Portions of this software are based, in part, on ImageMagick, , ImageMagick Studio, LLC.

Transcription

1

2 This guide is copyright. Reproduction or deletion, in whole or in part, of this document is strictly prohibited without prior written consent from Messaging Architects. GWGuardian is a trademark of Messaging Architects. VOP, Vircom Online Platform, VOP Mail, ModusMail, Modus, SCA, VOP Radius, ModusMail Gate, VOP Anti-Spam Gate, VOP Mail Web, Professional VOP Mail Web, VOP Migration Services, Modus Sieve are trademarks of Vircom, Inc. Norman Virus Control and NVC are trademarks of Norman Data Defense Inc. Windows, Windows NT, Windows 2000, IIS, Internet Information Server and Data Access Components are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Platypus, RODOPI, Emerald, EcoBuilder, Logisense, and Worldgroup are trademarks of their respective owners. All other products or services mentioned in this document are identified by the trademarks or service marks of their respective companies or organizations. McAfee and NetScan are registered trademarks of Network Associates, Inc. and/or its affiliates in the US and/or other countries. Network Associates Technology, Inc. All Rights Reserved. Portions of this software are based, in part, on ImageMagick, , ImageMagick Studio, LLC. ModusMail is based on the Professional Internet Mail Services product licensed from the University of Edinburgh. Certain algorithms used in parts of this software are derived from the RSA Data Security, Inc. MD5 Message-Digest Algorithm.

3 GWGuardian 4.4 Installation & Configuration Guide iii GWGuardian Installation & Configuration Guide About GWGuardian GWGuardian is the perfect solution for enterprise security needs. It provides superior spam and virus protection while maximizing return on investment. Layered with intelligence, it pre-authenticates all legitimate users before scanning for spam. It auto-updates virus definitions 24/7 and provides 24/7 updated spam protection. Also included is a multi-layered approach to prevent spammers from abusing and exploiting your network assets. Intended Audience This guide is intended for the GWGuardian administrator. It explains how to install, configure operate, and maintain GWGuardian. This guide assumes the user is fairly knowledgeable about common GroupWise and NetWare terms, concepts, and techniques. Other Resources Messaging Architects is committed to providing the best support available for GWGuardian. If your question is not answered in this guide, our website ( includes additional information. Feedback If you have a general feature question or comment, please submit it at Technical Support If you have a technical support question, please consult the Technical Support section of our website at or call , and a member of our technical support team will contact you as soon as possible during regular business hours. Sales To contact a Messaging Architects sales team member, send an to info@messagingarchitects.com, call , or complete the form at and we will get in touch with you. Other Issues If you have any other questions, send to info@messagingarchitects.com and we will contact you. Corporate Headquarters Messaging Architects 180 Peel, Suite 333 Montreal, QC Canada H3C 2G7 Tel: Fax:

4 GWGuardian 4.4 Installation & Configuration Guide iv How to Use This Guide This guide is intended to complement the GWGuardian Administration Console and introduces concepts in the same order as the layout of the console. If you are looking for a particular function, take a look at the index found at the end of the user guide. Advice Boxes Throughout the guide, you will sometimes see special advice boxes. These advice boxes are intended to supplement the information presented in the section where they are found. These advice boxes serve different functions based on the icon used to represent them. The types of advice boxes are: More information: This advice box tells you where to find more information pertaining to the current subject. Look for this advice box if you want to find out where else in the document a certain subject is being discussed. Warning: This advice box lets you know when something requires caution. The goal of this advice box lets you know about the potential errors into which you might run when using the function in question. Helpful tip: This advice box will inform you of advanced configuration tricks. This way, you can optimize your configuration and make better use of your mail server or your anti-virus engine. Application and Online Help You can access the GWGuardian Installation & Configuration Guide from the application by selecting Help > Contents. You can also send support reports (information about questions you have that are not covered by this guide) directly to our customer support representatives. For up-to-date information about troubleshooting and known issues, see the Technical Support section of our website at Accessing Contextual Help Press F1 from the part of the application you require more information about. The system displays the corresponding section of the GWGuardian Installation and Configuration Guide. Sending Support Requests from the Application: From the GWGuardian Administration Console, choose Help > Support. Enter your inquiry, making sure that all required fields marked with an asterisk are completed. Click Send Report.

