Symantec Mail Security Administration Guide

Transcription

1 Symantec Mail Security Administration Guide

2 Symantec Mail Security Administration Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Legal Notice Copyright 2006 Symantec Corporation. All rights reserved. Federal acquisitions: Commercial Software - Government Users Subject to Standard License Terms and Conditions. Symantec, the Symantec Logo, Brightmail, LiveUpdate, and Norton AntiVirus are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. Other names may be trademarks of their respective owners. Symantec Mail Security is protected under U.S. Patent Nos. 6,052,709; 5,999,932; and 6,654,787. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be "commercial computer software" and "commercial computer software documentation" as defined in FAR Sections and DFARS Section Symantec Corporation Stevens Creek Blvd. Cupertino, CA USA

3 Technical Support Contacting Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product feature and function, installation, and configuration. The Technical Support group also authors content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s maintenance offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization A telephone and web-based support that provides rapid response and up-to-the-minute information Upgrade insurance that delivers automatic software upgrade protection Global support that is available 24 hours a day, 7 days a week worldwide. Support is provided in a variety of languages for those customers that are enrolled in the Platinum Support program Advanced features, including Technical Account Management For information about Symantec s Maintenance Programs, you can visit our Web site at the following URL: Select your country or language under Global Support. The specific features that are available may vary based on the level of maintenance that was purchased and the specific product that you are using. Customers with a current maintenance agreement may access Technical Support information at the following URL: Select your region or language under Global Support. Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to recreate the problem.

4 When you contact Technical Support, please have the following information available: Product release level Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes Licensing and registration Customer service If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: Select your region or language under Global Support, and then select the Licensing and Registration page. Customer service information is available at the following URL: Select your country or language under Global Support. Customer Service is available to assist with the following types of issues: Questions regarding product licensing or serialization Product registration updates such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade insurance and maintenance contracts Information about the Symantec Value License Program

5 Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manuals Maintenance agreement resources Additional Enterprise services If you want to contact Symantec regarding an existing maintenance agreement, please contact the maintenance agreement administration team for your region as follows: Asia-Pacific and Japan: Europe, Middle-East, and Africa: North America and Latin America: Symantec offers a comprehensive set of services that allow you to maximize your investment in Symantec products and to develop your knowledge, expertise, and global insight, which enable you to manage your business risks proactively. Enterprise services that are available include the following: Symantec Early Warning Solutions Managed Security Services Consulting Services Educational Services These solutions provide early warning of cyber attacks, comprehensive threat analysis, and countermeasures to prevent attacks before they occur. These services remove the burden of managing and monitoring security devices and events, ensuring rapid response to real threats. Symantec Consulting Services provide on-site technical expertise from Symantec and its trusted partners. Symantec Consulting Services offer a variety of prepackaged and customizable options that include assessment, design, implementation, monitoring and management capabilities, each focused on establishing and maintaining the integrity and availability of your IT resources. Educational Services provide a full array of technical training, security education, security certification, and awareness communication programs.

6 To access more information about Enterprise services, please visit our Web site at the following URL: Select your country or language from the site index.

7 Symantec Software License Agreement Symantec Mail Security or SMTP 1. License: You may: You may not: 2. Limited Warranty: 3. Disclaimer of Damages: 4. U.S. Government Restricted Rights: 5. Export Regulation: 6. General: 7. Additional Uses and Restrictions:

8

9 Contents Technical Support Chapter 1 Chapter 2 About Symantec Mail Security Key features New features Functional overview Architecture Where to get more information Configuring system settings Configuring certificate settings Manage certificates Configuring host (Scanner) settings Working with Services HTTP proxies SMTP Scanner settings Configuring Default SMTP Settings Configuring internal mail hosts Testing Scanners Configuring LDAP settings Configure LDAP settings Synchronization status information Replicating data to Scanners Starting and stopping replication Replication status information Troubleshooting replication Configuring Control Center settings Control Center administration Control Center certificate Configuring, enabling and scheduling Scanner replication Control Center Settings System locale... 52

10 10 Contents Chapter 3 Chapter 4 Configuring settings Configuring address masquerading Importing masqueraded entries Configuring aliases Managing aliases Importing aliases Configuring local domains Importing local domains and addresses Understanding spam settings Configuring suspected spam Choosing language identification type Software acceleration Configuring spam settings Configuring virus settings Configuring LiveUpdate Excluding files from virus scanning Configuring Bloodhound settings Configuring invalid recipient handling Configuring scanning settings Configuring container settings Configuring content filtering settings Configuring filtering About filtering Notes on filtering actions Multiple actions per verdict Multiple group policies Security risks About precedence Creating groups and adding members Add or remove members from a group Assigning filter policies to a group Selecting virus policies for a group Selecting spam policies for a group Selecting compliance policies for a group Enabling and disabling end user settings Allowing or blocking based on language Managing Group Policies Manage Group Policies Creating virus, spam, and compliance filter policies Creating virus policies Creating spam policies... 96

