WEBROOT EMAIL ARCHIVING SERVICE Getting Started Guide North America Webroot Software, Inc. World Headquarters 2560 55th Street Boulder CO 80301 USA www.webroot.com 800.870.8102
Table of Contents Create your new archiving account... 3 Configure your firewall for IMAP collections... 4 Setting up and managing Collectors (SMTP or IMAP)... 5 SMTP Collection setup... 5 Configuring an IMAP Collector... 5 Starting Collection... 7 Inside a Collection Cycle... 8 Creating and Managing Users... 8 Enabling End User Access... 10 Determine Method of End User Account Creation... 11 Self-Registration Access Control List... 12 Managing Users and Adding Email Addresses... 12 Email Retention Policies... 14 Login Screen Messages... 14 Audits and Reports... 15 Working with and Managing Searches... 16 System Tags... 17 Creating a New Search... 17 Search Views... 20 End User Access (My Archive)... 21 Configuration for Your Mail System... 22 Webroot Email Archiving Service: Getting Started Guide v1.15 2
Create your new archiving account The first step in creating your Archive account is visiting https://new.archive.webroot.com. Here you will need to define your Account Owner which is the user with the highest permission levels. This user can be changed at a later date. All fields are required. Next, you will need to create a customized URL (https://<yourcompany>.archive.webroot.com) and display name for your archive account. This Display Name will appear at the top of all screens. Enter the approximate number of archive mailboxes and your street address. Select the mail platforms that you use (choose all that apply). You will receive a confirmation message with username, password, and private login URL. Finally, you will need to review and accept the terms of service. Webroot Email Archiving Service: Getting Started Guide v1.15 3
Configure your firewall for IMAP collections (Skip this step if you will be using SMTP as your collection method) Prior to configuring the integration with your mail servers, it is important that you make the necessary firewall changes. The archive needs secure IMAP access to your messaging server in order to retrieve data on a regular basis. The archive uses SSL to ensure no data is sent in clear text, and all data is stored encrypted with a unique encryption key. If you already allow external IMAP access to your mail server through your firewall then you can skip this section. Otherwise please gather the following information to continue configuring your firewall. 1. Mail server internal IP address (typically in the range of 10.1... or 192.168...) 2. IMAP port (typically this is 143 or 993) For this exercise let's assume your internal mail server IMAP port setting is 993 and its private IP is 10.1.1.5 and you have one public IP, which is 74.23.21.45. 3. Login to your firewall administration management interface (Web based, Telnet, SSH) 4. Select the Port Forwarding, NAT or Rules section. This could be in the advanced configuration menu. 5. Create an IMAP port forwarding/nat rule. This rule will forward external IMAP traffic from your public IP address to your mail server's private (internal) address. Only IMAP port activity will be able to use this access, and you can also restrict to SSL-only traffic if your firewall has the capability. 6. Enter the public IMAP port number you want to use. This can be any port number that is not already in use for this IP address. You will need to remember this number later in the archive configuration process. Typically this is the same port number you are using on your mail server. The rule should forward both TCP and UDP packets. 7. The end result is a port forwarding/nat rule that forwards publicly available 74.23.21.45:993 to your private 10.1.1.5:993. 8. Repeat port forwarding/nat rules for all your mail servers that will need to be accessed for archiving. 9. Use the IP address range below to lock-down your firewall to only accept connections from our hosting centers. US UK APAC 204.236.204.20 67.202.26.217 174.129.69.36 184.73.74.215 79.125.45.125 79.125.91.180 79.125.72.144 79.125.63.89 79.125.81.254 79.125.58.83 79.125.47.221 Webroot Email Archiving Service: Getting Started Guide v1.15 4
Setting up and managing Collectors (SMTP or IMAP) The management of collectors is performed within the COLLECTOR tab and can only be performed by Account Owners or Account Administrators. SMTP Collection setup To enable SMTP collections you must first subscribe to that service by checking the Enable SMTP Collection box on your ACCOUNT tab. Once checked, you will be presented with a Configure SMTP Collection button within your COLLECTOR tab. Your account will automatically generate a unique email address to forward your archive messages via SMTP. The archive system network also allows you to restrict the originating IP Network range. By adding a Trusted Network to your archive system SMTP configuration, you will be preventing any email originating outside of that IP address or range from entering into your archive. Configuring an IMAP Collector An IMAP collector connects to a single mailbox and sweeps all or some of the folders for email that needs to be archived. Exchange journal mail has a different format than other mail found on other IMAP Journal servers. To create a new collector you will need to: 1. Provide a Server name. This name does not need to match your own internal server name. 2. Enter the mailbox name (exact match) to which IMAP will connect to and collect email. 