Barracuda Spam Firewall User s Guide

Transcription

1 Barracuda Firewall User s Guide 1

2 Copyright Copyright 2005, Barracuda Networks v All rights reserved. Use of this product and this manual is subject to license. Information in this document is subject to change without notice. Trademarks Barracuda Firewall is a trademark of Barracuda Networks. All other brand and product names mentioned in this document are registered trademarks or trademarks of their respective holders. 2 Barracuda Firewall User s Guide

3 Managing your Quarantine Inbox Managing your Quarantine Inbox ur Quarantine Managing Inbox your Quarantine Inbox This chapter describes how you can check your quarantined messages, classify messages as spam and not spam, and modify your user preferences using the Barracuda This chapter Firewall describes interface. how you This can chapter check your quara chapter describes how you can check your contains This This quarantined chapter chapter describes describes messages, topics: how how classify you you can can messages check check your your as spam quarantined quarantined and not messages, messages, spam, and classify classify modify messages messages your user as as preferences spam spam and and using the pam, and modify your user preferences not not using spam, spam, the Barracuda and and modify modify your your Firewall user user preferences preferences interface. using using This the the chapter Barracuda Barracuda contains the Firewall Firewall following interface. interface. topics: This This chapter chapter ains topics: contains contains Receiving the following Messages topics: topics: from the Barracuda Firewall in the next section. Receiving Messages from the Barracuda F Receiving Messages from the Barracuda Using Receiving Firewall the Quarantine Messages the next from Interface section. the Barracuda on page 4. Firewall in the next section. Receiving Messages from the Barracuda Firewall in the next section. Using the Quarantine Interface on page 4. Using the Quarantine Interface on page 4. Changing Using the Quarantine your User Preferences Interface on on page page 4. Using the Quarantine Interface on page Changing your User Preferences on page 6. Changing your User Preferences on page 6. Using Changing Microsoft your User Outlook Preferences and Lotus on page Notes 6. Changing your User Preferences on page 6. to Classify Messages on page 9. Using Microsoft Outlook and Lotus Notes to Cla Using Microsoft Outlook and Lotus Notes to Using Classify Microsoft Messages Outlook on page and 9. Lotus Notes to Classify Messages on page 9. Using Microsoft Outlook and Lotus Notes to Classify Messages on page 9. Receiving Messages from the Barracuda Firewall Receiving Messages from the Barracuda ges from the Receiving Barracuda Messages The Barracuda Firewall from the Firewall Barracuda sends you two Firewall types of messages: The Barracuda Firewall sends you the followin Barracuda Firewall sends you the The following Greeting Barracuda Barracuda two Message types of Firewall Firewall messages: sends sends you you the following two two types types of of messages: messages: Greeting Quarantine Message Summary Report Quarantine Summary Report Quarantine Summary Report Quarantine Summary Report Quarantine Summary Report The first time the Barracuda Firewall quarantines an intended for you, the system sends you eting Message a greeting message with a subject line of User Quarantine Account The first Information. time the Barracuda The greeting message Firewall quarantin first time the Barracuda Firewall quarantines contains The The first first the time time an following the the Barracuda Barracuda intended information: you, Firewall Firewall the system quarantines quarantines sends you an an a greeting intended intended message for for you, you, with the the a system system subject sends sends line of you you User Quaran eting message with a subject line of User a greeting greeting Quarantine message message Account with with Information. a subject subject line line The of of greeting User User Quarantine Quarantine message Account Account contains Information. Information. The The information: greeting greeting message message ains information: contains contains Welcome the following to the Barracuda information: information: Firewall. This message contains the information you will need to access your Quarantine and Preferences. Welcome to the Barracuda Firewall. This m Welcome to the Barracuda Firewall. This Welcome Welcome message to to the the contains Barracuda Barracuda the information Firewall. Firewall. you will This This need message message to contains contains access the the your information information Quarantine you you will will need need and Preferences. to to Your access your Quarantine and Preferences. access account has been set to username and password: access your your Quarantine Quarantine and and Preferences. Preferences. Your account has been set to usern Username: Your account has been set to username Your <your address> Your account account and password: has has been been set set to to the following username username and and password: password: Username: <your address> Password: Username: <your address> Username: default password> Username: <your <your address> address> Password: <your default password> Access Password: <your default password> Password: your Quarantine directly using link: Password: <your <your default default password> password> system address or name>:8000 Access your Quarantine directly using the Access your Quarantine directly using Access Access your your link: Quarantine Quarantine directly directly using using the following link: link: system address or name>: system address or name>:8000 The Barracuda Firewall system system address address automatically or or name>:8000 name>:8000 provides your login information (username and password) and the link to access the quarantine interface. You should save The this Barracuda because Firewall future messages automatically from provides Barracuda Firewall automatically The The the provides system Barracuda Barracuda your do not login contain information Firewall Firewall your automatically automatically login (username information. and provides provides password) your your login login and the information information link to access (username (username the quarantine and and password) password) interface. You sh he link to access the quarantine interface. and and You the the should link link to to save access access this the the quarantine quarantine because interface. interface. future messages You You should should from save save the this this system do because because not contain future future your messages messages login information. from from ystem do not contain your login information. the the system system do do not not contain contain your your login login information. information. Managing your Quarantine Inbox 3 Managing your Quarantine Inbox 3 Managing your Quarantine Inbox Managing your Quarantine Inbox 3