11 Contents 11 Creating compliance policies Managing Firewall policies Configuring attack recognition Configuring sender groups Configuring Sender Authentication Managing policy resources Annotating messages Archiving messages Configuring attachment lists Configuring dictionaries Adding and editing notifications Chapter 5 Chapter 6 Working with Spam Quarantine About Spam Quarantine Delivering messages to Spam Quarantine Working with messages in Spam Quarantine for administrators Accessing Spam Quarantine Checking for new Spam Quarantine messages Administrator message list page Administrator message details page Searching messages Configuring Spam Quarantine Delivering messages to Spam Quarantine from the Scanner Configuring Spam Quarantine port for incoming Configuring Spam Quarantine for administrator-only access Configuring the Delete Unresolved setting Configuring the login help Configuring recipients for misidentified messages Configuring the user and distribution list notification digests Configuring the Spam Quarantine Expunger Specifying Spam Quarantine message and size thresholds Troubleshooting Spam Quarantine Working with Suspect Virus Quarantine About Suspect Virus Quarantine Routing messages to Suspect Virus Quarantine Accessing Suspect Virus Quarantine Checking for new Suspect Virus Quarantine messages Suspect Virus Quarantine messages page Searching messages Configuring Suspect Virus Quarantine

12 12 Contents Configuring Suspect Virus Quarantine port for incoming Configuring the size for Suspect Virus Quarantine Chapter 7 Chapter 8 Chapter 9 Testing Symantec Mail Security Verifying normal delivery Verifying spam filtering Testing antivirus filtering Verifying filtering to Spam Quarantine Configuring alerts and logs About alerts Configuring alerts Viewing logs Working with logs About logs Configuring logs Working with Reports About reports Selecting report data to track Choosing a report About charts and tables Setting the retention period for report data Running reports Saving and editing Favorite Reports Running and deleting favorite reports Troubleshooting report generation No data available for the report type specified Sender HELO domain or IP connection shows gateway information Reports presented in local time of Control Center By default, data are saved for one week Processed message count recorded per message, not per recipient Recipient count equals message count Deferred or rejected messages are not counted as received Reports limited to 1,000 rows Printing, saving, and ing reports Print, save, or reports Scheduling reports to be ed

13 Contents 13 Schedule, Edit, or Delete Reports Chapter 10 Appendix A Administering the system Getting status information Overview of system information Message status Host details LDAP Synchronization Log details Version Information Scanner replication Managing Scanners Editing Scanners Enabling and disabling Scanners Deleting Scanners Administering the system through the Control Center Managing system administrators Managing software licenses Administering the Control Center Starting and stopping the Control Center Checking the Control Center error log Increasing the amount of information in BrightmailLog.log Starting and stopping UNIX and Windows services Starting and stopping Windows services Starting and stopping UNIX services Periodic system maintenance Backing up logs data Backing up the Spam and Virus Quarantine databases Maintaining adequate disk space Integrating Symantec Mail Security with Symantec Security Information Manager About Symantec Security Information Manager Interpreting events in the Information Manager Configuring data sources Firewall events that are sent to the Information Manager Definition Update events that are sent to the Information Manager Message events that are sent to the Information Manager Administration events that are sent to the Information Manager

14 14 Contents Glossary Index

15 Chapter 1 About Symantec Mail Security This chapter includes the following topics: Key features New features Functional overview Architecture Where to get more information Key features Symantec Mail Security offers enterprises an easy-to-deploy, comprehensive gateway-based security solution through the following features: Antispam technology Symantec's state-of-the-art spam filters assess and classify as it enters your site. Antivirus technology Virus definitions and engines protect your users from -borne viruses. Content Compliance These features help administrators enforce corporate policies, reduce legal liability, and ensure compliance with regulatory requirements. Group policies and filter policies An easy-to-use authoring tool lets administrators create powerful, flexible ad hoc filters for users and groups.