5 GWGuardian 4.4 Installation & Configuration Guide 5 Table of Contents 1 GWGuardian Overview What is GWGuardian? Feature Overview GWGuardian Functionality Mail Gateway Perimeter Protection Attachment Blocking Virus Filtering Spam Filtering GWGuardian Administration Console Upgrading and Uninstalling GWGuardian Upgrading to Version 4.4 from GWGuardian Upgrading to Version 4.4 from GWGuardian 3.x and GroupWise Alias Update Wizard Uninstalling GWGuardian Installing GWGuardian System Preparation Pre-Installation Tasks Static IP Address Disable Port Set DNS Suffix on GWGuardian Server Install IIS Components Deploying GWGuardian Install Windows Components Install GWGuardian GWGuardian Routing Wizard Manual Website Configuration Configuring GroupWise GWIA with GWGuardian Receive Threads Mail Forwarding Security Settings GWGuardian Advanced Installation Options Deploying Web Components on a Different Server Managing Remote Servers Running 3rd-Party Anti-Virus Software on GWGuardian: Using GWGuardian with another Filtering Layer Clustering Solutions with GWGuardian Implementing a GWGuardian Cluster Implementing Windows Load Balancing Basic Configurations Incoming Connection Configuration General Authentication Methods Authentication requests Strip domain name for Authentication requests When mail server user list cannot be accessed Redirecting through GWGuardian Redirecting the Incoming SMTP Messages Redirecting Outbound SMTP Messages Checking Inbound & Outbound Mail Server Connections Testing Inbound Communications Testing Outbound Communications GWGuardian System-Level Configuration System > License Key Enter your License Key Product Description...62

6 GWGuardian 4.4 Installation & Configuration Guide Users Threshold Warning System > Agents System > Footer System> Scanning Order System > Services System > Global Aliases System > Settings System > Message Audit Database System > Mail Delivery System > Quarantine Database System > Performance System > Quarantine Reports System > Proxy System Custom Errors System Monitoring Database Security Configurations Security > Protocol Filter Security > SMTP Security Security > Mail Relay Security > Block Scan Attack Security > Sender Validation & Accreditation Perform a look up for the SMTP host in the DNS SPF Support Perform a look up for SMTP host in the Realtime Whitelist servers Security > Real-Time Blacklist Security > Connection Limits Security > Connections Security > Trusted Address List Security > Encryption and Certificates GWGuardian Configuration Checklist Anti-Relaying Summary Connection Layer Spam Blocking Summary Forbidden Attachment (F.A.) Attachments > General Attachments > Forbidden Attachments Attachments > Auto-Cleanup Attachments > Postmaster Attachments Options Attachments > Alert Sender Attachments > Alert Recipients Configuring Virus Preferences Virus> General Virus > Auto-Updates Virus > Auto-Cleanup Virus > Performance Virus > Postmaster Virus > Options Virus > Alert Sender Virus > Alert Recipients Configuring the Spam Engine Spam > General Spam > Auto-Updates Spam > Auto-Cleanup Spam > Sieve Database Spam > Options Spam > System Trusted Senders Spam > System Blocked Senders Spam > SURBL (SpamLinks)...111

7 GWGuardian 4.4 Installation & Configuration Guide 7 10 Phishing Phishing > Options Rules Rules > Custom Filters Rules > Performance Rules > Language Filter GWGuardian Domain-Level Configuration Domains > Preferences Aliases Footer Reporting Attachments Phishing Virus Spam Trusted Senders Blocked Senders Message Audit Language Filter Domains > Web Admin Privileges Administrators GWGuardian User-Level Configuration Users > Preferences General Tab Footer Reporting Attachments Phishing Virus Spam Trusted Senders Blocked Senders Aliases Message Audit Language Filter Users > WebAdmin Find Find Admin Find Quarantine Managing the Quarantine Using the Quarantine Quarantine - Message Quarantine - Headers Quarantine - Raw Source Logs Logs > File Config Logs > Settings Logs > Statistics Config Log > Flags GWGuardian Web Administration Preliminary Configuration Requirements for Using the Web Portals System Configuration Requirements WebAdmin WebAdmin > Options Accessing the WebAdmin Portal Configuring the GWGuardian WebAdmin Portal GWGuardian WebMonitor Accessing Monitoring Statistics with WebMonitor...159

8 GWGuardian 4.4 Installation & Configuration Guide System Health Mail Traffic Message Audit Web Quarantine Customizing WebQuarantine GWGuardian Monitoring Utility Monitoring Client Monitoring Information Administrator s View GWGuardian GroupWise WebAccess Anti-Virus Provider Process GWGuardian WebAccess AV Scanning Components WebAccess Notification Applet Anti-Virus Provider NLM for McAfee NetShield (optional) Installation Configuration & Startup GWGuardian Administration and Configuration Tips Filtering ZIP Attachments with GWGuardian Delaying Attachment Delivery GWGuardian Pre-Authentication GWGuardian Quarantine Databases Various Scenarios Converting SIEVESTORE Database to SQL Managing MS Access Database in GWGuardian Integrating GWGuardian with Microsoft SQL Data Engine (MSDE) Mask lists GWGuardian Mailbox Scanner GWGuardian Mailbox Scanner Installation GWGuardian Mailbox Scanner Configuration Appendix A: GWGuardian Directories Appendix B: GWGuardian Utilities Appendix C: GWGuardian Performance Counters Appendix D: GWGuardian MIB and SNMP Counters Appendix E: Formal Command Line Syntax Appendix F: Protocol Specifications Appendix G: Recommended GWGuardian Default Settings Appendix H: List of Recommended DNSBLs Appendix I: Sieve Programming Appendix J: GWGuardian License Consolidation Glossary Index...502H233

