Updata Core Barracuda Spam and Virus Firewall Appliance Domain Delegation Administrator Guide

Transcription

1 Updata Cre Barracuda Spam and Virus Firewall Appliance Dmain Delegatin Administratr Guide Updata Infrastructure Ltd Versin th June 2013

2 Page 2 f 4 Overview Overview The purpse f this guide is t prvide custmers wh have requested delegatin f their SMTP dmain, a detailed guide n hw t use the Updata Cre Barracuda Spam and Virus Firewall Service. Hw t Access the Updata Cre Barracuda Spam & Virus Firewall 1.1 Thrugh a web brwser access the url: Enter the Username: & Passwrd: issued and click n Lgin Once lgged in click n Manage Dmain. 2. BASIC Tab 2

3 Page 3 f Status The Status page displays summary infrmatin fr this dmain n the Barracuda Spam & Virus Firewall and is rganized int the fllwing sectins: Statistics [inbund] Statistics [utbund] Hurly Mail Statistics [inbund] Hurly Mail Statistics [utbund] Daily Mail Statistics [inbund] Daily Mail Statistics [utbund] Statistics [inbund] This sectin displays the fllwing summary cunts: Blcked - Number f spam messages rejected by the Barracuda Spam & Virus Firewall. Blcked: Virus - Number f virus messages blcked by the Barracuda Spam & Virus Firewall. Quarantined - Number f messages sent t the glbal r per-user quarantine areas (as specified in the BASIC > Quarantine page). Allwed: Tagged - Number f messages tagged (subject line mdified per the BASIC > Spam Checking page). Allwed - Number f messages delivered t the intended recipient withut mdificatin. The summary als displays infrmatin fr the fllwing three (3) time perids: Ttal - Statistics fr the Barracuda Spam & Virus Firewall since installatin (r since the last reset). Day - Statistics fr the current calendar day (starting at midnight). Hur - Statistics fr the past 60 minutes. Statistics [utbund] This sectin displays the fllwing summary cunts: Blcked: Plicy - Number f utbund messages rejected by the Barracuda Spam & Virus Firewall due t vilatins f plicy. Blcked: Spam - Number f utbund messages rejected by the Barracuda Spam & Virus Firewall which were determined t be spam. Blcked: Virus - Number f utbund virus messages blcked by the Barracuda Spam & Virus Firewall. Quarantined - Number f utbund messages quarantined. Encrypted - Number f messages sent t the Barracuda Message Center fr encryptin and delivery. 3

4 Page 4 f 4 Redirected - Number f messages redirected. Sent - Number f utbund messages delivered t the intended recipient withut mdificatin. The summary als displays infrmatin fr the fllwing three (3) time perids: Ttal - Statistics fr the Barracuda Spam & Virus Firewall since installatin (r since the last reset). Day - Statistics fr the current calendar day (starting at midnight). Hur - Statistics fr the past 60 minutes. Hurly Mail Statistics [inbund] The breakdwn f inbund messages fr the last 24-hur perid. Hurly Mail Statistics [utbund] The breakdwn f utbund messages fr the last 24-hur perid. Daily Mail Statistics [inbund] The breakdwn f inbund messages fr the last 4-week perid. Daily Mail Statistics [utbund] The breakdwn f utbund messages fr the last 4-week perid. 2.2 Message Lg Lg Display The dmain Message Lg displays traffic that passes thrugh the Barracuda Spam & Virus Firewall fr this dmain. Under Lg Display yu can use the drpdwn t select viewing either Inbund, Outbund, r bth. The page is divided int 2 panes: The Message List, which cntains varius details f the messages. The Preview Pane, which is turned ff by default, but can display the cntents f a message n the right, left r bttm sectin f the page. Frm the Tl Bar abve the Message List, yu can use the Page cntrl t mve thrugh pages f the Message List, r yu can click the Deliver, Exprt, Mre Actins r Settings cntrls t take actins with selected messages r t cnfigure hw the Lg is displayed. Click n a message in the Message List t view it in the Preview Pane, r dubleclick n it t bring it up in a separate Message Details brwser windw and t dwnlad r deliver messages that have nt been blcked, encrypted r 4

5 Page 5 f 4 redirected. Things yu can d frm this page: Scrll thrugh and view messages Custmize the appearance f the display Take actin with the messages displayed in this page Filter the entries displayed T scrll thrugh and view messages: Click the left and right arrw buttns n either side f the Page cntrl n the Tl Bar t page thrugh the Message Lg. These buttns will be disabled when there are n mre messages t be displayed in the specified directin. Click an entry in the Message List t view it in the Preview Pane, r duble click the entry t view the message details in a ppup windw. If yu want t include the message cntents in the Message Details ppup, yur administratr must set the Shw Message Bdy in Message Lg ptin t Yes in the Message Lg Optins sectin f the BASIC > Administratin page. The Deliver and Dwnlad buttns in the message ppup enable the Admin r Dmain Admin t either deliver r dwnlad messages when the message bdy is available. These buttns will NOT be displayed fr messages that have been blcked r deferred by the Barracuda Spam & Virus Firewall, because there is nthing t deliver r dwnlad, under these cnditins: Sender IP address was rejected Sender dmain was blcked Sender address was blcked Recipient dmain/ address was blcked Message was deferred Message was blcked due t a virus Nte: If a message subject r cntents is nt readable, the message may have multi-byte characters in it. Enable multi-byte r Unicde character encding n yur Web brwser t see the message displayed crrectly. T custmize the appearance f the display: Resize clumn widths - Click n the edge f the clumn header that yu wish t mve and drag t yur desired width. Yur cursr will change t a duble bar with arrws pinting in bth directins when it is ver a mvable brder. Select clumns t display - Click the drp-dwn next t any clumn header and click Clumns. Check/uncheck the clumn(s) yu wish t add/remve 5

6 Page 6 f 4 frm the display. T reset the clumn selectins t the built-in settings, select Reset Clumns Frm the Settings drp-dwn n the tl bar yu can cnfigure: Messages Per Page - Select the number f messages t list n each page f the Message Lg. Preview Pane - The message preview pane can be displayed n the right, left r bttm f the BASIC > Message Lg page, r it can be turned ff. Select Preview Pane t cnfigure. T resize the preview pane, click n and drag the brder between the Message List and the preview pane. Cluster Settings - Select Only view lcal messages if yu dn't want the message lg t display messages received by ther Barracuda Spam & Virus Firewalls in the cluster. T take actins with messages: Select ne r mre messages using the check bxes n the left-hand side f the lg, then click the ne f the actin cntrls n the tlbar abve the message list: Deliver - attempt t deliver the selected message(s). Exprt - Exprt either selected r all messages t a CSV file: Exprt Selected - Save selected messages t a CSV file. Yu will be prmpted fr a file name t save t yur lcal desktp r netwrk. Exprt All - Save the entire message lg t a CSV file. Yu will be prmpted fr a file name t save t yur lcal desktp r netwrk. Mre Actins - Edit the whitelist with the fllwing selectins: Whitelist - Add the sending address(es) t the whitelist. Messages frm whitelisted senders bypass spam scring as well as all ther blcklists. Virus scanning still applies. Un-Whitelist - Remve the sending address(es) frm the whitelist. Submit t Barracuda Central As Spam - Classify the selected message(s) as Spam and send the selected message(s) t Barracuda Central fr further analysis, a prcess which results in imprved spam definitins and intent analysis. Submit t Barracuda Central As Nt Spam - Classify the selected message(s) as Nt Spam and send the selected message(s) t Barracuda Central fr further analysis, a prcess which results in imprved spam definitins and intent analysis. Message Lg clumns available are: Classified - Indicates whether the message has been classified as spam r nt spam by the administratr. N/A means the message bdy is nt available and the message cannt be classified. Sender Whitelisted - Sender is in the glbal whitelisted database. This reflects the current status f the sender and whether any new frm 6