3. Define the collection interval: Nightly, Weekly, or Monthly. 4. Enter the Public IP or DNS address, and port number (standard or non-standard ports) 5. Check SSL if it is enabled on your IMAP server (SSL is highly recommended) 6. Select the Authentication Method. Select MD5, if it is enabled; otherwise select None. 7. Credentials to access that mailbox Some servers may require the username to be presented in a specific format (username@domain.com or username@domain.local) Now you are ready to set the collection criteria. This configuration will guide how the collector will process mail from that mailbox. Webroot Email Archiving Service: Getting Started Guide v1.15 5
1. Determine the maximum messages size you would like processed to the archive (up to 75 MB). 2. Enter the folder name (or use the browse feature to select) within the journal mailbox to collect email. You can bypass archiving of some emails by creating server side rules that move journal items to a separate folder. Check the Test mode box if you would like to have the collector simply take copies of the messages and leave the original messages intact after a collection cycle. This is typically used for evaluations and testing. When running in normal mode, the collector will mark messages for deletion once they have been successfully processed. Choose the collection date parameters: o o o All messages from all date ranges After X Days Date range Webroot Email Archiving Service: Getting Started Guide v1.15 6
Before saving your collector settings, you must first Test the Configuration. You can receive various responses back: Congratulations - All Correct and Ready Timeout typically means firewall issues Invalid credentials (username or password incorrect) The collector will not allow you to save its settings if the configuration does not test out correctly. In the Collector Overview Page, you can: Review list of existing collectors, associated server name, mailbox name and status Add new collectors or edit existing collectors Pause or Resume All Collectors Force a collection (This queues a collection job for your account) Review history of collection Starting Collection The collection process begins shortly after you click the Collect Now button. This queues up your first collection job and then places your collection on an automated schedule, based on the criteria you created in the collection configuration. Webroot Email Archiving Service: Getting Started Guide v1.15 7
Inside a Collection Cycle Fetching This is the initial process within a collection cycle. It is series of IMAP commands to analyze the content of the journal mailboxes and fetch the contents to the archive service. Expanding This process includes the expansion and extraction of all text components of an email. This includes header, body and over 400 different attachment types. Indexing The text that has been extracted from all emails fetched during a specific Collection Cycle is then indexed utilizing a Lucene indexing system. Storing Working in parallel with the indexing process, emails are encrypted and stored in a dedicated storage silo for each customer. The emails are stored in their original RFC.822 MIME format, encrypted using AES. Statistics updated Once an entire collection cycle has been completed the statistics found on the Dashboard in the UI are updated. Creating and Managing Users Webroot Email Archiving Service: Getting Started Guide v1.15 8
User Types Account Owner (AO) is the highest level permission within the system. This permission level can create users and administrators. They can also change all Account settings Archive Administrator (AA) is a role likely filled by an individual or group of individuals within the IT organization. They can create and manage users and their permissions. They are also able to create and modify data collector configuration. Search Administrator (SA) is responsible for creating and managing Searches. They may create new searches, edit existing, export search details and assign search access to Search Users (SA). Search User (SU) is responsible for reviewing the search results created by the Search Administrator. The Search User cannot create a new Search and can only change the scope of a Search if the Search Administrator has assigned that right to them. Search Admin Plus (**Optional**): This user type is found with customers supported by some partners. The Search Admin Plus user has the same permissions as the Search Administrator (SA) along with access to the Policies and Reports tabs found in the Archive Administrator dashboard. NOTE: Users can be set up with permanent or temporary access. Please specify an expiration date for those users whose access may only be for a short time. We recommend expiring inactive users who may need access in the future. Only Delete a User if it is highly unlikely that they will no longer need access in the future. User Summary Screen Webroot Email Archiving Service: Getting Started Guide v1.15 9