9 GWGuardian 4.4 Installation & Configuration Guide 9 1 GWGuardian Overview 1.1 What is GWGuardian? GWGuardian is an intelligent messaging gateway solution. It integrates advanced, multi-layered anti-spam with state-of-the-art anti-virus protection. GWGuardian is an all-in-one solution that provides you with an intelligent approach to Internet mail security. GWGuardian - Software package, anti-virus service and anti-spam updates relay gateway with extensive spam protection, including the 9-layer network-level security, attachment blocking, user-level safe list / blocked list, and custom Sieve scripts. GWGuardian AV comes with a full year of SCA anti-spam engine updates and a full year of robust anti-virus protection from McAfee for GWGuardian Enterprise Edition or Norman Data Defense for the GWGuardian Advanced Edition Feature Overview GWGuardian is composed of three central feature sets, complemented by three complementary feature sets, as illustrated in Figure 1. The central features around which GWGuardian is built are: Anti-virus: High-performance anti-virus engine built in to the mail gateway. Anti-spam: Flexible and powerful anti-spam tools, complemented with a powerful Sieve-based filtering engine. Simplified administration: All these components come together in the Administration Console, where the many components of GWGuardian are tied together in an easy to use, convenient user interface. Figure 1: The GWGuardian components In addition to the core components, GWGuardian offers the following complementary set of features for providing a complete solution for security. User-awareness: GWGuardian employs User-aware pre-authentication when scanning inbound messages. In other words, the destination of messages is validated before the scan takes place. This provides better performance to the mail gateway. Monitoring: This optional paid service package allows Messaging Architects to perform monitoring tasks on your GWGuardian server, eliminating your GWGuardian server s downtime by monitoring key services, resources, and performance counters. Auto-Updates: GWGuardian s anti-virus signature files and Sieve filters are automatically updated, 24/7, to ensure real-time, up-to-date protection against viruses and spam s. Product Support: Messaging Architects is committed to providing the highest level of product support available through our dedicated product support and customer service groups. Some of the services available include: Installation and deployment support

10 GWGuardian 4.4 Installation & Configuration Guide 10 Technical support and troubleshooting assistance Automatic updates of spam definition files 24/7 updates to virus definition files Notification of all major and minor upgrades Optional 7/24/365 Support Packages Product Benefits Features Highly parallel system architecture for unmatched performance and scalability Multi-layered Anti-SPAM Defense for 98.2% out-ofthe-box spam catch rate and 99% false-positive protection Network-level real-time perimeter protection specialized layers to analyze message content, IP header information, envelope information, and source domain attachment blocking based on forbidden file formats 24/7 Anti-Virus protection and virus definitions auto-updates Trusted / Blocked Senders list functionality to block or allow messages based on senders' addresses and Ultra-Secure Mailbox feature content extractor purifies the message body and content neutralizing all forms of hidden code and analyzing the structure in search of known spam characteristics Auto-updated Sequential Content Analyzer engine that employs stacked layers of predictive and statistical technologies to neutralize the advanced forms of spam Multi-level granularity of configuration - system, domain, user User-friendly Administration Console that allows administrators to write custom Sieve scripts, scan & quarantine both inbound / outbound Full integration with Novell ConsoleOne. Benefits Very low Total Cost of Operations (TCO) & almost instant Return on Investment (ROI) Eliminate end-user complaints about spam & increase employee productivity in a spam-free corporate environment Blocks DoS, OpenRelay, and harvesting attacks Customizable out-of-the-box file list that is efficient against hidden extensions Operate in a virus-free environment Flexibility that allows users to block messages other than spam; reduced CPU intensity by allowing messages from trusted senders to bypass scanning Extremely comprehensive and accurate engine to trap approximately 100% of junk mail with zero false positives Self-managed, auto-updated solution with optimal accuracy that won't fade over time Proactive protection for the entire organization with no additional administrative maintenance Tools to support and / or enforce your corporate policy GWGuardian user settings can be automatically set up and synchronized directly in Novell ConsoleOne and applied to multiple Novell edirectory (NDS) users.