7 Page 7 f 4 them wuld be whitelisted. It des nt indicate whether that particular message was accepted due t whitelisting. See the Reasn clumn fr message status. Time - Time and date when the arrived at the Barracuda Spam & Virus Firewall. Frm - Sender address (this may nt match the address in the headers that mail clients display t an end-user). T - Recipient address(es). CC and BCC recipients will shw up in separate lg entries in the Message Lg n the "T" field. Subject - Subject line f the message. Size - Message size in bytes. Nte: The size f an attachment file as indicated in the Size clumn and displayed in the Message Preview Pane is the encded size, which is generally larger than the actual file size. Actin - Allwed, Whitelisted, Tagged, Quarantined, Encrypted, Blcked r Deferred. Reasn - Reasn fr specific Actin may be ne f the fllwing: Subject - Actin was taken because f message subject. Scre - Actin was taken because f message scre. Virus - Message cntained a virus. Attachment - Actin was taken because f message attachment. Nte: The size f an attachment file as indicated in the Size clumn and displayed in the Message Preview Pane is the encded size, which is generally larger than the actual file size. External Blcklist - Sender IP address was present in an external blcklist. Rate Cntrl - Sender IP address exceeded maximum number f allwed cnnectins in a half-hur perid. The Actin taken is t defer any further cnnectin attempts frm that particular IP address until the next timeframe. Nte: Frutbund messages, if the number f utbund cnnectins frm a single (sender) address exceeds the specified Maximum cnnectins per Sender / 30 minutes threshld, the Barracuda Spam & Virus Firewall will defer any further cnnectin attempts frm that particular sender until the next time frame. 7

8 Page 8 f 4 Per-Cnnectin Message Limit Exceeded - Sender attempted t send t many messages in a single cnnectin. This is always a deferred cnnectin. Sender Timeut - Sender did nt respnd within required amunt f time. Invalid Dmain - "T" address was fr a user at a dmain nt filtered by this Barracuda Spam & Virus Firewall. Invalid Recipient - "T" address des nt exist n the mail server. N Valid Recipients - Nne f the specified "T" addresses exist n the mail server. Bdy - Actin was taken because f cntent in message bdy. Client - Actin was taken because f rule fr sender's IP address. Sender - Actin was taken because f rule fr sender's "Frm" address. Recipient - Actin was taken because f rule fr the "T" address. Per-User Sender - Actin was taken because f rule by recipient fr the sender. System Busy - The Barracuda Spam & Virus Firewall was temprarily nt accepting cnnectins because f high system lad, r maintenance being perfrmed. Recipient dmain name required - "T" address lacked a dmain name. Sender dmain name required - "Frm" address lacked a dmain name. Mail Prtcl Vilatin - The cmmunicatin frm the sending mail server was invalid r illegal. Sender Abrt - Remte system discnnected befre message transmissin was cmplete. Sender Reset - Remte system sent RSET cmmand t start the transactin ver befre message transmissin was cmplete. Server Reset - The Barracuda Spam & Virus Firewall reset the client cnnectin due t the relad f system settings. Sender Quit - Remte system sent QUIT cmmand befre message was cmplete. Header - Actin was taken because f rule fr ne f the headers. Message Size - Actin was taken because the message exceeded a certain size. Nte: The size f an attachment file as indicated in the Size clumn and displayed in the Message Preview Pane is the encded size, which is generally larger than the actual file size. SPF - Actin was taken because the Sender IP address was nt listed as an allwed sender fr the specified dmain using the SPF prtcl. 8

9 Page 9 f 4 Intent - Actin was taken because Intentin Analysis identified this message as a bulk/spam message. If there is an asterisk (*) in frnt f the URL, then it was a Real-Time Intent Analysis match, made against an RBL and nt against the Barracuda Spam & Virus Firewall s native Intent Analysis database. Reverse DNS (TLD) - The Barracuda Spam & Virus Firewall did a reverse DNS lkup n the IP address f the sender. The last part f the hstname (the TLD) assciated with the IP address matches a cuntry fr which an actin has been specified. Recipient Verificatin Unavailable - The Barracuda Spam & Virus Firewall recipient verificatin prcess was restarting when the message was received; the SMTP server will try re-sending the message after a perid f time. Per Dmain Client - Actin was taken because f rule fr sender's IP address as cnfigured n the DOMAINS > BLOCK/ACCEPT > IP Filters page. Per Dmain Sender - Actin was taken because f rule fr sender's "Frm" address as cnfigured n the DOMAINS > BLOCK/ACCEPT > Sender Filters page. Per Dmain Recipient - Actin was taken because f rule fr the "T" address as cnfigured n the DOMAINS > BLOCK/ACCEPT > Recipient Filters page. Scre - Spam scre. Encryptin Status - Indicates whether the message was received ver an encrypted TLS channel ( ), sent ut ver an encrypted TLS channel ( ) r received and sent ut ver an encrypted TLS channel ( ). Surce IP - Hstname (if available) and IP address f the sender. Delivery Status - The status f the message in the utbund queue if being delivered t the destinatin server. Delivery Detail - Details n the utbund status f the given message. T create and apply filters t the display: T filter the list f messages by any f the fields in the lg: 1. Select either Inbund and Outbund, Inbund r Outbund frm the drpdwn under Lg Display. 2. Frm the Filter drp-dwn, select a part f the message r a type f message n which t filter (i.e. Subject, Frm, T, Time Range, (spam) Scre, Blcked Messages, Valid Recipients Only, etc.). If yu are filtering n a specific message type (Whitelisted Messages, Quarantined Messages, etc.), skip t the last step. 3. Select a filtering peratr frm the secnd drp-dwn, such as cntains/desn't cntain r is equal t/nt equal t in relatin t the part f the message n which t filter. This selectin will be applied t a pattern yu enter. 9