4 Using the Quarantine Interface Quarantine Summary Report The Barracuda Firewall sends you a daily quarantine summary report so you can view the quarantined messages you did not receive. From the quarantine summary report you can also add messages to your whitelist, delete messages, and have messages delivered to your inbox. The following figure shows an example of a quarantine summary report. Click to access your quarantine interface to set preferences and classify messages Select to deliver, whitelist or delete quarantined messages Using the Quarantine Interface At the end of every quarantine summary report is a link to the quarantine interface where you can set additional preferences and classify messages as spam and not spam. Logging into the Quarantine Interface To log into your quarantine interface: 1. Click the link provided at the bottom of the Quarantine Summary Report (displayed above). Result: The login page appears. 2. Enter your username and password, and click Login. Your login information resides in the greeting message sent to you from the Barracuda Firewall. 4 Barracuda Firewall User s Guide

5 on the ones you classify as spam and not spam. The learning engine becomes more effective over time as you teach the system how to classify messages and as you set up rules based on your whitelist and Managing your Quarantine Inbox blacklist. After logging into the quarantine interface, select the QUARANTINE INBOX Using tab the to Quarantine view a list Interface of your Clicking quarantined on an messages. displays When you the first message. start using the quarantine interface, you should view this list on a daily basis and classify as many messages as you can. The following table describes the actions you can perform from this page. Managing The Barracuda your Firewall Quarantine has a learning Inboxengine that learns how to deal with future messages based After on Action the logging ones you into classify Description the quarantine as spam and interface, not spam. select The the learning QUARANTINE engine becomes INBOX more tab to effective view a list over of time your as quarantined Deliver you teach messages. the system Delivers When how the to you selected classify first start messages using to the and your quarantine as standard you set interface, up rules inbox. based you should on your view whitelist this list and on a blacklist. daily basis and classify Note: as If you many want messages to classify as you a message can. or add it to your whitelist, make sure to do so before delivering the message to your inbox. Once the Barracuda Firewall Clicking The Barracuda on an displays Firewall the has message. a learning engine that learns how to deal with future messages based delivers a message, it is removed from your quarantine list. on the ones you classify as spam and not spam. The learning engine becomes more effective over time The as Whitelist you following teach the table system Adds describes the how selected to the classify actions message messages you to can your and perform whitelist as you from set so this up all future rules page. based s on from your this whitelist sender and are blacklist. not quarantined unless the message contains a virus or banned attachment type. Action Description The Barracuda Firewall adds the sending address exactly as it appears Clicking Deliver on an in Delivers the displays message the selected the to message. your message personal to whitelist. your standard inbox. The following table Note: describes that If you some want the commercial actions to classify you mailings a can message perform may or from come add this it from to page. your one whitelist, of several make servers sure such to do as so mail3.abcbank.com, before delivering the and message a subsequent to your message inbox. Once may the come Barracuda from mail2.abcbank.com. Firewall See delivers the section a message, on managing it is removed your from whitelists your and quarantine blacklists list. for tips on specifying Action Description whitelists with greater effectiveness. Whitelist Deliver Adds Delivers the the selected selected message message to your to your whitelist standard so all future inbox. s from this sender are Delete Deletes not quarantined the selected unless message the message from your contains quarantine a virus list. or banned The main attachment reason to type. delete messages Note: If you is want to help to classify you keep a track message of which or add quarantine it to your messages whitelist, make you have sure to do so The Barracuda Firewall adds the sending address exactly as it appears reviewed. before delivering the message to your inbox. Once the Barracuda Firewall in delivers the message a message, to your it is personal removed whitelist. from your quarantine list. You cannot recover messages you have deleted. Note that some commercial mailings may come from one of several servers such as Whitelist Adds the selected message to your whitelist so all future s from this sender are Classifies mail3.abcbank.com, the selected and message a subsequent as not message spam. may come from mail2.abcbank.com. not quarantined unless the message contains a virus or banned attachment type. Not See Note: the Some section bulk on commercial managing your whitelists may be considered and blacklists useful for tips by some on specifying users and whitelists The Barracuda with greater Firewall effectiveness. adds the sending address exactly as it appears spam by others. Instead of classifying bulk commercial , it may be more in the message to your personal whitelist. Delete Deletes effective the to add selected it to your message whitelist from (if your quarantine wish to receive list. The such main messages) reason or to blacklist delete messages Note (if you that prefer some is to not help commercial to receive you keep them). mailings track of may which come quarantine from one messages of several you servers have such as reviewed. mail3.abcbank.com, and a subsequent message may come from mail2.abcbank.com. See Classifies the section the selected on managing message your as whitelists spam. and blacklists for tips on specifying You whitelists cannot with recover greater messages effectiveness. you have deleted. Delete Deletes Classifies the the selected selected message message from as not your spam. quarantine list. The main reason to delete Not messages Note: Some is bulk to help commercial you keep track of may which be considered quarantine useful messages by some you have users and reviewed. spam by others. Instead of classifying bulk commercial , it may be more You effective cannot to add recover it to messages your whitelist you (if have you deleted. wish to receive such messages) or blacklist (if you prefer not to receive them). Classifies the selected message as not spam. Not Classify as Classifies the selected message as spam. Note: Some bulk commercial may be considered useful by some users and spam by others. Instead of classifying bulk commercial , it may be more effective to add it to your whitelist (if you wish to receive such messages) or blacklist (if you prefer not to receive them). Classifies the selected message as spam. Managing your Quarantine Inbox 5 Managing your Quarantine Inbox 5 Managing your Quarantine Inbox 5