11 GWGuardian 4.4 Installation & Configuration Guide GWGuardian Functionality By using a multi-layered GroupWise anti-spam and anti-virus defense with advanced SMTP security options, GWGuardian is a complete GroupWise mail firewall that prevents unauthorized use of GroupWise Internet Agent (GWIA), blocks scan attacks, and enforces authentication of users sending . GWGuardian also blocks messages based on real-time blacklists (RBL), limits the number of simultaneous connections, and rejects connections from specified addresses or IPs, as illustrated in Figure 2. Figure 2: GWGuardian s place in the flow GWGuardian is compatible with any mail server, including Novell GroupWise x. The gateway is deployed safely behind the corporate firewall through a single connection, effectively enhancing server security. Furthermore, GWGuardian provides gateway intelligence that features unique user-aware pre-authentication to prevent Denial of Service (DoS) attacks and caches authenticated users for optimal performance. Once a message is received by GWGuardian, it connects to the mail server to verify if the user exists; if not, the message is rejected Mail Gateway The mail gateway component of GWGuardian provides the receipt and local delivery of all your Internet mail. The process is transparent to the server. The most important features of the mail gateway are: SMTP Receiver Service Understands Simple Mail Transfer Protocol (SMTP) and Extended SMTP (ESMTP). Restriction of incoming message based on size. Efficient multithread worker-pool threading model for high-speed reception. Validation of Sending Host using Reverse DNS, Domain name validation, or Sender Policy Framework. Restriction of Sending Host through Real-Time Black Lists, Internal Domain, and IP Restriction Lists. User-Aware Pre-Authentication Validates recipient addresses against the destination mail system to reduce receipt of invalid messages. Dynamically creates and maintains a cached user list of all valid users on the destination mail system(s). Configuration Remote management console to configure single or multiple gateways across a LAN. Immediate recognition of configuration changes eliminating the necessity for system restarts. Simple service start/stop & configuration controls from within the Administration console. Dial-up Support Support for intermittently-connected clients. Support for intermittent connectivity to the Internet.

12 GWGuardian 4.4 Installation & Configuration Guide 12 Performance Monitors Interfaces to Windows Performance Monitor. Five monitored services. Comprehensive performance counters. Logging Create three types of log files: Text, Event Viewer and ODBC. 18 separate log sub-categories. Automated Log File management with log cycling and clean-up. Reliability Self-restarting services. Mail Server Cloaking Hide your source mail server from the outside world. If checkbox is enabled, the system will remove the route information from the message header so that analysis of the MIME message will make it appear as if the message originated from GWGuardian as opposed to your internal mail system Perimeter Protection All GWGuardian versions provide 9 layers of security to protect your server from abuse by spammers: The Protocol filter recognizes known header patterns and rejects them immediately, without consuming system resources to accept and process the message. The SMTP Security automatically scans the sending host domain and IP address information in search of accepted or rejected address patterns. The Mail Relay is a configurable IP-based authorization system that lets you control who can and cannot relay on your corporate server. The Block Scan Attack layer counts the volume of transactions coming from a single source and either blocks or progressively slows the exchange process, thus making the server counter-productive to any spammer. The Reverse DNS Lookup sends a request to the sender s domain IP address before it accepts any . If the IP returns a negative check, the is bounced. The Real-Time Blacklists (or blackholes) layer compares the sender s name to different configurable spammer blacklists and blocks any processed by a blacklisted sender. This is an optional feature that can be set according to your corporate policies. The Connection Limit prevents a user (an IP address) to perform simultaneous operations in the server. The Block Connections layer is a configurable filter that blocks specific IP addresses or domain names from sending . Sender Protection Framework (SPF) allows you to detect whether an is being sent from a legitimate IP address and to block s sent from forged (or spoofed ) IP or domain addresses Attachment Blocking Explicitly block attachments by filename or extension. Optional Fingerprinting feature to validate attachment types through attachment scanning. Use of wildcards in attachment blocking. Ability to send notification messages to both sender and recipient regarding potentially harmful content.

13 GWGuardian 4.4 Installation & Configuration Guide Virus Filtering GWGuardian includes a powerful, built-in anti-virus engine. This engine is integrated to the core of the program for optimal performance and reliability. The anti-virus engine included with your copy of GWGuardian depends on your license. GWGuardian Enterprise Edition uses the McAfee AV engine. GWGuardian Advanced Edition uses the Norman Data Defense AV engine. McAfee, Inc. is a leading provider of network security and availability technology, offering best-in-class solutions for the enterprise. The McAfee award-winning antivirus scanning engine is integrated into GWGuardian Enterprise Edition, delivering iron-clad security to GroupWise users around the world. For more information, visit their website at Norman Data Defense, Inc. is an industry-acclaimed, award-winning anti-virus vendor. They have won numerous technical excellence awards in the anti-virus field, including % Awards from Anti-Virus Bulletin. For more information, visit their website at Virus scan engine Inbound and outbound message scanning. Scan messages when relaying to an external server. Specify anti-virus scanning by system, domain or user levels. Auto-updates Download auto-updates directly from Messaging Architects. Download frequency is adjustable. Option to accept high-priority updates and bypass QA tests. Option to use HTTP-S to download updates. Notifications Option to notify administrator-specified mailbox. Option to notify sender and recipient of detected virus. Administrator-specified alert messages. Plain text or HTML notifications. Specify alert from administrator-defined file. Performance Cache last positive anti-virus identifications. Specify size and time limit of cache retention. Option to bypass large attachments. Virus handling Option to delete the infected file or move to quarantine. Option to specify scanning order between virus and attachment scanning. Quarantine Quarantine interface integrated into Administration Console. Quarantine reports for end-user management of contents. Option to notify administrator-specified mailbox. Option to notify sender and recipient of detected virus. Administrator-specified alert messages.