Enabling End User Access Enable end user access to the archive by navigating to your ACCOUNT administration page, checking the Enable end user access box (in the Options section of the page), and saving changes. Webroot Email Archiving Service: Getting Started Guide v1.15 10
Determine Method of End User Account Creation The Archive System provides two (2) ways of creating End User (EU) accounts: 1. The Account Administrator adds users and their primary email addresses. In this scenario, end users will receive a welcome email with a link to login to their account. They must set a new password during this initial login. The Account Administrator (AA) or the End User (EU) can add additional email addresses associated to a user. Addresses added by end user will be checked against the Access Control List referenced below. 2. End users self register for their account access. You may choose to have some or all your users self-register for access to their email archive account. The self-registration link is https://<customer>.archive.webroot.com/user/signup/new. To self-register users must create a user name that will be verified as unique before completion of the registration process. They must enter a first and last name that will be displayed on the top right corner of their archive interface when they are logged in. They must enter a primary email address that will receive notification that their registration is complete. Access to end user email is based on email addresses that a user has ownership or control of. To gain access to their own archived emails, end users will need to confirm email addresses by clicking through a link sent to that specific email address. This prevents users from registering for an email address that they do not have control of. Webroot Email Archiving Service: Getting Started Guide v1.15 11
Self-Registration Access Control List Account Administrators can manage the Self-Registration process by adding email domains that are allowed to be part of the self-registration process. You may also add a Deny list to prevent the registering of email addresses you do not want to allow to register for end user access. Managing Users and Adding Email Addresses The administrator s user management console has been updated to allow for the filtering of various types of users (Administrators, Searchers or End Users). You can also filter on usernames (you may use wildcards). When adding or editing a user s account settings and permissions you can add additional email addresses for that user. Webroot Email Archiving Service: Getting Started Guide v1.15 12
End Users may also add email addresses within their Settings. However, users are first prompted with the following warning prior to submitting their additional email address: Are you sure you want to add this email address? A verification email will be sent to this address along with your name, IP address and other information to ensure you are the rightful owner. Click OK to proceed or cancel this action. Once users proceed through this warning the address is verified against your Access Control List. If the domain or address matches the Allow list, the newly added address will immediately receive a verification email. The message contains a unique link that must be accessed to confirm the address and finalize the process. Only after the address has been confirmed will emails matching that address be made available for that end user. Webroot Email Archiving Service: Getting Started Guide v1.15 13
Email Retention Policies The archive service allows for the creation of automatic or on-demand email retention policies. By default, all emails stored within your Archive system account are stored with an unlimited retention plan with no specified expiration date. If you would like to specify a different retention policy, you can access your retention plan on the Policies tab. The Automatic Retention policy allows an administrator to set the age at which emails need to be removed from the archive. The policy is set for the number of days from the original sent date of the email. Emails that have reached this designated retention age will be purged from the search and end user interface during an automated process each evening. Login Screen Messages You may add a customized message that will display on your login screen. Use this message to provide end users with additional assistance or add your organization s security disclaimer. Access through your Admin console through Settings ->Login Messages Webroot Email Archiving Service: Getting Started Guide v1.15 14
