Kerio MailServer - Technical Overview The intention of this document is to provide a brief, straight forward, functional description of how Kerio MailServer interacts with the local Operating System, and to provide a technical summary of its primary features. Table of Contents: Installation Recommended Hardware requirements Operating systems supported Configuration Wizard Local operating system environment Extras Active Directory Extension Administration Administrative Interface Configuration management Service Management File System management Email storage management Logs management Domain management User management Queue management Backup and recovery Security Relay control and mail abuse prevention Encryption and secure authentication Anti-virus Anti-spam Blacklists SpamAssassin Custom rules Installation Recommended Hardware requirements Assuming a typical KMS deployment as follows: 100 users (mailboxes) providing mixed usage of IMAP, POP3 and Webmail. Each user requires between 20 to 500 MB of storage. A combined average throughput of 1000~5000 messages per day. It is recommended that the system include the following minimum requirements: 1 GHZ processor with 512 MB of Memory and a 120 GB hard drive. 1 of 6
Operating systems supported KMS standard (~10 MB) and KMS with McAfee antivirus (~14MB) are the two available versions for the following supported operating systems: Macintosh: Mac OS X 10.2 Mac OS X 10.2 Server Mac OS X 10.3 Mac OS X 10.3 Server Windows: Windows NT Windows NT Server Windows 2000 Windows 2000 Server Windows XP Windows XP 2003 Linux: Linux RedHat 7 Linux RedHat 8 Linux RedHat 9 Linux RedHat Enterprise v. 2 and 3 Configuration Wizard All versions of KMS come with a wizard for setting up basic features such as the administrative account, the primary domain, and the location of the store directory. Local operating system environment All services within KMS are self contained, meaning it has no dependencies on other services which may be pre-installed with the operating system. Most server platforms ship with services such as SMTP (mail sender) or HTTP/HTTPS (WWW server). These services will conflict with KMS services, and should be disabled before installing KMS. In order to send mail, KMS uses DNS to resolve names (This is the default setting in KMS). Therefore, the computer must be able to resolve names. In other words, if it is possible to access www.kerio.com from the local browser, KMS should be able to properly resolve names. In case an anti-virus program is installed locally, it is necessary to exclude the Kerio store directory from real time protection. Otherwise, the antivirus software may remove email files which are indexed by KMS. Extras Active Directory Extension 2 of 6
The Active Directory Extension is a schema extension installed on the domain controller that allows KMS user properties (e.g. quotas and aliases) to be managed directly using the Microsoft Management Console. This component is only necessary if KMS uses LDAP to synchronize user accounts with Active Directory. Administration Administrative Interface The Administrative interface for Kerio MailServer is a separate application, which can be installed on any supported operating system, and can be used to manage KMS remotely. Any KMS user may be given administrative access. All communication between the engine and the administration console is encrypted. The administrative port is TCP and UDP port 44337. All settings and log data can be managed or viewed using the administrative console. Note that a minimum resolution of 1024 x 768 is required, otherwise some settings will not be visible. Configuration management Virtually any setting can be configured locally, or remotely using the administration console. Changes made through the administration console are updated directly into two configuration files: users.cfg, and mailserver.cfg, located in the /kerio/mailserver directory. Both files store data in an organized XML format and can be edited using a text editor if necessary. Changes made outside of the administration console, directly to the configuration files, require a restart of the mailserver engine. Service Management On all supported operating systems KMS installs as a system service, meaning it will start each time the operating system is loaded. All services within KMS (SMTP, POP3, Secure POP3, IMAP, Secure IMAP, Webmail, Secure Webmail, LDAP, Secure LDAP) are enabled by default. Each OS includes command line syntax for stopping and starting KMS. These examples are for stopping the service on the different operating systems.: Mac OS X: SystemStarter stop KerioMailServer Linux: /etc/init.d/keriomailserver stop Windows: net stop keriomailserver KMS can be started using 'start' in place of 'stop' in any of the above syntaxes. The Windows and Mac versions of KMS include an engine monitor utility, which is a graphical interface for stopping or starting the KMS service. File System management As a mailserver, it is necessary to allocate a large amount of disc space for email and logs storage. KMS manages logs and mail in a designated 'store' directory. It is possible to specify a separate 3 of 6
partition as the location of the 'store' directory. Email storage management Messages are stored in an organized structure using the format /store/mail/domain/user/folder_name/#msgs. Each message is stored as a *.eml file that can be viewed using an email client or any text editor. Messages are referenced by an index file called index.fld. If you intend to add/remove messages directly from the file system, it is necessary to rename the index.fld file to index.bad. Once the user attempts to access their mailbox, KMS will automatically reindex the folder. Logs management KMS includes 5 types of logs (debug, error, mail, security, warning), which can all be viewed in real time in the administration console. These log files are located in /store/logs. Each log file is accompanied by a *.idx file, which is used by the administration console to improve access speed to log data contained within the file. Using the administration console, these files can be configured to rotate at time intervals, or after the log file reaches a specified size. A maximum number of log files can be defined to prevent excessive log data from accumulating. Domain management KMS supports multiple domains. Each domain contains its own set of users, groups, email addresses, and mailing