14 GWGuardian 4.4 Installation & Configuration Guide 14 Plain text or HTML notifications Spam Filtering GWGuardian includes powerful and flexible anti-spam tools that protect your system from abuse from unsolicited bulk . These systems are 100% configurable to provide you the exact level of protection you need. In addition to these tools, GWGuardian offers you the full power of the Sieve filtering language, allowing you to build truly versatile spam filtering scripts. The most important features of the GWGuardian multi-layered Anti-Spam Engine are: Protocol Filter Filter messages at the protocol level. Block messages based on the following header fields: To, From, Subject, Received, Hello, Mailfrom, Rcptto and X-Advertisement. Specify protocol filter from file. SMTP Security Enable full VRFY support. Support SMTP authentication. Force SMTP authentication for suspect IP addresses. Validate sender addresses and malformed addresses. Mail Relaying Limit mail relaying to trusted hosts or domains. Route outbound messages from mail server to GWGuardian for scanning and processing. Block scan attack Limit the maximum number of recipients. Slowdown or block IP addresses. Cache connections by number of entries and lifetime. Reverse DNS lookup Perform reverse DNS lookup for the SMTP host. Cache DNS lookup results. Connection limits Limit connections by total number of connections to host. Limit connections by simultaneous connections from single IP. Mail connections Reject all incoming mail from specified hosts or IP addresses. Real-Time Blacklists (RBLs) Lookup SMTP hosts in Real-Time Blacklist (RBL) hosts. Administrator-specified RBL hosts. Exclude trusted IP addresses from lookup. Cache RBL lookup results. Lookup SURBLs. Trusted Senders Lists Administrator-specified list of IP addresses which automatically bypass Block Scan Attack filter, reverse DNS lookup and RBL lookup.

15 GWGuardian 4.4 Installation & Configuration Guide 15 Ensure that mail from specific domains and addresses will always get through. Configurable at the server, domain and user levels. Blocked Senders Lists Block mail from specific domains and addresses. Configurable at the server, domain, and user levels. Sequential Content Analyzer Performs advanced metrics analysis on message content. Determines whether message content is good or spam. Filters and processes messages according to your specifications (e.g. quarantine, delete, or tag and deliver spam messages). Automatic updates of filter engine. Language Filtering GWGuardian provides the option to scan for foreign language content: Scanning for language content occurs: - After virus and attachment scanning - After the trusted and blocked lists - Before Spam scanning by the SCA engine Custom filters based on language content are supported and trusted addresses bypass language filtering. Messages containing words or characters in several languages are given a language probability rating based on weight of the content. For example, if the bulk of a message is in Italian, GWGuardian will consider it as such and this is the code that will appear in the header envelope. The probability rating determines whether the message is filtered or not. - If the bulk of a message is in a permitted language, but contains words or characters in blocked languages, the message will pass through. Messages considered Spam are displayed in the low spam probability section of the Quarantine Reports and can be released by the end user. Sieve filters GWGuardian offers you the full power of the Sieve filtering language, allowing you to build versatile custom spam filtering scripts. Create multiple custom scripts. Cascade scripts for maximum flexibility. Verify syntax of script with Sieve compiler. Supports regular expression (regex) and body purification extensions. Create custom rules based on language, such as exclusion rules. Anti-Phishing/Spoofing Protection (SPF) Checks with the sender s DNS server to look for IP class or domain name forgery. Sieve is a proposed standard for an Internet mail filtering scripting language. It can be used in a wide range of applications, and is particularly useful in defining spam-filtering rules. Sieve is defined under RFC For more information on Sieve, visit the following site:

16 GWGuardian 4.4 Installation & Configuration Guide GWGuardian Administration Console The GWGuardian Administration Console (Figure 3) is where all GWGuardian elements come together. The Administration Console was designed for maximum flexibility and ease of use, and is organized in a coherent manner to assist with both day-to-day operations and in-depth system configuration. For a detailed description of all the options, refer to Basic Configurations onwards. Figure 3: GWGuardian Administration Console Administration Console Find feature allows system-wide searches. Functions grouped for easy day-to-day administration. Intuitive delegation of system, domain and user parameters. Flexible quarantine interface for easy management. Integrated mail server, attachment, anti-spam, and anti-virus administration tools (where applicable). Added System Trusted Senders list and System Blocked Senders list support at the server, domain and user levels (where applicable). Web-Based Administration End users have web access to their quarantine contents. End users can set their own scanning parameters, Trusted Senders lists and Blocked Senders lists from the web. GWGuardian administrators can configure and manage GWGuardian using GWGuardian Web Administration.

