Filter. SurfControl Filter 5.0 for SMTP Getting Started Guide. The World s #1 Web & Filtering Company

Transcription

1 Filter SurfControl Filter 5.0 for SMTP Getting Started Guide The World s #1 Web & Filtering Company

2 CONTENTS CONTENTS INTRODUCTION About This Document...2 Product Overview...2 What s New in Version How SurfControl Filter Works...5 BEFORE YOU BEGIN System Requirements...8 Minimum Requirements...8 Other Requirements...11 Installation Decisions...12 Location of Filter on the Network...13 Database Size and Location...13 Load Balancing Methods...14 Server Size...15 INSTALLATION In This Chapter...18 Running the Setup Wizard Filter Components...20 Typical Installation...21 Custom Installation - Administration Client...27 Custom Installation - Report Central...31 CONFIGURATION WIZARD In This Chapter...36 Running the Configuration Wizard...37 Next Steps...46 Launching Filter...46 Launching Report Central...46 Upgrading from a Previous Release...47 DEPLOYMENT In This Chapter...50 Deployment Options...51 Deployment Option 1: Filter Installed on the Mail Server...51 Deployment Option 2: Simple Dedicated Server...53 Deployment Option 3: In a DMZ...55 Deployment Option 4: A Protected Network...57 Deployment Option 5: Multiple Sites...59 SurfControl Filter for SMTP 5.0 Getting Started Guide ii

3 CONTENTS iii Getting Started Guide SurfControl Filter for SMTP 5.0

4 Chapter 1 Introduction About This Document page 2 Product Overview page 2 What s New in Version 5.0 page 3 How SurfControl Filter Works page 5

5 1 INTRODUCTION About This Document About This Document This document explains how to install and configure SurfControl Filter so that you can protect your system against threats as quickly as possible. Product Overview SurfControl Filter is a comprehensive filtering solution that deals with current and evolving threats: Table 1 Enterprise Threat Protection Threat Phishing and Fraud Spam Corporate Confidentiality Viruses and Malware How You re Protected The Filter Threat Database contains the digital signatures of thousands of known phishing s and fraudulent URLs. Because Filter uses Adaptive Threat Intelligence, it can also detect when an has phishing characteristics - protecting you against new and emerging threats. The Anti-Spam Agent comprises four separate tools that work independently to offer a complete solution. As well as a comprehensive database of known spam, Filter s advanced heuristics tools can detect new outbreaks of spam and stop them before they reach your inbox. Regulations such as Sarbanes-Oxley, Gramm-Leach-Bliley and HIPAA demand absolute protection of network data. The Virtual Learning Agent is a powerful tool that you can train to recognize and protect your organization s specific confidential data. Filter works with your resident Anti-Virus Solution to prevent transmission of viruses, spyware and other malware through your e- mail system. The Adaptive Threat Intelligence suite can also determine the likelihood that any is infected, offering you advanced protection against new outbreaks. 2 Getting Started Guide SurfControl Filter 5.0

6 INTRODUCTION What s New in Version What s New in Version 5.0 Table 2 explains the new features in version 5.0 Table 2 New Features in Version 5.0 Feature Quicker Setup New Setup Wizard Configuration Wizard Advanced Anti-Spam Protection Enhanced Anti-Spam Agent Directory Harvest attack detection Web Threat Protection URL Category List Confidential Data Protection Expanded Dictionaries support Easier Virtual Learning Agent Improved Security Denial of Service protection Secure Remote Access Expanded Scalability Unlimited Connection Threads Pipelining and Chunking (esmtp) LDAP Organizational Units What It Does The new Setup Wizard makes Filter quicker to download and install. After the Setup Wizard has installed Filter, the Configuration Wizard will guide you through the configuration process step by step so that you can begin filtering as quickly as possible. Digital Fingerprinting, Heuristics, LexiRules, and Neural Net tools provide industry-leading anti-spam effectiveness with zero administration cost. Prevents spammers stealing your addresses by brute-force attacks. Protects against inappropriate and fraudulent Web links in s. 10 pre-packaged language packs, including: English, French, Spanish, Dutch, Italian, German, Portuguese, Japanese, Traditional Chinese and Simplified Chinese. Uses Real-time Threat Intelligence to understand and protect your confidential data. Detects and manages suspicious SMTP connections and offers fine-tuning of all SMTP connections, internal and external. Locks down remote administration by user logon. Supports unlimited simultaneous connections, scaling up to meet requirements of the most demanding mail gateways. Significantly improves mail throughput between mail servers that support these commands, such as MS Exchange and Lotus Domino. Tailors message-processing rules based on organizational structures already defined in LDAP. SurfControl Filter 5.0 Getting Started Guide 3

