Barracuda Spam Firewall

Transcription

1 Barracuda Spam Firewall Overview The Barracuda Spam Firewall is a network appliance that scans every piece of our organization receives. Its main purposes are to reduce the amount of spam we receive and to help protect us from viruses. The device has default anti spam settings for all, but each user has their own preferences that can be configured via the web. Users will have their own whitelist and blacklist and can control how aggressively the device will detect spam for them. Messages that get marked as spam will be stored in individual user quarantines that can be monitored by the user. Users can monitor their quarantine via a daily, weekly, or monthly or via a web interface. If the Barracuda examines an and it contains a virus, it blocks it. If no virus is found, it will give the message a score. Based on this score the Barracuda will deliver, tag, quarantine, or block it. Quarantined message remain on the Barracuda and are placed in a mailbox owned by the user. Tagged message have a key word added to the subject then the message get delivered. Tagging is for messages that could not be classified neither safe nor harmful. Blocked messages are discarded immediately. To not risk losing any , by default our Barracuda does not block any . Each user can configure it to block some messages if they so choose. Even though this is a very effective appliance, it s not full proof. New spammers and spamming methods are created ever day. As with any type of anti spam appliance or software it is constantly learning and adapting, but will always be a few days behind the new threats. This means each user will still need to be wise about which attachments they open and which links they click on. The user is still a key component of our defenses.

2 Login to your account Each user will get an account on the Barracuda. Your account name (username) will be your address. Your account will not exist until you have received your first spam message. When your first spam message arrives, your quarantine mailbox will be created. You will receive an like the one below that contains your username and password. If you click on the link provided, it will automatically log you in. The link in your account is only valid for a specific amount of time. If you click on the link after it expires, you will be required to manually enter your username and password. If you simply browse to state.edu you will also be required to manually enter your username and password. Below is an image of the Barracuda login page.

3 Quarantine Inbox The Barracuda web interface allows you to view your quarantine inbox. From the inbox you can mark an individual or a group of s as spam and delete them. You can whitelist a recipient or you can deliver quarantined messages. The following screenshots will explain the various parts of the quarantine inbox Note: The Barracuda is designed to learn what is / isn t spam. Marking a message as spam helps the device do a better job of identifying future spam s.

4

5 Setting your Preferences The Preferences tab allows you to modify your account and quarantine inbox settings. From here you can change your password, determine how often you are notified about messages in your quarantine, set who can or can t send you an , and determine how aggressively you want to scan for spam. To modify your preferences simply click on the Preferences tab as shown below.

6 Whitelist/Blacklist The Barracuda allows you to create a blacklist and a whitelist. A blacklist is a list of individual addresses or domains that you want the Barracuda to block. A whitelist is just the opposite. Your whitelist will contain those that you want to receive whether they look like spam or not. Note: Messages sent from whitelist senders will still get scanned for viruses. If you want to add an individual to your whitelist, simply enter the person s address and click the add button. For example, if I wanted to make sure that s from my OSU address never get blocked, I would add salyers.24@osu.edu to my whitelist. If I want to make sure that all s from OSU never get blocked, I would add osu.edu to my whitelist. See the screenshot below for more information.

7 Quarantine Settings As you can see from the image below you have the ability to disable your quarantine. However, we strongly recommend that you never do that unless instructed to do so by one of the System Administrators. The Barracuda by default will send you a daily containing a summary of the messages in your quarantine. From this you can manage the messages in your quarantine or you can click on a link that will automatically log you in to the web interface. You can set this to Daily, Weekly, or Never. For this we also suggest that you never select Never. You can select Never, but without the notification you have to remember your password and the URL for the Barracuda. Also, having a daily or weekly message allows you to easily notice any good messages that made it into your quarantine and helps you keep your quarantine clean. Below is a screenshot of the quarantine preference page and the quarantine notification .

8 Sample Quarantine Notification Spam Settings Each message that gets scanned by the Barracuda is given a spam score between 0 and 9. This score is used to determine what action needs to be taken on the message. There are three spam score settings Tag, Quarantine, and Block. Below is an explanation of each setting. Tag The default is set to 3.5. This setting actually controls two things. If a message has a spam score that is less than 3.5, the message will be delivered to the mail server. If it has a score that is greater than or equal to 3.5, but less than the quarantine setting, it will tag the subject of the message with the text [Suspect] and deliver the message to the mail server. Note: Some users have Outlook configured to put messages with this subject in the Junk Mail folder.

9 Quarantine The default is set to 7. This setting determines which messages will get held by the Barracuda and placed in your quarantine inbox. Our default setting of 7 tells the Barracuda to put any message with a score of 7 or more in your quarantine inbox. Note: The upper limit for this setting is the Block setting. Because the block setting is set to 10, there is no upper limit. Please see the explanation for the Block setting below. Block The default is set to 10. The Block setting determines what score a message must have to be automatically discarded by the Barracuda. Blocked messages do not get delivered nor placed in your quarantine. Because of this, you need to be careful with this setting. As the image below indicates, setting this to 10 disables blocking. This means we don t block any s by default. The Bayesian database is what s used by the Barracuda to train itself on what should be classified as spam or not spam. You must mark at least 200 s as spam for this to be effective. Most users will never need to modify the Bayesian settings. Below is a screenshot of the Spam Setting properties. If you wish to more aggressively block spam, please be sure that you understand how these settings work. Most users won t need to change anything. However, if you want to make changes but aren t sure what to do, please contact the help desk.

10 Password You should change your password the first time you login. Because you wouldn t have logged in before that point, your old password is the one given to you in the account information sent by the Barracuda. Please see the snapshot below for more information.