17 GWGuardian 4.4 Installation & Configuration Guide 17 Delegation For optimal flexibility, GWGuardian allows certain settings to be specified at three different levels: system-wide, per domain, or per user (Figure 4). There are three levels at which preferences can be set: Server-level preferences affect all domains and users on the server. If you set the server-level preferences and do not grant override permission, all your users in all your domains will inherit these preferences. Domain-level preferences affect all the users in a specified domain. When you set a domain-level preference, it overrides the server preferences if override permission is granted, and will apply to all users in that domain. User-level preferences affect only the individual user. When you set a user-level preference, it will override the domain preferences and the server preferences if override permission is granted. Figure 4: Delegation in GWGuardian

18

19 GWGuardian 4.4 Installation & Configuration Guide 19 2 Upgrading and Uninstalling GWGuardian 2.1 Upgrading to Version 4.4 from GWGuardian 4.3 There are no changes to the installation procedure when upgrading to GWGuardian v4.4 from v4.3. Please skip the following sections, and see Installing GWGuardian. 2.2 Upgrading to Version 4.4 from GWGuardian 3.x and 4.0 Please read the following sections carefully before performing an upgrade to GWGuardian v4.4. This latest release of GWGuardian supports the 1 to 1 licensing model first introduced in GWGuardian 4.2 whereby the number of users in your GWGuardian list must match the number of actual users on your GroupWise. If the number of users in your GWGuardian list exceeds the number of users you have been licensed for, you probably have multiple entries for the same user under different aliases. If this is the case, you will need to consolidate these multiple users to a single user to follow the 1:1 license ratio before upgrading to GWGuardian 4.4 using the GroupWise Alias Update Wizard GroupWise Alias Update Wizard The GroupWise Alias Update Wizard allows GroupWise administrators to synchronize the number of users in the GroupWise system with the number of users in GWGuardian. System administrators can also configure and schedule the GroupWise Alias Update Wizard to run automatically to perform a variety of administrative tasks. For more information, see the GroupWise Alias Update Wizard Guide. With the GroupWise Alias Update Wizard, system administrators can: Create new users on a fresh GWGuardian system by taking existing GroupWise users and prepopulating the GWGuardian user list with all users and their corresponding aliases. Consolidate user lists on a GWGuardian system by creating the correct aliases for users. Add new users to GWGuardian when new users are added to the GroupWise system and populate the user list with the corresponding aliases for any new users. Remove users from GWGuardian if users are removed from the GroupWise system, freeing up available GWGuardian licenses for new users. If you are currently running a GroupWise 5.5 Internet Gateway, you will be required to implement some sort of pre-authentication mechanism as that version of the gateway does not validate users through SMTP and can cause the licensing count to be exceeded quickly. Version 4.4 supports native edirectory authentication. Please refer on how to implement this type of authentication in the appropriate section of this document. Once you have implemented aliasing, there are no changes to the installation routine when upgrading to GWGuardian v4.4 from GWGuardian v4.0 or earlier: Launch the GWGuardian.exe file. Update the MDAC version if prompted and reboot the computer. Backup the current configuration. Select the components to install: mail and/or web. Restart the services. In the case of a GWGuardian upgrade, you will NOT be able to edit the installation path.

20 GWGuardian 4.4 Installation & Configuration Guide 20 Figure 5: Upgrading to GWGuardian 4.x It is highly recommended to back up your existing mail server configuration and Web component pages. The installation will stop the necessary services and will warn about the WebQuarantine site customization. 2.3 Uninstalling GWGuardian To uninstall GWGuardian, go to Add/Remove Programs in your configuration panel, select GWGuardian and click Uninstall. Figure 6: Uninstalling GWGuardian

21 GWGuardian 4.4 Installation & Configuration Guide 21 3 Installing GWGuardian A successful installation of GWGuardian requires a step-by-step completion of the following checklist. Once all of the procedures outlined below have been carried out in the appropriate order, you should be able to enjoy the full functionality of GWGuardian advanced messaging firewall. GWGuardian Checklist Done 1. System Preparation Hardware requirements Software requirements Static IP Address 2. Pre-Installation Tasks Disable port 25 Set DNS Suffix Install IIS Install GWGuardian 3. Deploying GWGuardian Domain Configuration GroupWise GWIA Configuration Advanced Installation Options Connection settings Test Inbound 4. Basic Configurations Redirect Incoming Internet through GWGuardian GWGuardian System-Level Configurations Define User Aliases & Nicknames Security Configurations Attachment Policy Configurations Virus Preference Configurations 5. Advanced Configurations Anti-Spam Engine Configurations Domain-Level Configurations User-Level Configurations Quarantine Report Configurations Web Portal Configurations