6 your User Changing Preferences your User Preferences ing your Changing User Preferences your User Preferences After logging into your After quarantine logging into interface, your quarantine you can use interface, the PREFERENCES you can use the tab PREFERENCES to change your tab to change your account password, account modify your password, quarantine modify and your spam quarantine settings, and spam manage settings, your whitelist and manage and blacklist. your whitelist and blacklist. Changing your Changing Account your Password Account Password To change your account To change password, your account do one of password, : do one of : On the quarantine interface login page, click Create New Password, or On the quarantine interface login page, click Create New Password, or After logging into your After quarantine logging into interface, your quarantine go to PREFERENCES-->Password. interface, go to PREFERENCES-->Password. This option is not This option is not available if single sign available on has if been single enabled sign on via has LDAP been enabled or Radius. via LDAP or Radius. In the provided fields, In the enter provided your existing fields, enter password your and existing enter password your new and password enter your twice. new Click password Save twice. Click Save Changes when finished. Changes when finished. Note: Changing your Note: password Changing breaks your the password links in your breaks existing the links quarantine your existing summary quarantine reports so summary you reports so you cannot delete, deliver, cannot or whitelist delete, deliver, messages or whitelist from those messages reports. from New those quarantine reports. summary New quarantine reports will summary reports will contain updated links contain that you updated can use links the that same you as can before. use the same as before. Changing Your Changing Quarantine Your Settings Quarantine Settings The following table The describes following the table quarantine describes settings the quarantine you can change settings from you the can change from the PREFERENCES-->Quarantine PREFERENCES-->Quarantine Settings page. Settings page. Quarantine SettingQuarantine Description Setting Description Enable Quarantine Enable Whether Quarantine the Barracuda Whether the Firewall Barracuda quarantines Firewall your messages. quarantines your messages. If you select Yes, the If you Barracuda select Yes, the Firewall Barracuda does not deliver Firewall does not deliver quarantined messages quarantined to your general messages to your inbox, general but you can view inbox, these but you can view these messages from the messages quarantine from interface the quarantine and quarantine interface summary and quarantine reports. summary reports. If you select No, all If messages you select that No, would all messages have been that quarantined would have for been you quarantined for you are delivered to your are general delivered to your inbox general with the subject inbox line with prefixed the subject with line prefixed with [QUAR]:. The Barracuda [QUAR]:. The Firewall Barracuda administrator Firewall can modify administrator this can modify this prefix. prefix. Notification IntervalNotification The frequency Interval the Barracuda The frequency the Firewall Barracuda sends you Firewall quarantine sends you quarantine summary reports. The summary default reports. is daily. The default Barracuda is daily. The Firewall Barracuda only Firewall only sends quarantine summary sends quarantine reports when summary one or reports more of when your one s or more have of your s have been quarantined. been quarantined. If you select Never, If you can select still Never, view your quarantined can still view messages your quarantined from the messages from the quarantine interface, quarantine but you will interface, not receive but you quarantine will not receive summary quarantine reports. summary reports. Notification AddressNotification The Address address The the Barracuda address the Firewall Barracuda should use Firewall to deliver should your use to deliver your quarantine summary quarantine report. summary report. Default Language Default The Language language in which The you language want to in receive which your want quarantine to receive notifications. your quarantine notifications. This setting also sets This the setting default also encoding sets the for default handling encoding unknown for character handling unknown character sets during filtering. sets All during notifications filtering. All from the notifications Barracuda from the Barracuda Firewall are in UTF8 Firewall encoding. are in UTF8 encoding. cuda 6 Firewall Barracuda User s Guide Firewall User s Guide