7 1 INTRODUCTION What s New in Version 5.0 Table 2 New Features in Version 5.0 Feature Easier Administration Grouping of Rules Expanded Filtering in Rules Redesigned Server Configuration notifications of failed events Report Central Single Management Console What It Does Organizes your rules by the type of threats being managed. The default rule set includes anti-spam, network security, and other useful groupings. Supports inbound/outbound Who functionality, filtering of PDF, TNEF, and RTF, and supports Office 2003 and Web Archive formats. Offers a more powerful way to configure any server and view settings by service. Instant awareness that any scheduled event has not been successful. Provides web-based reporting of filtering activity, with ability to lock down reporting access by user. Allows easy administrative access to each SurfControl server within the organization, providing a single portal view of multiple SurfControl & Web Filter deployments. 4 Getting Started Guide SurfControl Filter 5.0

8 INTRODUCTION How SurfControl Filter Works 1 How SurfControl Filter Works Figure 1 explains how Filter processes messages: Figure 1 How SurfControl Filter Works SurfControl Filter 5.0 Getting Started Guide 5

9 1 INTRODUCTION How SurfControl Filter Works SurfControl Filter s functionality is managed by four software services: Receive Service Rules Service Send Service Administration Service The services fit together like this Figure 2 Filter Services During the installation and configuration process you will: Install the services to your server or servers. Install the SQL databases Specify where the queue folders will be located. 6 Getting Started Guide SurfControl Filter 5.0

10 Chapter 2 Before You Begin System Requirements page 8 Minimum Requirements page 8 Other Requirements page 11 Installation Decisions page 12 Location of Filter on the Network page 13 Database Size and Location page 13 Load Balancing Methods page 14 Server Size page 15

11 2 BEFORE YOU BEGIN System Requirements System Requirements MINIMUM REQUIREMENTS During installation, the System Checker will check your system to see if it meets the minimum requirements for SurfControl Filter to be installed correctly. Tables 1 to 3 show the Minimum Requirements Table 1 SurfControl Filter SMTP Processor Memory Operating System Disk Space Display Web Browser Networking DNS MDAC Database Intel Pentium III processor 600MHz or higher 512MB RAM minimum, 1024MB recommended Windows 2000 Server with Service Pack 4 Windows 2000 Advanced Server with Service Pack 4 Windows Server 2003 with Service Pack 1 200MB Minimum Disk Space 500MB is recommended. Super VGA (800 x 600) or higher resolution video adaptor and monitor Microsoft Internet Explorer 5.0 or later TCP/IP installed and configured with an Internet connection Internal or External DNS configured system with SMTP gateway or MTA installed Microsoft Data Access Components MDAC 2.7 (Service Pack 2) or later Microsoft SQL Server If this is not installed on your system, SurfControl Filter can install MSDE 2000 Service Pack 3. SQL Server is recommended for larger sites, as it handles large volumes of data more easily 8 Getting Started Guide SurfControl Filter 5.0

12 BEFORE YOU BEGIN System Requirements 2 Table 2 SurfControl Filter for SMTP Admin Client Processor Operating System Display Web Browser MDAC Intel Pentium III processor 600MHz or higher. Windows 2000 Server with Service Pack 4 Windows 2000 Advanced Server with Service Pack 4 Windows Server 2003 with Service Pack 1 Windows 2000 Professional with Service Pack 4 Windows XP Super VGA (800 x 600) or higher resolution video adaptor and monitor. Microsoft Internet Explorer 5.0 or later. Microsoft Data Access Components MDAC 2.7 (Service Pack 2) or later. SurfControl Filter 5.0 Getting Started Guide 9