16 16 About Symantec Mail Security New features New features The following table lists the features that have been added to this version of Symantec Mail Security: Table 1-1 New features for Symantec Mail Security (all users) Category Threat protection features Inbound and outbound content controls Features Improved firewall Sender Authentication Improved virus protection True file type recognition for content compliance filtering Keywords filtering within attachments, keyword frequency filtering Regular expression filtering Description Protects against directory-harvest attacks, denial-of-service attacks, spam attacks, and virus attacks. Protects against phishing attacks, using the Sender Policy Framework (SPF), Sender ID, or both. Additional virus verdicts protect against suspected viruses, spyware, and adware and quarantine messages with suspicious encrypted attachments. messages that may contain viruses can be delayed in the Suspect Virus Quarantine, then refiltered, with updated virus definitions, if available. This feature tcan be effective in defeating virus attacks before conventional signatures are available. View a list of available virus-definition updates. Automatically detects file types without relying on file name extensions or MIME types. Scan within attachments to find keywords from dictionaries you create or edit. Specify a number of occurrences to look for. Use regular expressions to further customize filter conditions by searching within messages and attachments. Support for Enterprise Vault and third-party archival tools Specify conditions that result in being sent to an archival address or disk location.

17 About Symantec Mail Security New features 17 Table 1-1 New features for Symantec Mail Security (all users) (continued) Category Flexible mail management Features LDAP integration Expanded variety of actions and combinations Expanded mail controls Aliasing Description Dynamic group population via any of several supported LDAP servers More than two dozen actions that can be taken, individually or in combination, on messages SMTP connection management, including support for secure (TLS encryption, with security level depending on platform); for user-based routing and static routes; for address masquerading, invalid recipient handling, and control over delivery-queue processing Distribution lists automatically expanded, mail filtered and delivered correctly for each user Improved reporting and monitoring Extensive set of pre-built reports, scheduled reporting, and additional alert conditions More than 50 graphical reports that you can generate ad-hoc or on a scheduled basis. Reports can be exported for offline analysis and ed. Expanded administration capabilities Message tracking IP-based access control Control over Quarantine size limits View a trail of detailed information about a message, including the filtering processing applied to a message. Control which hosts and networks can access your Control Center. Specify user-based and total limits, configure automatic message deletions. Enhanced localization capabilities Support for non-ascii character sets Support for double-byte character sets. Language autodetection of messages for Quarantine and of subject encodings for message handling. Support for non-ascii LDAP source descriptions.

18 18 About Symantec Mail Security Functional overview Functional overview You can deploy Symantec Mail Security in different configurations to best suit the size of your network and your processing needs. Each Symantec Mail Security host can be deployed in the following ways: Scanner Control Center Deployed as a Scanner, a Symantec Mail Security host filters for viruses, spam, and noncompliant messages. You can deploy Scanners on exisiting or groupware server(s). Deployed as a Control Center, a Symantec Mail Security host allows you to configure and manage filtering, SMTP routing, system settings, and all other functions from a Web-based interface. Multiple Scanners can be configured and monitored from your enterprise-wide deployment of Symantec Mail Security, but only one Control Center can be deployed to administer all the Scanner hosts. The Control Center provides information on the status of all Symantec Mail Security hosts in your system, including system logs and extensive customizable reports. Use the Control Center to configure both system-wide and host-specific details. The Control Center provides the Setup Wizard, for initial configuration of all Symantec Mail Security instances at your site, and also the Add Scanner Wizard, for adding new Scanners. The Control Centrer also hosts the Spam and Suspect Virus Quarantines to isolate and store spam and virus messages, respectively. End users can view their quarantined spam messages and set their preferences for language filtering and blocked and allowed senders. Alternatively, you can configure Spam Quarantine for administrator-only access. Scanner and Control Center A single Symantec Mail Security host performs both functions. Note: Symantec Mail Security provides neither mailbox access for end users nor message storage. It is not intended for use as the only MTA in your infrastructure.

19 About Symantec Mail Security Architecture 19 Note: Symantec Mail Security does not filter messages that don't flow through the SMTP gateway. For example, when two mailboxes reside on the same MS Exchange Server, or on different MS Exchange Servers within an Exchange organization, their messages will not pass through the Symantec Mail Security filters. Architecture Figure 1-1 shows how a Symantec Mail Security installation processes an message, assuming the sample message passes through the Filtering Engine to the Transformation Engine without being rejected. Figure 1-1 Symantec Mail Security architecture Messages proceed through the installation in the following way: The incoming connection arrives at the inbound MTA via TCP/IP.