22 GWGuardian 4.4 Installation & Configuration Guide System Preparation In order to run GWGuardian successfully, your system must meet the hardware and software requirements outlined in the table below: Minimum System Configuration 2.4 GHz Intel processor or equivalent; Windows 2000/2003 Server; At least 512 MB RAM; ATA 100 hard drive; Network connection; DNS servers accessible through server; Internet Explorer 6.0 or higher; MDAC 2.8 SP1; Recommended System Configuration Dual Xeon processor; Windows 2000/2003 Server 1 GB RAM; SCSI hard drive (RAID 0 or better); Ethernet connection; DNS servers accessible through server; Internet Explorer 6.0 or higher; IIS (for the web components); MDAC 2.8 SP1; For performance reasons, Messaging Architects recommends that you do not install MSSQL on the same server as GWGuardian. 3.2 Pre-Installation Tasks Before installing GWGuardian on a Windows 2000 / 2003 machine, make sure the following are properly configured. If these items are not properly configured, GWGuardian might not install or run properly. Messaging Architects advises that Automatic Microsoft Updates be turned OFF. Updates should be applied manually so that any issue with operability can be addressed immediately through a backup of the update Static IP Address The GWGuardian server must have a static IP. Configure your server to use a static IP address by selecting your network connection which will be used by GWGuardian. For Windows 2003: Go to Control Panel > Network Connection > Local Area Connection > Properties. Select Internet Protocol (TCP/IP) > Properties. Select Use the following IP address and enter the required data. For Windows 2000: Go to Control Panel > Network and Dial-up Connections > Local Area Connection > Properties. Select Internet Protocol (TCP/IP) > Properties. Select Use the following IP address and enter the required data Disable Port 25 Since Microsoft s built-in SMTP service in Windows 2000 also uses port 25, it must either be disabled or set to manual. To do so, choose Control Panel > Administrative Tools > Services. Look for the Simple Mail Transport Protocol (SMTP) service and set it to Manual or Disabled.

23 GWGuardian 4.4 Installation & Configuration Guide Set DNS Suffix on GWGuardian Server The domain name must be specified in the Computer Name / Network Identification properties of the GWGuardian server. To do so, follow the procedure below: For Windows 2003: Right-click My Computer, and then select Properties. Select the Computer Name tab and then click Change. Under Computer name, click More and enter the Primary DNS Suffix of this computer, which should equal your domain name (Figure 7). For Windows 2000: Right-click My Computer, and then select Properties. Select Network Identification and then click Properties. Under Computer name, click More and enter the Primary DNS Suffix of this computer, which should equal your domain name (Figure 7). Figure 7: Specifying your domain name on the GWGuardian server Click OK. You will be prompted to restart your system for the changes to take effect. You may disregard this request at this point and proceed with the GWGuardian configuration Install IIS Components GWGuardian has three web components that can be used via the Internet: WebQuarantine which allows end users to manage their quarantined mail. WebAdmin which allows administrators to perform administrative tasks. WebMonitor which allows administrators to view server activity statistics. If you plan on using the GWGuardian web components, check if the Internet Information Server (IIS) and the.net framework are installed. If they are not, first install IIS and then the.net framework. Once the two components have been installed, you will have to enable their access from the IIS Services Manager Interface. IIS must be installed before both the.net framework and the GWGuardian web components. To install IIS and ASP.NET, follow the respective procedure below: For Windows 2003: Start > Control Panel > Add or Remove Programs > Add/Remove Windows Components > Application Server > Details. Select ASP.NET > Internet Information Services (IIS) > Details > World Wide Web Service > Details. Select World Wide Web Service.

24 GWGuardian 4.4 Installation & Configuration Guide 24 Under Windows 2003 ensure that Active Server Pages and ASP.NET web server extensions are allowed (Figure 8). Figure 8: Enabling Active Server Pages and ASP.NET extensions For Windows 2000: Start > Settings > Control Panel > Add/Remove Programs > Add/Remove Windows Components. Select Internet Information Services (IIS) > Details. Select World Wide Web Server. If you get Error: 997, Overlapped I/O is in progress when starting GWGuardian services, it is probably due to the above steps not being fully completed. Review the above steps and try again. Performance varies greatly depending on the volume of mail transactions your mail server performs. Advanced features, such as anti-spam and Sieve scripts, may impact system performance. If you experience poor performance, consider disabling these features until you can upgrade your hardware. The two critical performance issues for your system are the available RAM on your server and the speed with which data is written to the hard drive. 3.3 Deploying GWGuardian This section tells you what you need to know for a first-time installation of GWGuardian. If you are upgrading from an older version of GWGuardian, refer to Upgrading and Uninstalling GWGuardian for details. Start the installation by double-clicking on the GWGuardian executable file. You must be logged onto the Windows 2000/2003 server with an Administrator account. If you are installing GWGuardian on Windows 2000/2003 server with Terminal Services already installed, it is recommended that you use the Add or Remove Programs option by choosing Start > Control Panel > Add or Remove Programs > Add New Programs (Figure 9).

25 GWGuardian 4.4 Installation & Configuration Guide 25 Figure 9: Installing GWGuardian through Add or Remove Programs Install Windows Components To run GWGuardian, you need to have the Microsoft.NET framework 1.1 and MDAC 2.8 installed on the machine. When you launch the GWGuardian installer program, it automatically detects if any of the components are missing and notifies you. In that case, exit the GWGuardian setup, install the necessary component(s) and restart the GWGuardian installation. Windows 2003 server comes already installed with the Microsoft.NET and MDAC components. However, you might need to install the.net 1.1 update. Figure 10: GWGuardian auto-detection of missing components IIS must be installed before both the Microsoft.NET framework and the GWGuardian web component. In terms of precedence, install the Microsoft.Net Framework first, followed by the MDAC 2.8 components.