10 Page 10 f 4 4. Finally, enter the pattern that is cntained r nt cntained in the part f the messages t filter. The filter criteria is nt case-sensitive and may nt include the special characters '\' r '/'. 5. Click + t specify additinal filters r - t remve a filter. When yu add a filter, an AND r OR buttn will appear between the text bx and the Search buttn. Clicking the buttn will tggle between AND and OR s yu can use either peratr with yur filters. 6. Click Search t see the matching results. T shw the unfiltered lg, with Select Filter displayed in the Filter drp-dwn, click Search. Pssible filters are: Time - Match messages sent within the specified time perid. Enter the Start year, mnth, day, hur and minute, and/r the End year, mnth, day, hur and minute. "Frm" + "Cntains" - Messages where any prtin f the "Frm:" field cntains the specified text. "Frm" + "Desn't cntain" - Messages where the "Frm:" field des nt cntain the specified text. "Frm" (full address) - Messages where the "Frm:" address matches exactly. "Frm" (username) - Messages where the first part f the "Frm:" address matches exactly. "Frm" (dmain name) - Messages where the dmain part f the "Frm:" address matches exactly. "T" + "Cntains" - Messages where any prtin f the "T:" field cntains the specified text. "T" + "Desn't cntain" - Messages where the "T:" field des nt cntain the specified text. "T" (full address) - Messages where the "T:" address matches exactly. "T" (username) - Messages where the first part f the "T:" address matches exactly. "T" (dmain name) - Messages where the dmain part f the "T:" address matches exactly. "Subject" + "Cntains" (slwest) - Match messages where the subject cntains the specified text. "Subject" + "Desn't cntain" (slwest) - Match messages where the subject des nt cntain the specified text. "Subject" + "Starts with" (fastest) - Match messages where the subject starts with the specified text. "Subject" + "Desn't start with" (fastest) - Match messages where the subject des nt start with the specified text. "Subject" + "Ends with" (slw) - Match messages where the subject ends with the specified text. 10

11 Page 11 f 4 "Subject" + "Desn't end with" (slw) - Match messages where the subject des nt end with the specified text. Allwed Messages - Messages that were allwed. Allwed r Whitelisted Messages - Messages that were allwed r whitelisted. Tagged Messages - Messages that were tagged. Quarantined Messages - Messages that were quarantined. Blcked Messages - Messages that were blcked. Abrted Messages - Messages that were abrted (sender discnnected r quit). Deferred Messages - Messages that were deferred. "Actin" + "Cntains" - Use this filter t specify a list f actins t be displayed (i.e. "Allw and Tag" r "Allw,Tag" r even "A,T"). "Actin" + "Desn't cntain" - Use this filter t specify a list f actins t be EXCLUDED in the display (i.e. "Allw and Tag" r "Allw,Tag" r even "A,T"). Whitelisted Messages - Messages that were allwed due t whitelisting. Encrypted Messages - Messages that were encrypted. Redirected Messages - Messages that were redirected. "Reasn" + "Cntains" - Reasn cntains the fllwing text (slw). This filter must nt include the special characters '(', ')', '\', '[', '], '/' r '@'. "Reasn" + "Desn't cntain" - Reasn des nt cntain the fllwing text (slw). This filter must nt include the special characters '(', ')', '\', '[', '], '/' r '@'. "Scre" + "Is equal t" - All messages with a scre equal t the specified scre (specifying 3 will match ; specifying 3.00 will nly match 3.00). "Scre" + "Nt equal t" - All messages with a scre that is NOT equal t the specified scre (specifying 3 will match ; specifying 3.00 will nly match 3.00). "Scre" + "Less than" - All messages with a scre less than the specified scre. "Scre" + "Greater than" - All messages with a scre greater than the specified scre. "Scre" + "Range" (X,Y) - Enter the lwer limit (X), then a cmma, fllwed by an upper limit (Y). All messages with a scre greater than r equal t X and less than r equal t Y. "Surce IP" + "Cntains" - The cnnecting IP, r reslved hstname, cntains the specified text. "Surce IP" + "Desn't cntain" - The cnnecting IP, r reslved hstname, des nt cntain the specified text. "Message" + "Cntains" - All messages cntaining the specified text. Warning: this may fail r take an exceptinally lng perid f time with a large Message Lg. "Message" + "Desn't cntain" - All messages that dn't cntain the specified text. Warning: this may fail r take an exceptinally lng perid f time with a large Message Lg. Valid senders nly - Messages where a valid "Frm:" address was specified. 11

12 Page 12 f 4 Valid recipients nly - Messages where a valid "T:" address was specified. ID (X-ASG-Debug-ID)" + "Is equal t" - Message with the unique ID number yu enter. ID (X-ASG-Debug-ID)" + "Nt equal t" - Messages that d nt match the unique ID yu enter. 2.3 Spam Checking Spam Scring Limits It is recmmended t enable spam scanning fr the dmain by setting Spam Scan Enabled t Yes. WARNING: If yu set Spam Scan Enabled t N, messages fr user accunts with this dmain will NOT be scanned and will nt have spam scres. Once a message has passed the initial Barracuda Spam & Virus Firewall blck/accept filters, it is given a scre that indicates its spam prbability. This scre ranges frm 0 (definitely nt spam) t 9 r greater (definitely spam). Based n this scre, the Barracuda Spam & Virus Firewall can take ne f the actins listed belw fr yur dmain. Nte: A setting f 10 fr any f the settings belw disables that ptin. Blck - Messages scring equal t r greater than the Blck threshld are nt delivered t the recipient. Quarantine - Messages scring equal t r greater than the Quarantine threshld, but belw the Blck threshld are quarantined. Messages are sent t a designated mailbx (specified in the BASIC > Quarantine screen), r int Per-User quarantine (if available). Tag - Messages scring equal t r greater than the Tag threshld, but belw the Quarantine threshld are delivered t the sender. Tagged messages cntain a subject line f the message with the text specified in the Subject Tag as defined at the glbal level. 2.4 Virus Scanning With virus scanning enabled, all messages prcessed by the Barracuda Spam & Virus Firewall are checked fr viruses. Detected viruses will nt be quarantined r delivered t the intended recipient - even if the message has been whitelisted by a Blck/Accept filter. The recmmended value is Yes t enable Virus Scanning. 12

13 Page 13 f Quarantine Quarantine Settings Quarantine Type - Set t Per-User t allw users assciated with this dmain t have and cntrl their wn quarantine inbx. Per-User quarantine allws users t specify whether t receive their quarantined mail with a special identifier prepended t the subject line, r t stre the mail n the Barracuda Spam & Virus Firewall. Nte: If yu set Quarantine Type t Glbal, make sure t enter a value fr Glbal Quarantine Addresses described belw. Glbal Quarantine Address - All quarantined fr addresses at this dmain will be sent t this address if Quarantine Type is set t Glbal. Enable User features - If set t Yes, user will be able t cnfigure whitelisted and blacklisted dmains, quarantine message language, enable/disable and ntificatins, spam settings and set their Passwrd in their quarantine area. Yu can limit which f these settings the user can see and cntrl frm the USERS > User Features page. Nte: With per-user quarantine enabled, if user features are enabled, then disabled, r if per-user quarantine is later disabled, accunt hlders will lse previusly cnfigured per-user settings. Fr example, if an accunt hlder has created a whitelist and blacklist in his/her accunt and the quarantine, the accunt hlder's whitelist/blacklist will be remved and cannt be restred. 2.6 IP Cnfiguratin Destinatin Mail Server TCP/IP Cnfiguratin The destinatin mail server is the real mail server where the final destinatin fr inspected messages fr this dmain is lcated. This is usually the riginal mail server befre yu installed the Barracuda Spam & Virus Firewall. Destinatin Server Name/IP - IP address r hstname that receives after the spam and virus scans. It is usually best t use a hstname rather than an IP address s that the destinatin mail server can be mved and DNS 13