20 20 About Symantec Mail Security Where to get more information The inbound MTA accepts the connection and moves the message to its inbound queue. The Filtering Hub accepts a copy of the message for filtering. The Filtering Hub consults the LDAP SyncService directory to expand the message's distribution list. The Filtering Engine determines each recipient's filtering policies. The message is checked against Blocked/Allowed Senders Lists defined by administrators. Virus and configurable heuristic filters determine whether the message is infected. Content Compliance filters scan the message for restricted attachment types, regular exessions, or keywords as defined in configurable dictionaries. Spam filters compare message elements with current filters published by Symantec Security Response to determine whether the message is spam. At this point, the message may also be checked against end-user defined Language settings. The Transformation Engine performs actions per recipient based on filtering results and configurable Group Policies. Where to get more information The Symantec Mail Security documentation set consists of the following manuals: Symantec Mail Security Administration Guide Symantec Mail Security Planning Guide Symantec Mail Security Installation Guide Symantec Mail Security Getting Started Symantec Mail Security also includes a comprehensive help system that contains conceptual and procedural information. You can visit the Symantec Web site for more information about your product. The following online resources are available: Provides access to the technical support Knowledge Base, newsgroups, contact information, downloads, and mailing list subscriptions

21 About Symantec Mail Security Where to get more information 21 Provides information about registration, frequently asked questions, how to respond to error messages, and how to contact Symantec License Administration /licensing/els/help/en/help.html Provides product news and updates Provides access to the Virus Encyclopedia, which contains information about all known threats; information about hoaxes; and access to white papers about threats

22 22 About Symantec Mail Security Where to get more information

23 Chapter 2 Configuring system settings This chapter includes the following topics: Configuring certificate settings Configuring host (Scanner) settings Testing Scanners Configuring LDAP settings Replicating data to Scanners Configuring Control Center settings Configuring certificate settings Manage your certificates using the Certificate Settings page. The two types of certificates are as follows: MTA TLS certificate User interface HTTPS certificate This is the TLS certificate used by the MTAs in each Scanner. Every Scanner has separate MTAs for inbound messages, outbound messages, and message delivery. Assign this certificate from the Inbound Mail Settings and Outbound Mail Settings portions of the SMTP tab on the Settings > Hosts > Edit Host Configuration page. This is the HTTPS certificate used by the Control Center for secure Web management. Assign this certificate from the Settings > Control Center > Control Center Settings page using the Control Center Certificate drop-down menu. You can add certificates to the certificate list in the following two ways: Add a self-signed certificate by adding the certificate and filling out the requested information as presented to you at the time.

24 24 Configuring system settings Configuring certificate settings Add a Certification Authority Signed certificate by submitting a certificate request to a Certification Authority. When you receive the certificate back from the Certification Authority, you then import the certificate into the Control Center. Manage certificates Follow these steps to add either self-signed or Certification Authority Signed certificates and to assign certificates. To add a self-signed certificate to the list 1 In the Control Center, click Settings > Certificates. 2 Click Add. 3 In the Certificate type drop-down list, choose Self-Signed Certificate. 4 Complete the information on the Add Certificate page. Some Certificate Authorities may not support certificates created using an IP address instead of a domain name. Check with your Certificate Authority, or use a domain name to be sure. 5 Click Create. To add a Certification Authority Signed certificate to the list 1 In the Control Center, click Settings > Certificates. 2 Click Add. 3 In the Certificate type drop-down list, choose Certificate Authority Signed. 4 Fill in the information on the Add Certificate page. 5 Click Request. A new page is displayed, showing the certificate information in a block of text, designed for use by the Certification Authority. 6 Copy the block of text that appears and submit it to the Certification Authority. Each Certification Authority has its own set of procedures for granting certificates. Consult your Certificate Authority for details. 7 When you receive the certificate file from the Certification Authority, place the file in an easily accessed location on the computer from which you are connecting to the Control Center. 8 On the Certificate Settings page, click Import.

25 Configuring system settings Configuring host (Scanner) settings 25 9 On the Import Certificate page, type the full path and filename or click Browse and choose the file. 10 Click Import. To view or delete a certificate 1 In the Control Center, click Settings > Certificates. 2 Check the box next to the certificate to be viewed or deleted. 3 Click View to read the certificate. 4 Click Delete to remove the certificate. To assign an MTA TLS certificate 1 In the Control Center, click Settings > Hosts. 2 Select a host and click Edit. 3 Click the SMTP tab. 4 Check Accept TLS encryption as appropriate. 5 Choose the TLS certificate from the Certificate drop-down list for the inbound or outbound MTA. 6 Click Save. To assign a user interface HTTPS certificate 1 In the Control Center, click Settings > Control Center. 2 Select a certificate from the User interface HTTPS certificate drop-down list. 3 Click Save. Configuring host (Scanner) settings The following sections describe changes that can be made to individual hosts using the tabs on the Edit Host Configuration page, under Settings > Hosts: Working with Services HTTP proxies SMTP Scanner settings Configuring Default SMTP Settings Configuring internal mail hosts