Audits and Reports The archiving service audits all user interaction within the system. This includes all administrative functions: Collectors User management Account Settings Reports can be generated to show these activities. A sample Search Activity Audit Report is shown below. Search Activities include: Creation of new Searches Change in scope to existing Searches Viewing of Searches by users Comments and Tags placed on messages by users Exporting of emails from Search. Webroot Email Archiving Service: Getting Started Guide v1.15 15
Working with and Managing Searches The archive service allows authorized users to create searches Webroot Email Archiving Service: Getting Started Guide v1.15 16
System Tags Tags function as the classification system for categorizing search results. There are several "pre-defined" tags already available. These are "Starred", "Save", "Reviewed", and "Attention". The system also allows for the creation of Tag Words that are frequently used terms, in organizing and collaborating, during the search review process. Some examples could be: Privileged, Classified, Personal, Responsive, etc. Creating a New Search 1. Click Start a New Search 2. Choose Simple, Wizard, Advanced, Custom, or Random For all new Searches, you must assign the following common fields and parameters: 1. Give a short Name 2. Assign any special Tags that will be used with this Search 3. Permissions: Who will have access? a. Access or View b. Allow Change of Scope c. Export Webroot Email Archiving Service: Getting Started Guide v1.15 17
4. Note field is optional 5. Range (pre-defined date range) 6. Begins/Ends NOTE: You must use the calendar to choose a date. Make sure to click a day in the pop-up calendar or your date will not be saved. You can now choose your Search type: 1. Simple Search allows you to define a list of search terms (words or phrases) that can be found in the Message Body or Attachments. 2. Wizard Search provides a structured condition editor to create various AND/OR operators for your Search. These can include: a. Sender Contains b. To/cc/bcc contains c. Subject d. Body Text e. Attachment Text f. Attachment Name (Wildcard operators can be used for any of these fields). 3. Advanced Search expands upon the search criteria allowed in a Simple Search. You can expand from date range and basic word search to find specific senders, recipient combinations and much more. a. Subject Line (Optional) b. Wildcards are allowed c. Sender (use full or partial email addresses, separate multiples with a space; partial must use wildcards * or?) d. Recipients (use full or partial email addresses, separate multiples with a space; partial must use wildcards * or?) e. Has Words in body and/or Attachments - separate words with a space. f. Do Not Have Words g. Attachment name (wildcard like *.jpg or financial*.xls) Webroot Email Archiving Service: Getting Started Guide v1.15 18
4. Custom Search provides a field where you can create your own index query to find words within words, words in proximity and many other fine-tuning capabilities. 5. Random Search provides a way to select a random group of messages, within the date range you specify. You can choose to select between 1% and 30% of the messages from the date range. Webroot Email Archiving Service: Getting Started Guide v1.15 19
Search Views Collapsed View Expanded View Text View Provides a view of all text in email body and attachment. Expanded View Original View Provides a view of all text in email body. Allows the downloading of attachments. Webroot Email Archiving Service: Getting Started Guide v1.15 20
End User Access (My Archive) My Archive is an application for end users to access their archived emails. To access the application, click on My Archive in the upper right corner of the page next to your name The My Archive does not keep track of your personal email folders, but it does provide an easy way to move between your Sent Emails and your Received emails. The Archive displays the last 90 Days of messages by default. To find older emails you can change the Pick Year from the drop down or open the Advanced Find for more detailed date searches. Keep in mind that the archive has many email messages stored and indexed for fast retrieval. To ensure steady performance for all users, the end user loads only a single year at a time into memory for access. The Attachments tab provides you access to files that were attached to emails that are now stored in the archive. You can choose to filter by file type or sort or search by file name. The File link allows you to open or download the attachment. The Subject link will open the original email associated with that file attachment The Settings tab allows you to change your default view, number of items and time zone preferences. Webroot Email Archiving Service: Getting Started Guide v1.15 21