lists. Only one domain can be designated as the primary domain. Users configured within the primary domain need only to authenticate with their user name. Users in other domains must authenticate using name@domain. In most cases it will be their email address. This is how KMS is able to distinguish between user accounts configured in different domains, who share the same login name. User management Users can be managed within the KMS internal user database, or accessed via LDAP from a remote source. The administration console allows users to be accessed via LDAP from Apple OpenDirectory or Windows Active Directory or they can be imported from a Windows NT domain controller. LDAP allows KMS to automatically detect new users added to the remote user database. Access parameters (kerberos realm, domain name, administrative user account) are defined in the properties of each mail domain configured in KMS. Queue management When any message is received by KMS, it will immediately try to process the message. The status of any message actively being sent can be viewed in the Status/Delivery tasks dialog of the administration console. If KMS fails to successfully send a message, it will be reinserted into the queue with a status, (for example: 4.4.1 Cannot connect to remote host). A delivery status notification will be sent to the sender and the message will be scheduled for redelivery. The sender address, recipient address, message size, status, creation date, next delivery attempt date, and message id for each message in the queue can be viewed within the administration console under 4 of 6
Status/Mail Queue. This dialog can be used to delete queued messages, or try to send them immediately, as opposed to waiting until the next retry interval. Additional queue options include: the maximum number of concurrent deliveries, the retry interval, the status notification interval, and the maximum amount of time a message may remain in the queue. Backup and recovery The backup facility is intended only for retrieval and archiving of messages. It is not intended as a complete mail server restoration in the event of hardware or other failure. A local or remote email account is defined to store the messages specified for backup. This includes messages sent and or received by internal users and or external sources. The messages are stored in separate folders labeled by the period of time in which the messages were sent or received. Backed up messages can be accessed through the webmail or any client using IMAP. Note that these folders must be subscribed to using the webmail or an IMAP client before they are visible. Security Secure messaging is a focal point of Kerio MailServer. Mail server security can be broken down roughly into two categories: relay control for prevention of unauthorized email dissemination and protection of user privacy through secure authentication and encrypted communication. Relay control and mail abuse prevention The default settings of KMS will allow relay of messages to remote addresses for users configured to authenticate through SMTP. Additionally, relay can be allowed for a custom defined IP address group, or for POP3 clients capable of authenticating immediately before attempting to send a message. There are a number of additional security options to prevent abuse from authenticated users, or messages destined to local recipients. These optional restrictions include: Max number of messages per hour from a single host, Max number of concurrent SMTP connections, Max number of recipients, Max number of unknown recipients, Max number of failed commands. As well, messages can be blocked if they exceed a certain file size, or the sender's email address does not resolve when using DNS. Encryption and secure authentication When sending outbound email, KMS will always attempt to encrypt the communication over SSL. All other services (POP3, IMAP, LDAP) are also available over SSL. KMS ships with a default certificate that is secure, however it is not personalized, and most applications will either reject the certificate, or throw a warning. There is an intuitive SSL certificates dialog within the administration console which allows the admin to generate a personalized certificate, or a certificate request, which is sent to an authority and returned with a signature that is trusted by Internet browsers. This signed certificate can be imported back into KMS using the same SSL certificates dialog. In addition to encrypted communication, KMS supports several secure authentication methods, including Cram-MD5, Digest-MD5, Kerberos and NTLM. Anti-virus 5 of 6
KMS with McAfee Anti-Virus is a single software package that integrates a virus scan engine into the mail server. Anti-virus scanning is automatically enabled. Updates to the virus definitions database are managed within the KMS administration console, and can be scheduled as often as once every hour. Additional options include actions to be taken if a virus is detected, or a file could not be scanned. Plug-in support is available for other vendors such as Grisoft, Computer Associates, Symantec and Eset. If anti-virus scanning is not preferred, KMS can be configured to block file attachments containing any type of MIME or extension format. Anti-spam Blacklists KMS can query online databases including MAPS or ORDB. Additional online databases can be custom defined based on the URL. A custom IP blacklist can also be defined. Any IP address found in the custom IP database or the online databases will be denied and/or logged if these options are enabled. SpamAssassin This component is based on an open source project that is comprised of a heuristic engine that evaluates the content of each message to calculate a cumulative score. If this score exceeds a threshold (set in KMS administration) then it can be discarded by KMS, or forwarded with **spam** prepended to the subject of the message. SpamAssassin includes Bayesian technology, which allows the heuristic engine to become more intelligent over time based on characteristics of evaluated messages. Custom rules In case there are particular messages which are not evaluated as spam, but are undesirable, or there are messages considered spam that are desirable, it is possible to define custom rules to either reject a message, adjust the score of a message, or bypass SpamAssassin. These rules can be based on any header information contained in a message. 6 of 6