26 26 Configuring system settings Configuring host (Scanner) settings Working with Services You can stop or start the following services on a Scanner using the Services tab on the Edit Host Configuration page, under Settings > Hosts. Conduit LiveUpdate Filter Engine MTA Note: If you stop the filter engine or the MTA service and wish to continue receiving alerts, specify an operating MTA IP address under Control Center Settings on the Settings > Control Center > Control Center Settings page. In addition, you can enable or disable individual Scanner replication and configure MTA settings that can help you take a Scanner offline from the Services tab at Settings > Hosts > Edit Host Configuration. Work with the Services tab Use the following procedures from the Services tab to manage individual Scanner services, replication, and stop the flow of messages through a Scanner. Replication synchronizes Scanner directory data with LDAP directory data stored on the Control Center. To start and stop services 1 In the Control Center, click Settings > Hosts. 2 Check the Scanner to edit. 3 Click Edit. 4 Select the services to be started or stopped. 5 Click Stop to stop a running service or Start to start a stopped service. To enable or disable Scanner replication for a host 1 In the Control Center, click Settings > Hosts. 2 Check the Scanner to edit. 3 Click Edit. 4 Using the Scanner Replication portion of the page, check Enable Scanner Replication for this host to enable Scanner replication. (Replication is enabled by default.)

27 Configuring system settings Configuring host (Scanner) settings 27 5 Using the Scanner Replication portion of the page, uncheck Enable Scanner Replication for this host to disable Scanner replication. The Control Center will not update the directory for this Scanner when the box is not checked. 6 Click Save to store your changes. To take a Scanner out of service 1 In the Control Center, click Settings > Hosts. 2 Check the Scanner to edit. 3 Click Edit. 4 On the MTA Operation portion of the page, check Do not accept incoming messages. All messages in Scanner queues are processed as needed, but no new messages will be received. 5 Click Save to store your changes. HTTP proxies The Conduit and Symantec LiveUpdate services run on each Scanner and receive filter updates from Symantec. If you need to add proxy and/or other security settings to your server definition, follow the steps below. To change or add proxy information 1 In the Control Center, click Settings > Hosts. 2 Check the Scanner to edit. 3 Click Edit. 4 Click the Proxy tab. 5 Check Use proxy server. 6 Specify the proxy host name and port on this panel. In addition to this information, you can include a user name and password as needed. 7 Click Save to store your information. SMTP Scanner settings A full complement of SMTP settings has been provided to help you define internal and external SMTP configurations for Scanners. Inbound SMTP settings determine how the inbound MTA processes inbound messages. Outbound SMTP settings determine how the outbound MTA processes outbound messages.

28 28 Configuring system settings Configuring host (Scanner) settings Note: For incoming messages, you can conserve computing resources by blocking messages from undesirable domains and IP addresses using SMTP Scanner settings rather than by configuring content filtering policies from the Policies > Sender Groups page. SMTP Scanner settings effectively block unwanted messages before they are filtered by Content Compliance policies, resulting in fewer messages filtered through Content Compliance policies. To modify SMTP settings for a Scanner 1 In the Control Center, click Settings > Hosts. 2 Check the Scanner to edit. 3 Click Edit. 4 Click SMTP. 5 As appropriate, complete the SMTP definition for the scanner. The following parameters are included: Scanner Role Determines if the Scanner is used for Inbound mail filtering only, Outbound mail filtering only, or Inbound and outbound mail filtering.

29 Configuring system settings Configuring host (Scanner) settings 29 Inbound Mail Settings* Provides settings for inbound messages. In this area, you can provide the following information: Inbound mail IP address Location at which inbound messages will be received. You can ping this address by pressing Test. Inbound mail SMTP port Port on which inbound mail is received, typically port 25. Accept TLS encryption Indicates if TLS encryption is accepted. Check the box to accept encryption. You must have a certificate defined for MTA TLS certificate in Settings > Certificates to accept TLS encryption. Certificate Specifies an available certificate for TLS encryption. Accept inbound mail connections from all IP addresses Indicates that all connections for inbound messages are accepted. This is the default. Accept inbound mail connections from only the following IP addresses and domains Indicates that only the addresses or domain names entered in the checked IP Address/Domains box are accepted. Click Add to add an entry or Remove to delete one. If you specify one or more IP addresses, you must include the IP address of the Control Center so that Spam Quarantine and Suspect Virus Quarantine can release messages. After you add the first entry, the IP address of the Control Center is added automatically and selected. If you are using a different IP address for the Control Center, or have the Control Center and Scanner installed on different machines, you must add the new IP address and disable the one that was added automatically. Warning: If you deploy this Scanner behind a gateway and specify one or more IP addresses instead of All IP addresses, you must add the IP addresses of ALL upstream mail servers in use by your organization. Upstream mail servers that are not specified here may be classified as spam sources. Relay local domain mail to Gives the location where inbound mail is sent after being received on the inbound port. Click Add to add an entry.