13 2 BEFORE YOU BEGIN System Requirements Report Central Minimum Requirements The computer where you are installing Report Central must meet the requirements listed in Table 3. The computer must be part of a network that meets the requirements listed in Table 4. Table 3 Basic requirements Operating System Processor Memory Disk space Applications Other Windows 2000 Server Service Pack 4 Windows 2000 Advanced Server Service Pack 4 Windows Server 2003 Standard Edition Windows Server 2003 Enterprise Edition Pentium III or higher 512 MB 1GB Internet Explorer 5.0 or higher Adobe Reader 6.0 or later to read reports in PDF format The SQL Server tembdb transaction log file should have a capacity of more than 5MB. 15MB is recommended. To allocate more memory to this file, consult the Filter Administrator s Guide. You can do this after you have installed Report Central. Table 4 Network requirements Operating Windows 2000 Server SP4 System Windows 2000 Advanced Server SP4 Windows Server 2003 Standard Edition Windows Server 2003 Enterprise Edition Database Microsoft MSDE Service Pack 3 Microsoft SQL Server 2000 Applications SurfControl Filter 5.0 Microsoft Internet Explorer 5.0 or higher Adobe Reader 6.0 or later to read reports in PDF format 10 Getting Started Guide SurfControl Filter 5.0

14 BEFORE YOU BEGIN System Requirements 2 OTHER REQUIREMENTS Please note the following: None of the Filter components can be installed via a terminal server client. You must have full administrative rights to install Filter. You will also need the following information: Your mail system s pre-registered domain name. The IP address or host name of your system s SMTP gateway or MTA. The address of your system security administrator. Your Activation Key as supplied by SurfControl. The HTTP port number (default 8181) to install and start the Administration Service. The IP address of the relay host (for example your ISP) if you use a relay host to send mail to the Internet. SurfControl Filter 5.0 Getting Started Guide 11

15 2 BEFORE YOU BEGIN Installation Decisions Installation Decisions Before you begin installing SurfControl Filter you need to make decisions about the following: Location of SurfControl Filter on your network. Database size and location. Load balancing method. 12 Getting Started Guide SurfControl Filter 5.0

16 BEFORE YOU BEGIN Installation Decisions 2 LOCATION OF FILTER ON THE NETWORK Before you install Filter on your network, consider Whether you will install Filter on the mail server / MTA or on a dedicated server. Whether the mail server uses MX records for domain name resolution, or whether the mail server passes this task to a relay host. Where the Filter server will be located in relation to your firewall or DMZ. Chapter 5 describes a range of deployment options for different sized enterprises. DATABASE SIZE AND LOCATION SurfControl Filter stores all configuration data and filtering policies in a SQL database called STEMConfig. All logging data is stored in a SQL database called STEMLog. SQL Server vs. MSDE MSDE, included with the SurfControl Filter download, is the run-time version of SQL. MSDE databases have a 2 GB size limit and few management tools, but it is an effective database for small environments. Although you can install a SQL database onto the SurfControl server, SurfControl recommends that large environments install a fully licensed version of SQL onto a separate, dedicated server. Dedicated vs. Centralized If your network requires multiple SurfControl servers, you have two database options: dedicated or centralized. A dedicated database stores data for a single SurfControl server in a single database; a centralized database stores the data for multiple SurfControl servers in a single database. Many customers choose to use the centralized database option, which provides the advantages of centralized policy management and message administration, plus the ability to run reports from a single repository. However, the size of a centralized database grows in direct relation to the number of SurfControl servers that write to it. Depending on the size of your environment and the number of s that pass through your network, a centralized database can require additional administration. In this case, you may choose to use a dedicated database for each SurfControl server. Database Size The size of the database depends on the number of s your organization receives per day, and the length of time you plan to retain the logged data for message administration and reporting purposes. To size your database appropriately, SurfControl estimates that each generates approximately 1KB of log data stored in the database. (This calculation can also be helpful when determining whether MSDE is sufficient for your environment.) No matter where you store the SurfControl Filter data, make sure the server has as much RAM as the anticipated size of the database (for example, a one GB database requires one GB of RAM. (This is in accordance with Microsoft s recommendations for optimal performance.) SurfControl Filter 5.0 Getting Started Guide 13