7 Changing your User Preferences Changing your User Preferences Adding Enabling Addresses and Disabling and Domains Scanning to Your of Whitelist your and Blacklist The PREFERENCES-->Whitelist/Blacklist If you do not want the Barracuda page Firewall lets you scanning specify your s addresses for and spam domains content, from you can The disable PREFERENCE which you spam do or filtering do not from want the to receive PREFERENCES--> s. Settings page. From this page you can also change which you the do or do default spam scoring levels that determine when your s are tagged, quarantined or blocked. List Type Description List Type D When the Barracuda Firewall receives an for you, it scores the message for its spam Whitelist probability. The This list of score ranges addresses from 0 or (definitely domains from not spam) which to you 10 always or higher wish (definitely to receive spam). Based Whitelist on Th messages. The only time the Barracuda Firewall blocks a message from m this score, the Barracuda Firewall either allows, quarantines, or blocks the message. someone on your whitelist is when the message contains a virus or a disallowed so A setting attachment of 10 for any file setting extension. disables that option. at Blacklist The list of senders from whom you never want to receive messages. The Barracuda Blacklist Th The following table Firewall describes immediately the fields discards on the messages PREFERENCES--> from senders on your Settings blacklist. page. These S messages are not tagged or quarantined and cannot be recovered. The sender does m Settingnot receive a notice Description that the message was deleted, and neither do you. no Filter The only Enable/Disable time a blacklisted address is delivered is if the same address Th also appears in your whitelist. al Enable Select Yes for the Barracuda Firewall to scan your s for spam. Filtering Select No to have all your messages delivered to you without being scanned for spam. To whitelist or blacklist senders, follow these steps: To whitelist or blac Scoring 1. Go to the PREFERENCES-->Whitelist/Blacklist page. 1. Go to the PREF Use System Select Yes to use the default scoring levels. To configure the scoring levels A list Defaults of your existing whitelisted yourself, and select blacklisted No and addresses make the appears desired on changes this page. in the Scoring Levels A list of your e section described below. 2. To delete Tag a score whitelist or a blacklist Messages entry, with click a score the trash above can this icon threshold, next to the but address. below the quarantine 2. To delete a whi threshold, are delivered to you with the word [BULK] added to the subject line. 3. To add an entry, type an address into the appropriate field, and click the corresponding Add 3. To add an entry Any message with a score below this setting is automatically allowed. The button. button. default value is 3.5. Tips on specifying Quarantine score addresses Messages with a score above this threshold, but below the block threshold, Tips are on specifyin forwarded to your quarantine mailbox. When adding addresses to your whitelist and blacklist, note tips: When adding addre The default setting is 10 (quarantine disabled). If you enter a full address, To enable such as the johndoe@yahoo.com, quarantine feature, this just setting that user must is have specified. a value If you lower than If the you enter a fu enter just a domain, such as block yahoo.com, threshold. all users in that domain are specified. enter just a dom If you Block enter score a domain such as Messages barracudanetworks.com, with a score above all this subdomains threshold are are also not included, delivered such to your as inbox. If you enter a d Depending on how the system is configured, the Barracuda Firewall may support.barracudanetworks.com and test.barracudanetworks.com. support.barracu notify you and the sender that a blocked message could not be delivered. Mass mailings often come from The domains default value that do is 9. not resemble the company s Web site name. For Mass mailings example, you may want to receive mailings from historybookclub.com, but you will find that this example, you m Barracuda Bayesian Learning site sends out its mailing from the domain hbcfyi.com. Examine the From: address of an actual site sends out it mailing Reset that Bayesian you are trying to Click whitelist Reset or to blacklist remove to your determine Bayesian what rules to learned enter. by the Barracuda mailing that yo Database Firewall from the point of installation. Changing Bayesian the Language Database Backup of the Quarantine Interface Adding Changing the You can change Backup the Bayesian language of Click your quarantine Backup to interface download by a copy selecting of your a language Bayesian from database the drop-down to your local You can change the Database system. This backup copy can then be uploaded to any Barracuda menu in the upper right corner of the QUARANTINE INBOX and PREFERENCES tabs. Supported menu in the upper r Firewall, including this one, in the case of a corrupt Bayesian installation. languages include Chinese, Japanese, Spanish, French, and others. languages include C Restore Database Click Browse to select the backup file containing your Bayesian database, and The language you select is only applied then click to your Upload individual Now to quarantine load the Bayesian interface. settings No other to this user s Barracuda interface The language you se is affected. Firewall. is affected. The backup file does not need to have originated from this Barracuda Firewall, nor from the same user database. 8 Barracuda Firewall User s Guide Managing 8 your Barracuda Quarantine Inbox Firewall 7User s G