30 30 Configuring system settings Configuring host (Scanner) settings Outbound Mail Settings* Provides settings for outbound mail characteristics. In this area, you can provide the following information: Outbound mail IP address Specifies the IP address on which outbound messages are sent. You can ping this address by pressing Test. Outbound mail SMTP port Specifies the port on which outbound mail is sent, typically port 25. Accept TLS encryption Indicates if TLS encryption is accepted. Check the box to accept encrypted information. You must have a certificate defined for MTA TLS certificate in Settings > Certificates to accept TLS encryption. Certificate Specifies an available certificate for TLS encryption. Accept outbound mail connections from the following IP addresses and domains Only the addresses entered in the checked IP Address/Domains box are accepted. Click Add to add an entry or Remove to delete one. If you specify one or more IP addresses, you must include the IP address of the Control Center so that Spam Quarantine and Suspect Virus Quarantine can release messages. After you add the first entry, the IP address of the Control Center is added automatically and selected. If you are using a different IP address for the Control Center, or have the Control Center and Scanner installed on different machines, you must add the new IP address and disable the one that was added automatically. Relay non-local domain mail to Specifies how outbound SMTP message relaying is routed. By default, MX Lookup is used. Click Add to add an entry. Apply above settings to all hosts Indicates that, when saved, all settings on this page are applied immediately to all hosts. Advanced Settings Provides for inbound, outbound and delivery advanced settings. See Configuring Default SMTP Settings on page 31. (*) Classless InterDomain Routing (CIDR) is supported for inbound and outbound mail connection IP addresses. 6 Click Save to store your changes.

31 Configuring system settings Configuring host (Scanner) settings 31 Configuring Default SMTP Settings Additional SMTP settings are available from the SMTP Defaults page of the SMTP tab when you click the Advanced Settings button at the bottom of the Edit Host Configuration page. There are advanced SMTP settings for: Inbound messages Outbound messages Delivering messages Specify the MTA host name in the MTA Configuration portion of the SMTP Defaults page. The MTA Host Name gives you the ability to define the HELO banner during the initial portion of the SMTP conversation. SMTP Defaults page inbound settings describes inbound SMTP settings you can use to further define your SMTP configuration. Table 2-1 Item SMTP Defaults page inbound settings Description Maximum number of connections Maximum number of connections from a single IP address Maximum message size in bytes Maximum number of recipients per message Insert RECEIVED header to inbound messages Enable reverse DNS lookup Sets the maximum number of simultaneous inbound connections allowed. Additional attempted connections are rejected. The default is 2,000 connections. (Not available on Windows systems.) Sets the maximum number of simultaneous inbound connections allowed from a single IP address. Additional connections for the same IP address will be rejected. The default is 20. Sets the maximum size of a message before it is rejected. The default is 10,485,760 bytes. Sets the maximum number of recipients for a message. The default is 1,024 recipients. Places a RECEIVED header in the message during inbound SMTP processing. Causes the system to perform reverse DNS lookup on the SMTP client IP addresses to resolve the IP address to a name when checked. This is the default condition. When unchecked, reverse DNS lookup is not performed for inbound messages. SMTP Defaults page outbound settings describes the advanced outbound SMTP settings that you can use to further define your SMTP configuration.

32 32 Configuring system settings Configuring host (Scanner) settings Table 2-2 Item SMTP Defaults page outbound settings Description Maximum number of connections Sets the maximum number of permissible simultaneous outbound connections. Additional attempted connections are rejected. The default is 2,000 connections. Maximum number of connections from a single IP address Maximum number of connections from a single IP address (Not available on Windows systems.) Sets the maximum number of permissible simultaneous outbound connections from a single IP address. Additional attempted connections are rejected. The default is 20 connections. Sets the maximum number of permissible simultaneous outbound connections from a single IP address. Additional attempted connections are rejected. The default is 20 connections. Maximum message size in bytes Maximum number of recipients per message Default domain for sender addresses with no domain Insert RECEIVED header to outbound messages Strip pre-existing RECEIVED headers from outbound messages Enable reverse DNS lookup Sets the maximum size allowable for a message before it is rejected. The default is 10,485,760 bytes. Indicates the maximum number of recipients permitted for a message. The default is 1,024 recipients. Sets a default domain when none can be found in the message. Places a RECEIVED header in the message during outbound SMTP processing when checked. When unchecked, no RECEIVED header is inserted during outbound SMTP processing. If Insert RECEIVED header to outbound messages and Strip pre-existing RECEIVED headers from outbound messages are both checked, the outbound SMTP RECEIVED header remains when the message goes to the delivery queue. Removes all RECEIVED headers for the message when checked. When headers are stripped, message looping can occur depending on the settings of other MTAs. When unchecked, RECEIVED headers remain in the message during outbound processing. The RECEIVED header for outbound SMTP processing remains in the message when Insert RECEIVED header to outbound messages and Strip pre-existing RECEIVED headers from outbound messages are checked. Causes the system to perform reverse DNS lookup on the SMTP client IP addresses to resolve the IP address to a name when checked. This is the default condition. When unchecked, reverse DNS lookup is not performed for outbound messages.