14 Page 14 f 4 updated at any time withut any changes t the Barracuda Spam & Virus Firewall. Nte: If yu set Use MX Recrds belw t Yes, yu must enter a dmain name fr this field. If multiple servers are specified, then the delimiter used determines the behaviur: Cmma (",") r semi-cln (";") - Each entry in the list will use in rund-rbin fashin, with relative weights determined by the number f times a particular entry is listed. Space (" ") - Each entry in the list will be treated as a failver list, with an entry getting used nly if all entries preceding it in the list are unreachable. Dest. (TCP) Prt - The prt (usually 25) ver which the destinatin mail server receives inbund . If multiple destinatin mail servers are specified they must all use the same prt. Valid Test Address - T test that the Barracuda Spam & Virus Firewall can successfully send messages, enter an address in this field and click the Test SMTP Cnnectin buttn. The system sends a message t the address yu specify. The Frm address in this is smtptest@barracudanetwrks.cm. Use MX Recrds - Set t Yes if the Destinatin Server listed abve is actually a dmain and mail shuld be frwarded t the apprpriate MX recrds. If yu set this field t Yes, yu must enter a dmain name fr the Destinatin Server Name/IP. Recmmended setting is N. 2.7 Reprts The Barracuda Spam & Virus Firewall prvides reprts based n bth inbund and utbund . Reprt frmat is either HTML, PDF r text as cnfigured by the administratr. Nte that, fr reprts that list inbund messages that have been tagged, quarantined r blcked due t RBL matches, subject r bdy filters, SPF vilatins r attachment filters, utbund messages that are blcked by any f these layers are als included in the message cunt r IP address cunt. Generate Reprt The fllwing fields enable yu t select, view and a reprt: Reprt Type - Lists all available reprts, which are described in the table belw. Select ne t run r t . Date Range - Select a date/time windw f 7 days r less if yu are viewing a reprt n the screen; if yu are ing the reprt, yu can select a wider time frame. 14

15 Page 15 f 4 Reprt T - The reprt can either be viewed n-screen by clicking the Shw Reprt buttn, r it can be queued fr delivery t the designated address(es) after the reprt is generated by clicking the Reprt buttn. Separate addresses (reprt recipients) by cmmas. ed reprts are added t a queue, and nly ne reprt is created at a time t prevent verlading the Barracuda Spam & Virus Firewall resurces. Nte: Generating a reprt t view instead f sending as an can ptentially cnsume excessive system resurces n the Barracuda Spam & Virus Firewall. Fr this reasn, discretin shuld be used when deciding n the date range a given reprt is t cver. T minimize impact f reprt generatin n the Barracuda Spam & Virus Firewall perfrmance, reprts f ver 7 days in length can nly be generated thrugh . Reprt Types All reprts with parameters and available chart types are listed in the table belw. Reprt Type Tp Spam Senders (Frm) Tp Spam Recipients (T) Infrmatin Reprted Fr all senders f spam messages: Date/time range f data Hst/dmain name f sender and IP address Cunt, r number f spam messages sent in timeframe Pie, hrizntal bar r vertical bar graph f: Number f spam messages sent by IP address Fr all recipients f spam: Date/time range f data address f each f tp spam recipients Cunt, r number f spam messages received in timeframe Pie, hrizntal bar r vertical bar graph f: Number f spam messages received by address 15

16 Page 16 f 4 Tp Recipients Tp Viruses Tp Attachments Tp SPF Vilatins Tp Bdy Filters Fr all users: Date/time range f data address f tp recipients Cunt, r number f messages received in timeframe Pie, hrizntal bar r vertical bar graph f: Number f messages received by address Fr the system: Date/time range f data Name f virus identified Cunt, r number f viruses identified in timeframe Pie, hrizntal bar r vertical bar graph f: Number f ccurrences f viruses by virus name Fr all attachment types: Date/time range f data Attachment type Cunt, r number f attachments by type that were blcked, quarantined, encrypted r redirected Pie, hrizntal bar r vertical bar graph f: Number f attachments by type that were blcked, quarantined, encrypted r redirected Fr inbund messages received: Date/time range f data Hst/dmain name f senders f messages failing SPF checks Cunt, r number f messages failing SPF checks Pie, hrizntal bar r vertical bar graph f: Number f messages failing SPF checks by IP address f sender Fr all inbund and utbund mail: Date/time range f data Tp bdy filters that caused blcking, tagging, encrypting, redirecting r whitelisting Cunt, r number f messages blcked, quarantined, tagged, encrypted, redirected r whitelisted Pie, hrizntal bar r vertical bar graph f: Number f messages blcked, quarantined, tagged, encrypted, redirected r whitelisted fr each bdy filter listed 16

17 Page 17 f 4 Tp Subject Filters Tp RBL Matches Spam Scring Breakdwn Tp Sender based n Message Size Tp Surce IP based n Message Size Fr all inbund and utbund mail: Date/time range f data Tp subject filters that caused blcking, tagging, encrypting, redirecting r whitelisting Cunt, r number f messages blcked, quarantined, tagged, encrypted, redirected r whitelisted Pie, hrizntal bar r vertical bar graph f: Number f messages blcked, quarantined, tagged, encrypted, redirected r whitelisted fr each subject filter listed Fr all IP addresses sending inbund mail: Date/time range f data Tp RBL hst/dmain name and IP addresses Cunt, r number f messages cming frm surces matching RBLs Pie, hrizntal bar r vertical bar graph f: Number f messages per RBL IP address Fr all inbund and utbund messages received: Date/time range f data Spam scre ranges f 0-1, 1-2, 2-3, etc. up t 10 Cunt, r number f messages scred in each range Pie, hrizntal bar r vertical bar graph f: Number f messages versus spam scre range Fr all senders f inbund and utbund mail: Date/time range f data address f tp sender based n message size Size f largest received messages in bytes Pie, hrizntal bar r vertical bar graph f: Message size, in bytes, by address f sender Fr surce IP addresses f inbund and utbund mail: Date/time range f data Hst/dmain name and IP address f tp surce based n message size Size f largest received messages in bytes Pie, hrizntal bar r vertical bar graph f: Message size, in bytes, by sender IP address 17

18 Page 18 f 4 Tp Outbund Sender based n Message Cunt Fr senders f utbund mail: Date/time range f data address f tp sender based n message cunt Cunt (number f messages sent) fr the time frame Pie, hrizntal bar r vertical bar graph f: Message cunt by sender address Tp Outbund Sender based n Message Size Tp Outbund Surce IP based n Message Cunt Tp Outbund Surce IP based n Message Size Fr surce IP addresses f utbund mail: Date/time range f data address f tp sender based n message size Size f largest received messages in bytes Pie, hrizntal bar r vertical bar graph f: Message size, in bytes, by address f sender Fr senders f utbund mail: Date/time range f data Hst/dmain name and IP address f tp sender based n message cunt Cunt (number f messages sent) fr the time frame Pie, hrizntal bar r vertical bar graph f: Message cunt by sender IP address Fr all utbund mail: Date/time range f data Hst/dmain name and IP address f tp surces f utbund mail by message size Size f largest utbund messages in bytes Pie, hrizntal bar r vertical bar graph f: Message size by sender IP address 18