17 2 BEFORE YOU BEGIN Installation Decisions LOAD BALANCING METHODS You can load balance SurfControl Filter using MX records. On the DNS server hosting your domain, create an MX record for each primary SurfControl server using the same MX preference, while giving the failover server a higher number (which gives it a lower preference). Table 5 provides an example of MX preference assignments for load-balancing and failover using MX records. Figure 1 further shows this method. Table 5 MX Records for Load Balancing. Mail Exchanger IP Address MX Preference Site A mx1.sitea.com mx2.sitea.com mx3.sitea.com mx4.sitea.com Site B mx1.siteb.com mx2.siteb.com mx3.siteb.com mx4.siteb.com Figure 1 Using MX records for load balancing. 14 Getting Started Guide SurfControl Filter 5.0

18 BEFORE YOU BEGIN Installation Decisions 2 In Figure 1, sent to sitea.com round-robins between mail exchangers 1, 2, and 3, because each SurfControl server has the same MX preference of 5. (A lower MX preference number means that it has a higher priority -- 5 having a higher priority than 10.) The same thing happens for s sent to siteb.com. If site A is down (e.g., with a network failure), the sending mail server will route to the fourth (failover) MX record, which is the address of a server in a different physical location. For the described failover to work properly, SurfControl servers in site A are configured to accept messages for site B, and SurfControl servers in site B are configured to accept messages for site A. The failover servers also have static routes configured so that SurfControl knows where to route the s. In addition to load balancing and failover using MX records, there are also sophisticated load balancing switches that can be used for these purposes. These switches offer a variety of load balancing algorithms, in addition to round-robin delivery, which provide efficient load distribution and timely failover. Although this is not a required component for a SurfControl implementation, the use of load balancing switches may improve the overall efficiency of your SMTP infrastructure. SERVER SIZE Table 2 shows SurfControl s server recommendations, depending on how many s per hour your organization typically handles. Table 6 Server Recommendations. s Per Hour Server Recommendations < 10K s PIII 1Ghz + 1 GB RAM. < 25K s Dual Xeon 2GB RAM. <40K s Quad Xeon, 2GB RAM, 3 or more HDDs (10,000 + RPM) for processing. < 120K s 3-Quad Xeon, 2GB RAM, 3 or more HDDs (10,000 + RPM) for processing. < 240K s 6-Quad Xeon, 2GB RAM, 3 or more HDDs (10,000 + RPM) for processing. Actual processing speeds are dependent on several factors: number of rules processing threads, number of enabled rules, size of s, and complexity of the s (e.g., attachments, embedded files, etc.). SurfControl Filter 5.0 Getting Started Guide 15

19 2 BEFORE YOU BEGIN Installation Decisions Partitioning the Server You can optimize Filter s performance by installing onto a server capable of fast disk I/O and configured to support multiple HDDs. Figure 2 shows the optimal HDD and partitioning configuration for SurfControl. Because SurfControl frequently reads from and writes to disk as it processes , SurfControl recommends that you have a server capable of fast disk I/O. Figure 2 shows a server with five SCSI HDDs. Two of the HDDs are in a RAID1 configuration and are divided into three partitions: a partition for the operating system, a partition for the page file, and a partition for the SurfControl application. The other three HDDs each have a single partition and are capable of fast disk I/O. The first drive contains the In folder where SurfControl stores the received s. The second drive contains the Work folder. SurfControl retrieves s from the In folder and moves them to the Work folder, where the s are processed against the configured rule set. SurfControl then moves the to a quarantine folder for review or to the Out folder for delivery. The third drive contains the Out folder where SurfControl relays processed messages to the intended recipient. Figure 2 Partitioning the SurfControl server. Now turn to the next chapter to begin the installation process. 16 Getting Started Guide SurfControl Filter 5.0

20 Chapter 3 Installation In This Chapter page 18 Running the Setup Wizard page 19 Filter Components page 20 Typical Installation page 21 Custom Installation - Administration Client page 27 Custom Installation - Report Central page 31

21 3 INSTALLATION In This Chapter In This Chapter Once you have made the installation decisions discussed in the previous chapter, you are ready to begin installing SurfControl Filter. There are two stages to complete before SurfControl Filter can begin filtering The Setup Wizard will install the files on your computer. The Configuration Wizard will guide you through the basic configuration process and download the latest Threat Databases. The Configuration Wizard will begin automatically once the Setup Wizard is finished. This chapter explains how to install the Filter files on your computer using the Setup Wizard. 18 Getting Started Guide SurfControl Filter 5.0