33 Configuring system settings Configuring host (Scanner) settings 33 SMTP Defaults page delivery settings describes SMTP delivery configuration message settings for your site. Table 2-3 Item SMTP Defaults page delivery settings Description Maximum number of external connections Sets the maximum number of simultaneously allowed external connections. Additional attempted connections are rejected. The default is 100 connections. Maximum number of connections to all internal mail servers Sets the maximum number of connections allowed to all defined internal mail servers. Additional connection attempts are rejected. The default is 100 internal mail server connections. Maximum number of connections per single internal mail server Minimum retry interval Sent message time-out Bounce message time-out Sets the maximum number of connections to one internal mail server. Additional connection attempts are rejected. The default is 50 connections. Sets the smallest interval the SMTP server waits before trying to deliver a message again. The default is 15 minutes. Sets the time after which an undelivered message times out and is rejected from the queue. The default is 5 days. (Unix/Linux only) Sets a time-out period for deletion of messages in your bounce queue. This can be particularly useful in environments where you cannot configure LDAP settings. The default is 1 day. Message delay time in queue before notification Sets the time a message waits in the mail queue before notification of nondelivery is sent. The default is 4 hours. Reverse Address Binding Strategy (Unix/Linux only) Reverses the default delivery MTA interface bindings. Check this box if messages back up in the delivery queue due to routing issues.

34 34 Configuring system settings Configuring host (Scanner) settings Table 2-3 Item SMTP Defaults page delivery settings (continued) Description Enable TLS encryption (Unix/Linux) Require TLS encryption for the following hosts (Windows) For Unix/Linux installations, indicates if TLS encrypted information can be accepted. Check the box to accept encrypted information. Whenleft unchecked, TLS encryption is not performed. On Windows installations, indicates which domains require information to be encrypted. Add or delete domains from which you require encryption. Note: You must have created an MTA TLS certificate from the Certicate Setting page in Settings > Certificates before you can enable TLS encryption. See Configuring certificate settings on page 23. Domains (Windows only) Adds the names of domains from which you may require encryption. Check the names of those domains from which information must currently be encrypted. Leave unchecked to currently except listed domains from this requirement. Press Delete to remove selected domains from the list. To configure SMTP Default settings 1 From the Control Center, click Settings > Hosts. 2 Select a Scanner from the displayed list. 3 Click Edit. 4 Click the SMTP tab. On this tab, you will see some general-purpose settings. See SMTP Scanner settings on page 27. for details on these settings. 5 Click Advanced Settings. On this page you will see the advanced settings for SMTP configuration detailed in the above tables. 6 As appropriate, modify the settings explained above. 7 Click Continue to store your information. You are returned to the SMTP tab of the Edit Host Configuration page. 8 Click Save.

35 Configuring system settings Testing Scanners 35 Configuring internal mail hosts You can add or delete internal mail hosts at your site. Configure internal mail hosts Follow these procedures to add or delete internal mail hosts. To add an internal mail host 1 From the Control Center, click Settings > Hosts. 2 Check the Scanner you want to configure. 3 Click Edit. 4 Click the Internal Mail Hosts tab. 5 Specify the IP address for an internal mail host. 6 Click Add. 7 Click Save to store the information. To delete an internal mail host 1 From the Control Center, click Settings > Hosts. 2 Check the Scanner you want to configure. 3 Click Edit. 4 Click the Internal Mail Hosts tab. 5 Select an internal mail host. 6 Click Delete. Testing Scanners 7 Click Save to store the information. After adding or editing a Scanner, you can quickly test that the Scanner is operating and that the Agent is able to make a connection. The Agent facilitates the transfer of configuration information between the Control Center and attached and enabled Scanners.