19 Page 19 f 4 3. BlOCK/ACCEPT 3.1 IP Filter Allwed IP/Range Add any IP addresses r netwrks t whitelist here. Use a netmask f t add an individual IP address. Whitelisted IP addresses/netwrks bypass spam scring as well as all ther Blacklists. Virus scanning still applies. Blcked IP/Range Add any IP addresses r netwrks t here that yu want t blck, tag r quarantine. Use a netmask f t add an individual IP address. 3.2 Sender Filters Click Add after adding each entry fr the plicy sectins belw. T mdify an entry that is already in the table, click the Bulk Edit buttn. T remve an entry, click the trash can icn ( ). Allwed Addresses and Dmains Add any dmains, subdmains, and/r senders whse messages will always be accepted, r "whitelisted" (e.g. supprt@barracudanetwrks.cm) per the fllwing cnditins: Messages frm whitelisted senders bypass spam scring, Intent Analysis, Bayesian filtering, and keywrd filters. Virus scanning and rate cntrl are still applied. Valid entries fr the Address/Dmain fields are dmains, individual addresses, r TLDs (tp level dmains). Warning: 19

20 Page 20 f 4 Spammers can use a whitelisted address t bypass filtering; as such, IP whitelisting is a mre reliable way t identify trusted dmains. Blcked Addresses and Dmains Add any dmains, subdmains, and/r senders whse messages will always be blcked, r "blacklisted" (e.g. spammer@spammingcmpany.cm). Yu can chse t blck, tag r quarantine messages. Blcking a dmain autmatically blcks all subdmains. Valid entries fr the Address/Dmain fields are as described abve. Blacklisting addresses is nt recmmended. This is due t the fact that spammers rarely, if ever, use the same sender address mre than nce. Cnsequently, adding such addresses t a blacklist culd eventually increase unnecessary lad n the Barracuda Spam & Virus Firewall as it cmpares sender addresses t an ever-grwing blacklist that may be f n value 3.3 Recipient Filter Click Add after adding each entry fr the plicy sectins belw. T mdify an entry that is already in the table, click the Bulk Edit buttn. T remve an entry, click the trash can icn Allwed Addresses and Dmains Add any recipients t "whitelist". Listed recipients' messages are nt scred fr spam but are still checked fr viruses. Whitelisted recipients can als have sme messages blcked due t IP cntrls. Valid entries fr the Address/Dmain fields are dmains, individual addresses, r a pattern f addresses. Entries in the Address/Dmain field shuld be in ne f the fllwing frmats: /@mydmain.cm/ - Whitelists all addresses that end with "@mydmain.cm". /mydmain.cm/ - Whitelists all address in all subdmains f mydmain.cm, in additin t mydmain.cm. user@dmain.cm - Whitelists nly that ne address. /list-.*@dmain.cm/ - Whitelists all addresses in "dmain.cm" that start with "list-" (e.g., list-reply@dmain.cm, list-ntify@dmain.cm, listbunce@dmain.cm, etc.) Blcked Addresses and Dmains Add any recipients t "blacklist". Listed recipients, with blcking selected, d nt receive messages that are nt whitelisted by IP, sender dmain, r sender address. If quarantine r tag is selected and these messages match in anther spam filter layer, then these recipients' messages may still have their blcked. 20

21 Page 21 f 4 Valid entries fr the Address/Dmain fields are as described abve. 3.4 Sender Authenticatin Reg.rg Exemptins If a dmain is registered at the Barracuda Spam & Virus Firewall will allw all frm that dmain. If, hwever, yu want all frm any dmains that are registered at Reg.rg t underg header, subject and bdy filtering, yu can add them t this table as an exemptin t that rule. If yu put any dmain in the Blcked Sender Dmain/Subdmain table that is ALSO registered at Reg.rg, the Barracuda Spam & Virus Firewall will blck all frm that dmain. 4. USERS Tab 4.1 Accunt View With the Accunt View page, yu can view, edit, delete and change passwrds n accunts, depending n yur rle and assciated permissins. If yur accunt permissins allw, yu will be able t click the Edit Rle link in the Administratr Actins clumn and change the rle fr that accunt n the Edit Rle ppup. Yu'll als be able t access details abut rles frm the help buttn n the ppup. Accunts are nly assciated with inbund mail. View and Mdify Accunt Infrmatin Filter the entries displayed Custmize the display User Accunt Cleanup Accunt View This sectin displays a list f all per-user accunts fr this dmain. A filter is prvided t limit the display t nly users with specific attributes (e.g., users with quarantine disabled). The ttal number f accunts fund is displayed next t the filter and reflects the results f applying that filter. The fllwing attributes are available: Accunt Address - The address f the per-user accunt. Rle - The rle assciated with the accunt: User, Helpdesk, Dmain Admin Ntify Interval - Reflects the user's selected interval fr quarantine ntificatins: Daily 21

22 Page 22 f 4 Weekly Never Quarantine - The status f the user's quarantine. If "yes", then the user's quarantine inbx has been enabled, and all quarantined messages will be stred in the user's quarantine accunt. If "n", then all quarantined mail is frwarded t the intended recipient's mailbx instead f being placed in quarantine. Spam Scan - The status f spam scanning fr the user. If "yes", then all mail addressed t that user will underg spam scanning. If "n", then any messages where that user is the nly recipient will nt be scanned fr spam. Size (KB) - The current size f the user's quarantine area in KB. It is helpful fr Retentin Plicies (if enabled), and can be useful in determining which users are nt cleaning ut their quarantine areas. Message Cunt - The current number f items in a user's quarantine area. It is helpful fr Retentin Plicies (if enabled), and can be useful in determining which users are nt cleaning ut their quarantine areas. Oldest Message - This is the ldest message in a user's quarantine area. It is helpful fr Retentin Plicies (if enabled), and can be useful in determining which users are nt cleaning ut their quarantine areas. Administratr Actins - List f basic actins available t an Administratr t manage a particular user's accunt: are: Edit Accunt Edit Rle Change Passwrd Delete Accunt Fr additin and remval f specific features, g t the USERS > User Features tab. T create and apply filters t the display: 1. Frm the filter drp-dwn, select ne f the accunt characteristics n which t filter (i.e. Accunt address, Size (KB), Message Cunt). 2. Select a filtering peratr frm the secnd drp-dwn, such as cntains/desn't cntain r is equal t/nt equal t in relatin t the accunt characteristic n which t filter. This selectin will be applied t a pattern yu enter. 3. Finally, enter a search pattern in the text bx. The filter pattern is nt casesensitive and may nt include the special characters '\' r '/'. 4. Click + t specify additinal filters r - t remve a filter. When yu add a filter, an AND r OR buttn will appear between the text bx and the Search buttn. Clicking the buttn will tggle between AND and OR s yu can use either peratr with yur filters. 5. Click Search t see the matching results. T shw the unfiltered accunt list, with Select Filter displayed in the filter drp-dwn, click Search. Pssible filters are: "Accunt" ( address) + "is equal t" - Searches fr accunts with the full address specified in the pattern textbx. 22