22 INSTALLATION Running the Setup Wizard 3 Running the Setup Wizard There are two ways to install SurfControl Filter: Typical Installation A typical installation will install all the SurfControl Filter Core Components. If you run a typical installation, everything that SurfControl Filter needs to begin filtering will be installed on the same server. Custom Installation You can select which filter components you want to install. This is useful if you want to access the Filter server from a remote location. Figure 1 shows the Monitor installed as an Administration Client on the administrator s workstation, which enables the administrator to view traffic passing through the Filter server in real time. Figure 1 Using the Administration Client for remote access You can also use the custom installation to install Report Central. SurfControl Filter 5.0 Getting Started Guide 19

23 3 INSTALLATION Running the Setup Wizard FILTER COMPONENTS Table 1 describes the Filter Components. Table 1 Filter Components Component Description Server Components Filter services Manages the processing of . See Filter Services on page 6. Scheduler Schedules the updating of the Threat Management Database and other management tasks. Administration client Manages communication between the components. Administration Clients Report Central Monitor Rules Administrator Message Administrator Creates reports on use in your organization. Displays the progress of s through Filter in real time. Displays and manages the rules you set up to enforce your organization s Acceptable Use Policy. Displays information about s that have triggered rules, and enables you to act on them. If you install the Server Components, the Administration Clients are also installed automatically. You can install the Administration Clients without the Server Components and specify the remote location of the Server Components so that the Administration Clients can connect to them. 20 Getting Started Guide SurfControl Filter 5.0

24 INSTALLATION Running the Setup Wizard 3 TYPICAL INSTALLATION A typical installation will install all of the Filter components on your computer. Follow Procedure 1. Procedure 1: Typical Installation Step Action 1 Double click the setup.exe icon to start the Setup Wizard. 2 Specify where you want the Setup Wizard to copy the SurfControl installation files. Click Next to continue. 3 The Welcome page will display. Click Next to continue. 4 You will be asked to agree to the SurfControl License Agreement. Select I accept the terms of the license agreement and click Next. SurfControl Filter 5.0 Getting Started Guide 21

25 3 INSTALLATION Running the Setup Wizard Procedure 1: Typical Installation Step Action 5 You will be asked to accept the GNU public license agreement. Select I accept the terms of the license agreement and click Next. 6 You will be asked to select a Setup Type. Choose Typical. Click Next. 7 You will see that the core components are selected by default. By default, Report Central is also selected. You need Report Central to create reports on use in your organization. You cannot deselect any of the core components but you can choose not to install Report Central. To change which core components are installed, click Back to return to step 6, and select a Custom installation. 22 Getting Started Guide SurfControl Filter 5.0

26 INSTALLATION Running the Setup Wizard 3 Procedure 1: Typical Installation Step Action 8 The System Checker will check that your computer meets the recommended requirements. If your computer meets the minimum requirements but not the recommended requirements, the system checker will display a warning, but you can continue the installation process. If your computer does not have MDAC the Setup Wizard will install it automatically when you click Next. If your computer does not meet the minimum requirements you will be asked to abort the installation. To continue installing, click Next. If you plan to create the Filter databases on the local computer, proceed to step 9. If you plan to create the Filter databases on a remote computer, proceed to step 15. Creating local Filter databases 9 The Setup Wizard will check whether a valid SQL Server is installed on your computer: If a SQL Server is present, you can use it to create the Filter databases on the local computer. See step 10. If SQL Server is not present, you can install MSDE and use it to create the Filter databases on the local computer. See steps To create the databases on an existing SQL Server, select Create SurfControl Filter databases on this computer. Click Next. Proceed to step 17 SurfControl Filter 5.0 Getting Started Guide 23

27 3 INSTALLATION Running the Setup Wizard Procedure 1: Typical Installation Step Action 11 To install MSDE select Install MSDE and create SurfControl Filter databases on this computer. 12 Specify the location of the MSDE database. By default this is C:\Program files\microsoft SQL Server Click Browse to change the path. Click Next to proceed. 13 Specify a password for the SQL Server administrator account SA Enter a password for the SA account, then enter it again to confirm. Click Next 24 Getting Started Guide SurfControl Filter 5.0