Configuration for Your Mail System Configure Your Microsoft Exchange Environment The archive uses the envelope journaling system to capture a copy of every message sent or received. You can skip this section if you have already enabled envelope journaling services. 1. Create a mailbox that will be used to collect the journaled messages. Use "archivebox" for this exercise. Note the password used for this mailbox. You will need it later in the configuration process. 2. Enable Envelope Journaling and select the "archive" mailbox name you created in step 1 as the recipient of the journal messages. 3. There is extensive Exchange envelope journaling online help at http://technet.microsoft.com/enus/library/aa996081%28exchg.65%29.aspx When envelope journaling is enabled, a copy of every message is saved to the "archivebox" journal mailbox. The messages will remain securely in this mailbox until the archive retrieves the messages during the next fetch cycle. Configure Your Novell GroupWise Environment GroupWise uses a system called Trusted Application and Message Retention to ensure the archive process can access all messages. Follow the steps below to enable Message Retention in your GroupWise system. 1. Download the Trusted Application Generation (TAppgen) utility tappgen.zip file. This ZIP file contains three files in the TAppgen folder. 2. Unzip tappgen.zip into it's own folder. 3. Login to your directory with administrative permissions. The remaining steps will not be successful if you do not have admin rights. 4. Map a drive to the GroupWise primary domain location. 5. Open the folder where you extracted the Trusted Application Generation utility (TAppgen). 6. Use a text editor such as notepad.exe to modify the file irtappgen.ini. 7. Edit the second line: DomainPath= 8. Append your primary domain path to this line in the the INI file. For example, if your primary domain is g:\domain the path line should read: DomainPath=G:\primary - do not put a trailing backslash and make sure the path is to the folder where the file 'wpdomain.db' exists. Save the file and exit the text editor. 9. Run the program tappgen.exe. You will get a success message when the process is complete. The most common errors are incorrect path to the domain database or no admin rights. Running tappgen.exe tells GroupWise to accept connections from the hosted archive data center. 10. Open the irtappgen.ini file and look at the last line. It should read "KEY=[long string of characters]". 11. Save this file. You will need this information later in the configuration process. 12. GroupWise is now configured for message retention with the trusted application you just created. Webroot Email Archiving Service: Getting Started Guide v1.15 22
Enable IMAP on POA Post office agent IMAP services need to be enabled to support the archiving process. Use Console 1 to edit the properties of each post office and enable the IMAP protocol. If you have multiple POA's loading per a single post office (one dedicated to indexing for example), only enable IMAP for one POA instance. Note: If you have more than one POA loaded per server make sure the IMAP port for each post office is unique before enabling the IMAP function. If two or more POA's load with the same IMAP port, one will not start. Kerio MailServer Configuration Kerio MailServer provides flexible options for email archiving. The journaling of emails for archiving can be stored locally on the mail server or forwarded to an external email address. The archive service supports both methods. Kerio MailServer Archiving and Backup Administration Whether you choose to use the archive service SMTP option or the IMAP collector option, we recommend chosing to archive to a remote email address. In the case of SMTP collection, you can enable SMTP on your archive Account tab and copy and paste your remote SMTP collector address into your Kerio Archiving administration screen. When working with the IMAP collection option, we recommend creating a archiving mailbox on your Kerio MailServer and directing the Archiving emails to that address. We do not support the collection of messages from sub-folders within the Kerio Archive Folders within the admin mailbox. Configure Your IBM Lotus Notes Environment 1. Create a mailbox that will be used to collect the copied messages. Use "archivebox" for this exercise. Note the password used for this mailbox. You will need it later in the configuration process. 2. Enable the message retention option. Enter the full address for the "archivebox" - i.e. archivebox@domain.com for the address. When the message retention option is enabled, a copy of every message is saved to the "archivebox" mailbox. The archive will fetch the messages during the next processing cycle. Configure the Domino Server for Journaling Journaling is enabled from the Configuration Settings document. If you already have the necessary Configuration Settings document, the following procedures explain how to modify the document to enable journaling. If you do not already have the necessary Configuration Settings document, the instructions for creating one are included in the following procedures. Webroot Email Archiving Service: Getting Started Guide v1.15 23