26 GWGuardian 4.4 Installation & Configuration Guide Install GWGuardian After installing the necessary Windows components, follow the GWGuardian installation wizard. Review and then accept the license agreement and click Next (Figure 11 and Figure 12). Figure 11: GWGuardian Welcome screen Figure 12: GWGuardian EULA During the installation of GWGuardian, you will be prompted for a license key. This license key is provided to you at purchase, and is required to run GWGuardian.

27 GWGuardian 4.4 Installation & Configuration Guide 27 Figure 13: License key screen Enter your license key when prompted. The License key can be entered with or without the separating dashes or simply copied and pasted if the license key was sent by . Once the license key has been entered, click Validate. If your license key is valid, the information will appear in the installation window. Check the Product information details and click Next (Figure 14). License keys are product version specific. An Advanced Edition license (GWGuardian Advanced) will not work with the corporate version (GWGuardian Enterprise), so ensure you have downloaded the correct version if it was not provided on Messaging Architects-distributed media. Figure 14: License key validation screen You can access your license key information at any time after installation from the GWGuardian Administration Console by choosing System > License Key. If you have an evaluation key, or you need to renew your perpetual key or subscription, contact Messaging Architects Sales at or call (in USA and Canada) or (outside North America).

28 GWGuardian 4.4 Installation & Configuration Guide 28 You have the option of installing the following GWGuardian components (Figure 15): Figure 15: GWGuardian components Mail Component: Server and Administration Console: the core GWGuardian program & configuration console. Console Only: the Administration Console only for remote management of the GWGuardian server. Web Component: Provides end-user access to the quarantine, Trusted Senders and Blocked Senders settings. This option will be unavailable (grayed out) if IIS is not installed. It is possible to install the web portion on a separate web server. For configuration details, refer to Deploying Web Components on a Different Server. If the installer does not allow you to install a specific component, check your system configuration and make sure you are not missing some of the Windows components necessary to install GWGuardian. For instance, the WebAdmin will not install if you do not have IIS 5 or above installed beforehand (refer to Install IIS Components). The installation program will ask for the destination folder of the Mail component (Figure 16). If desired, change the destination folder location and click Next.

29 GWGuardian 4.4 Installation & Configuration Guide 29 Figure 16: Mail Component Destination folder Do NOT try to install the web components within the GWGuardian directory (e.g., C:\Program Files\Messaging Architects\GWGuardian\Web). If you uninstall the web component at some point, this action may also cause GWGuardian to uninstall! If desired, enter the address of the postmaster of your primary mail server (Figure 17). All delivery failure notifications will be sent to this address (e.g., Figure 17: Configuring delivery failure notification If Send delivery failure notices is activated, a valid address must be entered. Messaging Architects does not recommend that this setting be used, so that delivery failure notifications will be sent to the users directly. GWGuardian installation can automatically configure IIS. Click Next to continue the installation. If you need to configure IIS manually, choose I will do it manually later, and click Next to continue the installation. For more information, see Manual Website Configuration.

30 GWGuardian 4.4 Installation & Configuration Guide 30 The installation needs to stop the IISAdmin. If you do not want to stop IISAdmin, you might have to reboot your server after the installation. Figure 18: IIS Configuration Due to performance and reliability fixes that were made to the GWGuardian monitoring service, we do not recommend that you continue to run the GWGuardian monitoring service without PostgreSQL. To proceed with the installation, ensure Yes is enabled and click Next (Figure 19). Historical statistical data will not be migrated. If you were using the GWGuardian monitoring service, please capture relevant graphs before continuing with the installation. Figure 19: Installation of PostgreSQL You will be prompted to confirm that you want to install PostgreSQL. Click Yes if you wish to proceed with its installation (Figure 20).

31 GWGuardian 4.4 Installation & Configuration Guide 31 Figure 20: Confirmation of Installation After confirming that you wish to install PostgreSQL, the installation will prompt you to enter a password for the Service Windows Account and for the Admin Account. Select your destination folder for the PostgreSQL server (Figure 21). Click Next to continue. Figure 21: PostgreSQL Service Windows Account Password Confirmation In order for GWGuardian to properly install, the IISAdmin and SNMP services must be stopped. Ensure that each service is enabled and click Next to continue (Figure 22). Figure 22: Stopping Services The installation wizard shows the folders where GWGuardian will be installed and the other configuration tasks which will be executed. Click Next to continue.

32 GWGuardian 4.4 Installation & Configuration Guide 32 Figure 23: Installation ready You will see a new window where applicable files are copied (Figure 24). Figure 24: Installing GWGuardian

33 GWGuardian 4.4 Installation & Configuration Guide 33 Figure 25: Installation status window A new window will temporarily appear stating that the data cluster is being initialized (Figure 26). Figure 26: Initializing the database cluster When prompted, click Yes to launch GWGuardian services and Yes to start IIS. At the end of the installation, you will be informed that the installation is successful (Figure 27) and a shortcut for the GWGuardian Administrator will be created on the desktop (Figure 28).