23 Page 23 f 4 "Accunt" ( address) + "nt equal t" - Searches fr accunts whse full address des ntmatch the ne specified in the pattern textbx. "Accunt" (pattern*) + "cntains" - Searches fr the full r partial usernames yu specify in the textbx fr this dmain. Nte: The wildcard is n the right f the pattern. This type f search yields the fllwing results: a search fr 'bb' matches bb@dmain.cm and bbby@dmain.cm, but des nt match billybb@dmain.cm. "Accunt" (pattern*) + "desn't cntain" - Searches fr the full r partial usernames that dn't match the full r partial usernames yu specify in the textbx fr this dmain. "Accunt" (*pattern) + "cntains" - Searches fr the full r partial usernames fr this dmain. Nte: The wildcard is n the left f the pattern. This type f search yields the fllwing results: a search fr '*bb' matches billybb@dmain.cm but des nt match je_bbsn@dmain.cm. "Accunt" (*pattern) + "desn't cntain" - Searches fr the full r partial usernames fr this dmain thatdn't match the pattern yu enter in the text bx. "Quarantine" + "Enabled" - Searches fr all accunts that have quarantine enabled. "Quarantine" + "Disabled" - Searches fr all accunts that have quarantine disabled. "Spam Scan" + "Enabled" - Searches fr all accunts that have spam scanning enabled. "Spam Scan" + "Disabled" - Searches fr all accunts that have spam scanning disabled. "Size KB" + "less than" - Searches fr all accunts with a quarantine size under the specified KB amunt. "Size KB" + "greater than" - Searches fr all accunts with a quarantine size ver the specified KB amunt. "Message Cunt" + "is equal t" - Searches fr all accunts that have the specified number f messages in their quarantine. "Message Cunt" + "nt equal t" - Searches fr all accunts that dn't have the specified number f messages in their quarantine. "Message Cunt" + "less than" - Searches fr all accunts that have less than the specified number f messages in their quarantine. "Message Cunt " + "greater than" - Searches fr all accunts that have mre than the specified number f messages in their quarantine. 23

24 Page 24 f 4 T custmize the appearance f the display: Rearrange the rdering f the clumns by clicking n a clumn header and dragging it t the right r left f ther clumn headers. Change which clumns are included in the display by hvering the muse ver any clumn header and clicking the drp-dwn. Frm the Clumns drp-dwn list, check r uncheck the clumn names t add t r remve frm the display. User Accunt Cleanup Use the Remve All Invalid Accunts buttn t delete all invalid user accunts. Remving an invalid accunt will cause deletin f any messages that may be stred in that user's quarantine. Warning: If there are a lt f user accunts, this prcess can take several hurs t cmplete. The apprximate time required t validate a user is 1-2 secnds and remval f an invalid user can take 3-5 secnds. Click the Stp buttn in the pp-up windw t terminate this prcess. Yu can then restart the prcess if needed by clicking the Restart buttn in the same windw. 4.2 User Features Default User Features This page is used t specify which features yur users will be allwed t access when they lg int their accunts. The settings chsen in the Default User Features sectin are applied t all new and existing user accunts that are created fr this dmain. T create exceptins fr specific users, see the User Features Override sectin belw. Click Save Changes after making any updates. The fllwing default settings are available and will vary depending n what the administratr (either Admin rle rdmain Admin rle) f this accunt has cnfigured: Quarantine Enable/Disable - Cntrls the user's ability t enable/disable their persnal quarantine inbx. Spam Scan Enable/Disable - Cntrls the user's ability t mdify their persnal spam settings. Ntificatin Change - Cntrls the user's ability t change the frequency and language f their quarantine summary ntificatins. Whitelist/Blacklist - Cntrls the user's ability t add addresses and dmains int their persnal whitelist and blacklist. Use Bayesian - Cntrls the user's ability t manage their persnal Bayesian database. 24

25 Page 25 f 4 Scring Change - Cntrls the user's ability t change the spam scres at which their s are tagged, quarantined, and blcked. User Features Override Specify which features the users fr this dmain will be allwed t access frm their peruser quarantine accunt areas. User Accunts - Indicate user accunts that already exist fr this dmain fr whm yu'd like t verride settings. Enter ne r mre addresses that yu wish t change in the User Accunt(s) list bx, select the ptins yu wish t mdify and click Save Changes. Quarantine Enable/Disable - Cntrls the user's ability t enable/disable their persnal quarantine inbx. Spam Scan Enable/Disable - Cntrls the user's ability t mdify their persnal spam settings. Ntificatin Change - Cntrls the user's ability t change the frequency and language f their quarantine summary ntificatins. Whitelist/Blacklist - Cntrls the user's ability t add addresses and dmains int their persnal whitelist and blacklist. Use Bayesian - Cntrls the user's ability t manage their persnal Bayesian database. Scring Change - Cntrls the user's ability t change the spam scres at which their s are tagged, quarantined, and blcked. Nte: With per-user quarantine enabled, if user features are disabled r if per-user quarantine is later disabled, accunt hlders will lse previusly cnfigured per-user settings. Fr example, if an accunt hlder has created a whitelist and blacklist in his/her accunt and the administratr disables the whitelist/blacklist feature r disables per-user quarantine, the accunt hlder's whitelist/blacklist will be remved and cannt be restred. 4.3 User Add/Update User Accunt Create/Update User accunts are created autmatically fr users when all f the fllwing cnditins are met: 1. Quarantine is enabled 2. "Per-User" is selected as the quarantine type 3. Messages that rate a "quarantine" status arrive fr a user wh des nt already have a quarantine accunt. User accunts can als be created (r disabled) manually by an administratr by entering the address(es) in the User Accunts text bx and selecting the apprpriate "Enable User(s) Quarantine" setting. Nte: 25

26 Page 26 f 4 It may take a minute r tw befre the accunt is created. If yu lk fr the accunt n the USERS > Accunt View page and dn't see it, lk fr a message in the upper left f the page that says Running Tasks: Accunt Creatin. This message will disappear after the accunt creatin task is cmplete and yu'll see the new accunt yu created in the Accunts windw.if there is a prblem creating the accunt, yu'll see an errr message in a red bubble at the tp f the page. User Accunt(s) - Enter address(es) f accunts t be created / disabled (ne address per line). Enable User(s) Quarantine - Select Yes t create a quarantine accunt fr specified user(s), r N t disable specified quarantine accunt(s). Disabled quarantine accunts will nt quarantine any new messages, but any pre-existing quarantined messages will still be accessible. Any user preferences (such as Whitelist/Blcklist) allwed t users by the administratr will als be available. New User(s) - new accunt lgin infrmatin t user(s) upn either manual r autmatic creatin f an accunt. 4.4 Single Sign-On Edit Single Sign-On Settings Use this sectin t alter the current Single Sign-On settings used fr this dmain. An verview f each setting is prvided belw. T effectively disable single sign-n, set the Authenticatin Type t Lcal n this page fr the selected dmain. Using Lcal authenticatin means that the Barracuda Spam & Virus Firewall will assign a passwrd t users fr lgging int the appliance. Authenticatin Type - Select the type f authenticatin t be used fr per-user lgins. LDAP infrmatin fr authenticatin can either be as cnfigured fr recipient verificatin n the USERS > LDAP Cnfiguratin page, r as specified n this page. If yu want t ne LDAP server t authenticate users lgging int the Barracuda Spam & Virus Firewall t retrieve their quarantined mail, and anther LDAP server fr recipient verificatin, enter the IP address and LDAP settings fr the frmer belw. This LDAP server will then be used t authenticate users lgging int the Barracuda Spam & Virus Firewall. Nte: If yu select LDAP authenticatin, yu must setexchange Acceleratr/LDAP Verificatin t Yes n the USERS > LDAP Cnfiguratin page. Radius Server - Server infrmatin fr the RADIUS Authenticatin mechanism. POP Server - Server infrmatin fr the POP Authenticatin mechanism. 26