1. Open the Lotus Notes client. 2. Open the Domino Directory: Click File > Database > Open. From the Server list, select the server on which you created the Mail Journaling database. From the Database list, select the directory for that server. For example, if you selected Server01.com, then select Server01.com Directory. In the Filename field, select or enter names.nsf. Click Open. 3. Open the Server Configurations view: In the navigation pane, expand Configuration. Expand Servers. Under Servers, select Configurations. 4. Create or open for edit the All Servers Configuration Settings document. If the document does not exist: Click Add Configuration. On the Basics tab, select the check box for Use these settings as the default settings for all servers. Save the Configuration Settings document. If the document does exist, select the document, then click Edit Configuration. 5. Open the Journaling tab of the Configuration Settings document: Click the Router/SMTP tab. Click the Advanced tab. Click the Journaling tab. 6. Set the values for the following options: Option Value Journaling Field Encryption exclusion list Method Mail Destination Enabled Form From Principal Posted Date Send to Mail-in Database Domino Mail Journal (The title of the mail journaling database) 7. Save the Configuration Settings document. 8. Open the Rules tab of the Configuration Settings document: Click the Router/SMTP tab. Click the Restrictions and Controls tab. Click the Rules tab. 9. Click New Rule. The New Rule dialog box appears. 10. Create the condition to journal all email messages: In the This rule is field, select On. From the first drop-down list, select all documents, then click Add. Webroot Email Archiving Service: Getting Started Guide v1.15 24
11. Create an exception to the condition so that messages sent to your Archive email address are not journaled again: In the Create field, select Exception. From the first drop-down list, select To. From the second drop-down list, select is. In the next field (Value to check), enter your Archive SMTP collector email address. Click Add. 12. In the Specify Actions section, select Journal this message. 13. Click Add Action. 14. Click OK. 15. Open the Outbound tab of the Configuration Settings document: Click the MIME tab. Click the Conversion Options tab. Click the Outbound tab. 16. Set the following two options to Enabled (enabling the first option displays the second option): Lookup Internet address for all Notes addresses when Internet address is not defined in document Perform exhaustive lookups when converting Notes addresses to Internet addresses 17. Click Save and Close. 18. Close the Domino Directory. Configure Your Ipswitch imail Environment The IMail Server has new Archiving options located at Web Administration > System > System Settings. There are two possible archiving settings when using a Third Party Solution. 1. Create a new mailbox that will be used to collect the copied messages. Name the mailbox "archivebox" for this exercise. Note the password set for this mailbox, since you will need it later in the configuration process. 2. Open the SMTP Security Options screen. 3. Enable the Copy to Mail Address option in the SMTP Security Options screen. Enter the full address for the "archivebox" - i.e. archivebox@domain.com for the address. When Copy to Mail Address is enabled, a copy of every message is saved to the "archivebox" mailbox. The hosted data collector will fetch the messages during the next processing cycle. If you want to fork the mail to more than one mailbox, create an alias and use the alias address for the Copy to Mail Address. Then add the specific mailbox names (archive1, archive2, etc.) to the alias group. All the mailboxes will receive the messages. Webroot Email Archiving Service: Getting Started Guide v1.15 25
Configure Your SunOne IMS Environment SunOne (and derivative products like IMS) has a powerful rules engine called Sieve. Use Sieve to create rules that copy messages from user mailboxes to a archive mailbox. All the messages will be collected from archive mailbox daily. For user1 we set the rule: #RULE: $Name="archive" $Order=2 $Type="DEFAULT_TYPE" #BEGINFILTER if anyof(header :is ["From","Sender","Resent-from","Resent-sender","Return-path"] "user2@domain.com"){ redirect "archive@domain.com"; keep; } #ENDFILTER For user2 we set the rule: #RULE: $Name="archive" $Order=2 $Type="DEFAULT_TYPE" #BEGINFILTER if anyof(header :is ["From","Sender","Resent-from","Resent-sender","Return-path"] "user1@domain.com"){ redirect "archive@domain.com"; keep; } #ENDFILTER Webroot Email Archiving Service: Getting Started Guide v1.15 26