36 36 Configuring system settings Configuring LDAP settings To test a Scanner 1 In the Control Center, click Status > Host Details. 2 If only one Scanner is attached to your system, you can see a snapshot of how it is currently functioning. 3 If more than one Scanner is attached, select the Scanner you want to test from the drop-down list. Configuring LDAP settings You will see a snapshot of its current status. You can click on the plus sign to expand a section. The Control Center can optionally use directory information from LDAP servers at your site for any of the following purposes: Authentication Synchronization LDAP user data is used by the Control Center to authenticate Quarantine access and resolve aliases for quarantined messages. The Control Center authenticates users by checking their user-name and password data directly against the LDAP source. LDAP user and group data is used to apply group policies, recognize directory harvest attacks, expand distribution lists, and validate message recipients. LDAP-authenticated user and group address data are cached in the Control Center for replication to Scanners but are not written back to the LDAP source. Symantec Mail Security supports the following LDAP directory types: Windows 2000 Active Directory Windows 2003 Active Directory Sun Directory Server 5.2 (formerly known as the iplanet Directory Server) Note: If you are using Sun Directory Server 5.2, you must update to patch 4 to address some changelog issues that arose in patch 3. Exchange 5.5 Lotus Domino LDAP Server 6.5

37 Configuring system settings Configuring LDAP settings 37 Configure LDAP settings Follow these procedures to configure LDAP settings. To add an LDAP server definition to the Control Center 1 In the Control Center, click Settings > LDAP. 2 Click Add. 3 Complete the necessary fields presented for defining a new LDAP Server. The values you complete will depend on your choices for LDAP Server Usage. See Table 2-4 on page 38. for a description of the available settings when adding an LDAP server to the Control Center. 4 Click Save. Warning: When adding an LDAP server that performs synchronization, you can replicate data from the Control Center to attached and enabled Scanners using the Replicate now button on the Control Center Settings page. Begin this replication only after initial synchronization has completed successfully as shown on the LDAP Synchronization page, and the number of rejected entries is 0 or stays constant after successive synchronization changes. If synchronization has not completed successfully, a status of Failed appears on the LDAP Synchronization page. Error messages recorded in the logs detail the cause of the failure. Alternatively, you can wait until the next scheduled replication occurs, at which time the LDAP synchronization service updates all Scanners. Warning: If you see the Failed to create user mappings for source error during source creation and you have recently changed DNS servers, restart your LDAP synchronization service. See Starting and stopping UNIX and Windows services on page Then, follow the above steps again. Note: If your LDAP service runs on the Linux operating system, restart LDAP synchronization by logging in and issuing the following command: service ldapsync restart.

38 38 Configuring system settings Configuring LDAP settings Table 2-4 Add LDAP Server page Item LDAP Server Description Description Text describing the LDAP server being defined. Permissible characters are any alphanumeric character (1-9, a-z, and A-Z), a space ( ), hyphen (-), underline (_), and double-byte characters. The Description entry will fail if any of the following characters are used: reverse apostrophe ( ), tilde (~), exclamation point (!), at-sign (@), number symbol (#), dollar sign ($), percent sign (%), circumflex (^), ampersand (&), asterisk (*), left and right parentheses, plus (+), equal (=), left and right braces ({}), left and right bracket ([]), vertical bar ( ), colon (:), semicolon (;), quote ("), apostophe ('), less than and greater than (<>), comma (,), question mark (?), slash (/), backslash (\). Host Host name or IP address of the LDAP server. Port TCP/IP port for the server. The default port is 389. Directory Type Specifies the type of directory used by the LDAP server. Available choices are: Active Directory iplanet/sun ONE/Java Directory Server Exchange 5.5 Domino Other (for authentication only) Usage (Required) Describes how this LDAP server is used. Select any of the following items that apply to this server definition: Authentication Synchronization Authentication and Synchronization Administrator Credentials Anonymous bind Allows you to login to an LDAP server without providing specific user ID and password information. Before using anonymous bind, configure your LDAP server to grant anonymous access to the changelog and base DN. For the Domino Directory Type using anonymous bind, group and dlist data are not retrieved. Use the following Specifies login and usage information to the LDAP server as follows: Name (bind DN) Login name allowing you to access the LDAP server. When entering the Name (bind DN) for an Exchange 5.5 server, be sure to use the full DN such as cn=administrator,cn=recipients,ou=mysite,o=myorg rather than a shortened form such as cn=administrator to ensure detection of all change events and guarantee full authentication by the LDAP server. For an Active Directory server, the full DN or logon name with User Principal Name suffix may be required. Password Password information that allows you to access the LDAP server. Test Login Verifies the anonymous bind connection or the user id and password given for accessing the LDAP server.