28 INSTALLATION Running the Setup Wizard 3 Procedure 1: Typical Installation Step Action 14 When the MSDE setup program has finished, you will be asked to restart your computer. When the computer has restarted the Setup Wizard will resume where it left off. Select Create SurfControl Filter databases on this computer and click Next. Creating the Filter databases on a Remote SQL Server 15 Select Create SurfControl Filter databases on another computer. 16 Specify the server name of the SQL Server where you want to install the Filter databases. Choose how the SurfControl Filter server will connect to the SQL Server: Windows NT Authentication SQL Authentication Enter a user name and password to log into the SQL Server. Click Next. SurfControl Filter 5.0 Getting Started Guide 25

29 3 INSTALLATION Running the Setup Wizard Procedure 1: Typical Installation Step Action 17 The summary screen will now display, showing the options you have chosen. To proceed with the installation, click Next. Click Back to amend your settings. 18 When the installation is complete, you will see the final screen of the Setup Wizard. Click Finish. Once you have finished installing SurfControl Filter the Configuration Wizard will begin immediately. See Configuration Wizard on page Getting Started Guide SurfControl Filter 5.0

30 INSTALLATION Running the Setup Wizard 3 CUSTOM INSTALLATION - ADMINISTRATION CLIENT Procedure 2 describes how to use a Custom Installation to install the Administration Client components of your choice. See Filter Components on page 20 for a description of each component. Procedure 2: Installing the Administration Client Step Action 1 Double click the setup.exe icon to start the Setup Wizard. 2 Specify where you want the Setup Wizard to copy the SurfControl installation files. Click Next to continue. 3 The Welcome page will display. Click Next to continue. 4 You will be asked to agree to the SurfControl License Agreement. Select I accept the terms of the license agreement and click Next. SurfControl Filter 5.0 Getting Started Guide 27

31 3 INSTALLATION Running the Setup Wizard Procedure 2: Installing the Administration Client Step Action 5 You will be asked to accept the GNU public license agreement. Select I accept the terms of the license agreement and click Next. 6 Select the Custom setup type. 7 Select the components you want to install. Note: You can install the Filter Client without the Filter Server, but you cannot install the Filter Server without the Filter Client. 28 Getting Started Guide SurfControl Filter 5.0

32 INSTALLATION Running the Setup Wizard 3 Procedure 2: Installing the Administration Client Step Action 8 The System Checker will check that your computer meets the recommended requirements. If your computer meets the minimum requirements but not the recommended requirements, the system checker will display a warning, but you can continue the installation process. If your computer does not have MDAC the Setup Wizard will install it automatically when you click Next. If your computer does not meet the minimum requirements you will be asked to abort the installation. To continue installing, click Next. 9 Specify the location of the Filter server. Enter: The server name or IP address of the computer where the Filter Server Component is installed. The port number that the Filter client will use to communicate with the server. A user name and password that the Filter client will use to log in to the Filter Server. Click Next to continue 10 The summary screen will show the installation choices you have made. Click Next to proceed. SurfControl Filter 5.0 Getting Started Guide 29

33 3 INSTALLATION Running the Setup Wizard Procedure 2: Installing the Administration Client Step Action 11 The Installation Complete screen will display. Click Next to launch SurfControl Filter. If you selected to install Report Central, the Report Central installation process will now begin. 30 Getting Started Guide SurfControl Filter 5.0

34 INSTALLATION Running the Setup Wizard 3 CUSTOM INSTALLATION - REPORT CENTRAL If you install Report Central as part of a full installation, the Setup Wizard will install all the files you need automatically. If you install Report Central as part of a custom installation, you will need to follow further steps in the setup wizard that are specific to Report Central. Procedure 3: Installing Report Central Step Action 1 If you have already installed any Filter Components, you will be asked whether you want to Install Report Central v1.5 Uninstall SurfControl Filter Select Install Report Central v1.5 and click Next. 2 If you are installing Report Central without any SurfControl Filter components, select Custom from the Setup Type screen. Click Next to continue. 3 You will see the Report Central welcome screen. Click Next to continue. SurfControl Filter 5.0 Getting Started Guide 31