27 Page 27 f 4 Settings fr selected authenticatin type The fllwing settings will appear depending n the authenticatin type chsen abve: Lcal - There are n additinal settings t cnfigure. LDAP - The LDAP settings cnfigured n the USERS > LDAP Cnfiguratin page will be applied fr single sign-n authenticatin unless yu specify a separate LDAP server n this page, which wuld then be used fr user single sign-n. If yu d, fill in the fllwing fields: Auth. Hst - The server that is utilized fr LDAP lkups fr single sign-n authenticatin. If this setting is a hstname, and is cntained in multiple A recrds, r multiple space-separated hsts are prvided, then fail-ver capabilities will be available if the Barracuda Spam & Virus Firewall is unable t cnnect t ne f the machines listed. Auth. Prt - Prt used t cnnect t the LDAP service n the specified LDAP Server. Typically prt 389 is used fr regular LDAP and LDAP using the STARTTLS mde fr privacy. Prt 636 is assigned t the LDAPS service (LDAP ver SSL/TLS). LDAP UID - Attribute f the LDAP cntainer fund using the LDAP filter and which prvides the Barracuda Spam & Virus Firewall a unique identifier t assciate with user accunts n the Barracuda Spam & Virus Firewall. This is primarily used fr Alias Unificatin and Single Sign-On. Typically this is uid r, n mre recent Active Directry schemas, samaccuntname. Warning: The LDAP UID must nt cntain any blank spaces. Bind DN (Username) - Username used t cnnect t the LDAP service n the specified LDAP Server. If f the frm accuntname@dmain.cm, the username is transfrmed int a prper LDAP bind DN like CN=accuntname,CN=users,DC=dmain,DC=cm when accessing the LDAP server. Smetimes the default transfrmatin des nt generate a prper bind DN. In such cases, a fully frmed and valid bind DN must be entered. Bind Passwrd - Passwrd used t cnnect t the LDAP service n the specified LDAP Server. LDAP Primary Attribute - When Unify Aliases is set t Yes n the USERS > LDAP Cnfiguratin page, this LDAP cntainer attribute prvides the accunt name where quarantined messages are stred and fr which the actual recipient address is an alias. Fr single sign-n using LDAP (and when Unify Aliases is enabled), this is the accunt t which users will be directed when lgging in with any f their aliases. Warning: If the queried value f this field is different frm the queried value f LDAP Primary Attribute cnfigured n the USERS > LDAP 27

28 Page 28 f 4 Cnfiguratin page, the user wn't be able t lg int the crrect quarantine accunt. This attribute is almst always mail, and shuld return a fully qualified address with a lcal part, an "@" sign, and a dmain cmpnent which is cnfigured n the Barracuda Spam & Virus Firewall as a valid dmain. Nte: When Link Dmains is enabled n the BASIC > Quarantine page, Unify Aliases CANNOT be enabled, and vice-versa. RADIUS - Simply enter the RADIUS Server IP address r hstname, RADIUS Prt (default is 1812) and the RADIUS Secret, r passwrd. POP - Enter the POP Server IP address r hstname and the prt. Default POP prt is LDAP Cnfiguratin The LDAP Cnfiguratin page prvides fr entering all LDAP related infrmatin fr the dmain, including Advanced Settings belw. Edit LDAP Settings Advanced LDAP Settings Edit LDAP Settings (Available n certain mdels) Use this sectin t alter the current LDAP settings used fr this dmain. An verview f each setting is prvided belw. Exchange Acceleratr/LDAP Verificatin - Whether r nt LDAP lkups are perfrmed fr recipient verificatin. If set t Yes, the LDAP settings will be used and Single Sign On may be cnfigured n the USERS > Single Sign On page; therwise, the Barracuda Spam & Virus Firewall will default t SMTP verificatin thrugh RCPT TO cmmands and Single Sign On cannt be used. LDAP Server - The server that is utilized fr LDAP lkups. If this setting is a hstname, and is cntained in multiple A recrds, r multiple space-separated hsts are prvided, then fail-ver capabilities will be available if the Barracuda Spam & Virus Firewall is unable t cnnect t ne f the machines listed. LDAP Prt - Prt used t cnnect t the LDAP service n the specified LDAP Server. Typically prt 389 is used fr regular LDAP and LDAP using the STARTTLS mde fr privacy. Prt 636 is assigned t the LDAPS service (LDAP ver SSL/TLS). Fr rganizatins using Active Directry fr their LDAP server and which have multiple dmains serviced frm separate servers, the Barracuda Spam & Virus Firewall may need t read the LDAP directry frm the Glbal Catalg. The Glbal Catalg is a virtual LDAP tree which the primary dmain cntrller cnstructs and which unifies disparate dmain views. If available, the Glbal Catalg is typically fund n prt(s) 3268 and/r 3269, which are analagus t 389 and 636, respectively. Unify Aliases - Select whether r nt the Barracuda Spam & Virus Firewall perfrms accunt unificatin (als knwn as alias linking). If set t Yes, the 28

29 Page 29 f 4 Barracuda Spam & Virus Firewall will attempt t gather the primary address (using LDAP) fr the addressee f the it has just received. Mail is then prcessed using the settings fr the primary accunt and placed int that accunt's quarantine inbx (if quarantine is being utilized). As such, all messages t any addresses aliased t the primary accunt are aggregated int the primary accunt. The user can lg int the Barracuda Spam & Virus Firewall with either an aliased address r the primary address, withut needing t knw the difference. If set t N, the Barracuda Spam & Virus Firewall will prcess each address fr which mail is received as a separate accunt. If the user lgs in with an alias, that's the accunt the user will see. If the user lgs in with the primary address, then that's the accunt the user will see. Mail fr ther accunts assciated with the same user will nt be aggregated t the primary accunt. Nte: If yur LDAP server is ffline r takes t lng t respnd (mre than 5 secnds) and Unify Alias is set t Yes, the incming will be deferred (rejected with an errr message) until the LDAP server is wrking crrectly again. Als nte that when Link Dmains has been enabled by the system administratr n the BASIC > Quarantine page, Unify Addresses cannt be enabled, and viceversa. SSL/TLS Mde - Type f encryptin t be used fr LDAP queries. LDAP supprts tw mdes fr secure cmmunicatins. LDAPS is the riginal mde typically used with versin 2 f the LDAP prtcl. LDAPS is a traditinal ut-f-band SSL/TLS cnnectin where SSL/TLS is first negtiated and then the LDAP prtcl is spken ver this channel. The prt fr LDAPS is usually 636, since in this mde plain-text LDAP and secure LDAP cannt ccur n the same prt. STARTTLS debuted with versin 3 f the LDAP prtcl. In this mde, an unsecured LDAP cnnectin is initially made. The client then tells the server it wishes t upgrade t SSL/TLS. If the server supprts it and its plicy allws STARTTLS, then SSL/TLS is negtiated and all further cmmunicatin ccurs securely. The STARTTLS capability can be ffered n the same prt as plain-text LDAP and therefre is typically the default prt 389. If SSL/TLS is Off, then LDAP cmmunicatins will ccur in plain-text. This is ften desirable if the netwrk between the Barracuda Spam & Virus Firewall and yur LDAP server(s) is private and/r annymus authenticatin is used (meaning n username/dn and passwrd is sent). Plain-text LDAP is significantly mre efficient than LDAP ver SSL/TLS since SSL/TLS can intrduce significant prcessing delays, especially when cnnecting t the LDAP server. Require SSL/TLS - Whether r nt secure cmmunicatin t the LDAP server is required. If enabled, then if an LDAPS cnnectin cannt be made, r if the STARTTLS LDAP cmmand is nt supprted r disallwed, the LDAP cnnectin will fail. Using this ptin assures that passwrds will nt be sent in the clear. LDAP Server Type - Use the drp-dwn menu t select the type f LDAP server yu're using fr authenticatin. Bind DN (Username) - Username used t cnnect t the LDAP service n the specified LDAP Server. If f the frm accuntname@dmain.cm, the username is transfrmed int a prper LDAP bind DN likecn=accuntname,cn=users,dc=dmain,dc=cm when accessing the LDAP 29

