-separated values (CSV) format, and improvements to performance. Real-Time System Monitoring Reports For system monitoring, SonicWALL Email Security 6.0 provides real-time reports. The System Status screen on Reports & Monitoring > Monitoring shows live information and indicates whether SonicWALL Email Security is connected to the following: The SonicWALL data center The downstream mail server (for a Remote Analyzer or All-In-One) Real-time graphs are displayed for CPU History and CPU Usage: The Real-Time System Monitor screen on Reports & Monitoring > Monitoring shows message throughput and bandwidth usage per second in real-time: 15
Downloadable Data SonicWALL Email Security 6.0 provides the ability to download data into a CSV file for any report. When you click the Download Report button, a dialog box asks you to confirm the transfer of the data to your local system, and then allows you to select the location and file name for the.csv file. Improved Performance SonicWALL Email Security 6.0 features a unified reporting system architecture to improve the quality, reliability, and performance of the reporting system. 16
Effectiveness SonicWALL Email Security effectiveness enhancements in this release are focused on stopping image and stock ticker spam, adding infrastructure to handle new outbreaks, enhancing connection-level protection, and providing feedback and troubleshooting notifications. Effectiveness Enhancements Image Inference Engine In Email Security 6.0, blocking image spam is 35% more effective. For example, Email Security will detect and block images such as the following: Bayesian Rules Email Security 6.0 includes enhanced Bayesian rules, which filter email by identifying spam, and also includes parser enhancements such as the following: Improved URL extraction Generalizes for rotating domains and country codes Improved lexical distancing algorithm Helps defeat this new technique, also known as scrabble spam Improved phone number extraction Catches spam through increased recognition of phone numbers Stock Ticker Spam Update SonicWALL Email Security 6.0 provides improvements to the financial spam filter that was introduced in Email Security 5.0. 17
Enhanced Reporting Effectiveness Junk Box Summary Reporting Junk Box summaries now include: The number of included messages in the subject A total organization statistics chart Message Tagging From the System > Default Message Management screen, an administrator can define conditions for tagging messages arriving to their inbox. Message Tagging is turned on by default. The administrator can select from four options to tag the arriving messages. For each option you can type custom text into the field. The text is prefixed to the subject line of the message in your inbox. You can select any or all of the options to tag messages that are unjunked, included in the Allowed list, delivered because of a policy action, or used for deployment testing. 18
Connection Management Update SonicWALL Email Security 6.0 provides improvements on filtering Sender IDs. Email Security 6.0 checks emails received with a sender on an Allowed List against Sender ID. If the sender fails the Sender ID check, the Allowed List is ignored and the email is checked using other technologies. Smart Allowed Lists In Email Security 6.0, SPF and Sender ID-checked Allowed Lists and user notifications prevent risky additions. Additionally, warnings will be displayed when a user attempts to add inappropriate entries to the Allowed List, including the following: Your own email address Your organization s domain You can add to your Allowed List from several locations in the user interface. Domains are added on the Anti-Spam, Anti- Phishing > Companies screen by clicking Add on the Allowed tab. Adding your own domain will result in the following warning: You can add a Sender to your Allowed List on the Anti-Spam, Anti-Phishing > People screen. A similar warning is displayed if you add your own email address. The admin account is not affected; only regular user accounts can cause this warning. When you unjunk a message from your Junk Box Summary mail, you will see a similar warning dialog box. 19
Related Technical Documentation SonicWALL user guides and reference documents are available at the SonicWALL Technical Documentation Online Library: http://www.sonicwall.com/us/support.html For basic and advanced deployment examples, refer to SonicOS Guides and SonicWALL TechNotes available on the Web site. Part number: 232-001254-00 Rev: A Last updated: 8/22/2007 20