30 Page 30 f 4 server. Smetimes the default transfrmatin des nt generate a prper bind DN. In such cases, a fully frmed and valid bind DN must be entered. Bind Passwrd - Passwrd used t cnnect t the LDAP service n the specified LDAP Server. Canary - address used t determine if LDAP lkups are prperly lcating valid and invalid addresses fr this dmain during the nrmal peratin f the Barracuda Spam & Virus Firewall. If at anytime the prvided Canary address is nt fund in the LDAP directry, then LDAP recipient verificatin (Exchange Acceleratr) and Unify Aliases will be disabled fr the duratin f the failure. Valid (fr testing) - address used in cnjunctin with the "Test LDAP" buttn t determine whether the LDAP settings lcate the prvided address, and whether the prper attributes fr LDAP UID and LDAP Primary Alias have been prvided. Advanced LDAP Settings LDAP Search Base - The starting search pint in the LDAP tree. The default value will lk up the 'defaultnamingcntext' tp-level attribute and use it as the search base. Blank LDAP Search Base - This ptin applies if yu are using Active Directry. If yu are using the glbal catalg prt (3268) and yu have cnfigured users fr the dmain in yur Active Directry utside f the dmain's search base, setting this ptin t Yes allws the Barracuda Spam & Virus Firewall t search the entire Active Directry. LDAP Filter - Filter used t lk up an address and determine if it is valid fr this dmain. The filter cnsists f a series f attributes that might cntain the address. If the address is fund in any f thse attributes, then the accunt is valid and is allwed nt the Barracuda Spam & Virus Firewall. LDAP UID - Attribute f the LDAP cntainer fund using the LDAP filter and which prvides the Barracuda Spam & Virus Firewall a unique identifier t assciate with user accunts n the Barracuda Spam & Virus Firewall. This is primarily used fr Alias Unificatin and Single Sign-On. Typically this is uid r, n mre recent Active Directry schemas, samaccuntname. Warning: The LDAP UID must nt cntain any blank spaces. LDAP Primary Attribute - When Unify Aliases is enabled, this LDAP cntainer attribute prvides the accunt name under which quarantined messages are stred and fr which the actual recipient address is an alias. Fr Single Sign-On using LDAP (and when Unify Aliases is enabled), this is the accunt t which users will be directed when lgging in with any f their aliases. This attribute is almst always mail, and shuld be a fully qualified address with a lcal part, an "@" sign, and a dmain cmpnent which is cnfigured n the Barracuda Spam & Virus Firewall as a valid dmain. 30

31 Page 31 f 4 Valid Recipients 4.6 Recipient Settings The Barracuda Spam & Virus Firewall can authenticate valid recipients fr this dmain either via yur LDAP server r with a lcal database which is ppulated by filling in the Explicitly Accepted Users list bx belw. If yu chse Use LDAP fr authenticatin, the Exchange Acceleratr/LDAP Verificatin setting n the LDAP Cnfiguratin page will autmatically be set t Yes. Yu must then cnfigure the LDAP server and settings n that page. Explicitly Accepted Users Specify a list f valid recipients fr this dmain if nt using LDAP authenticatin t verify the authenticity f the recipient's address. Enter ne address n each line. The number f entries in the text bx fr Explicitly Accepted Users and Alias Linking is limited based n the mdel f Barracuda Spam & Virus Firewall. On mdels 600 and lwer the maximum is 1000 and n mdels 800 and abve the limit is 5000 per dmain. Only accept fr nly these recipients (applies nly t Explicitly Accepted Users): Yes - Restricts incming t the specifically listed addresses. All ther incming will be rejected. N - Causes incming recipients t be checked against this list first befre prceeding t ther verificatin mdes. Alias Linking Alias linking allws quarantined frm multiple accunts t be directed t ne accunt when using per-user quarantine. Enter the addresses t be linked tgether n ne line, separated by a space. The quarantine accunt fr all f the linked addresses will be assciated with the first address. A "catch-all" accunt can be created t receive all quarantined s frm a particular dmain. Make sure t enter the first address a secnd time n the same line t define it as a valid recipient n the Barracuda Spam & Virus Firewall. Nte: The quarantine accunt which receives all f the des nt need t belng t this dmain. Examples fr dmain xyz: address with aliases, where the first address is ALSO a valid recipient: bsmith@xyz.cm bsmith@xyz.cm bb@xyz.cm bbby@xyz.cm (quarantined mail will be ruted t bsmith@xyz.cm) 31

32 Page 32 f 4 address with aliases where the first address is in a different dmain, and is NOT a valid recipient: bsmith@abc.cm bb@xyz.cm bbby@xyz.cm (specify this rule in dmain xyz) Entire dmain delivered t a "catchall" accunt: (quarantined addressed t xyz.cm will be ruted t catchall@xyz.cm) 5. ADVANCED Tab 5.1 Prtcl Edit Dmain Settings Reject messages frm my dmain - This setting prvides dmain spfing prtectin. If set t Yes, the Barracuda Spam & Virus Firewall will reject addressed frm this dmain t this dmain. In this case, the 'Frm' address wuld match the 'T' address. This ptin is nly enabled if all mail frm the cnfigured dmains ges directly t the mail server, and nt thrugh the Barracuda Spam & Virus Firewall. An IP whitelist can verride this setting if spf prtectin is desired and a filtered dmain's mail server needs t deliver mail thrugh the Barracuda Spam & Virus Firewall t anther dmain that is filtered. Abut SMTP ver TLS/SSL SMTP ver TLS/SSL defines the SMTP cmmand STARTTLS. This cmmand advertises and negtiates an encrypted channel with the peer fr this SMTP cnnectin. This encrypted channel is ONLY used when the peer als supprts it. T require SMTP ver TLS/SSL fr this dmain, add dmains (either by hstname - FQDN - r IP address) t r frm which yu want t require SMTP ver a TLS cnnectin: Require Encrypted TLS frm these dmains - Require dmains yu add here t always send messages thrugh the Barracuda Spam & Virus Firewall TO THIS DOMAIN ver a TLS cnnectin. Require Encrypted TLS t these dmains - Require messages relayed ut thrugh the Barracuda Spam & Virus Firewall FROM THIS DOMAIN t dmains yu add here t be sent ver a TLS cnnectin. 32