Symantec 10490452 - Mail Security 8220 Administration Manual

Symantec Mail Security for

SMTP

Administration Guide

Symantec Mail Security for SMTP

Administration Guide

The software described in this book is furnished under a license agreement and

may be used only in accordance with the terms of the agreement.

April 27, 2006

Copyright notice

Symantec logo, Brightmail, LiveUpdate, SESA, and Norton AntiVirus are U.S. registered

trademarks or registered trademarks of Symantec Corporation or its affiliates in other

countries. Other names may be trademarks of their respective owners.

Symantec Mail Security for SMTP 5.0 is protected under U.S. Patent Nos. 6,052,709;

5,999,932; and 6,654,787.

The product described in this document is distributed under licenses restricting its use,

copying, distribution, and decompilation/reverse engineering. No part of this document

may be reproduced in any form by any means without prior written authorization of

Symantec Corporation and its licensors, if any.

THE DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED

CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED

WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-

INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH

DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL

NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION

WITH THE FURNISHING PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE

INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE

WITHOUT NOTICE.

The Licensed Software and Documentation are deemed to be “commercial computer

software” and “commercial computer software documentation” as defined in FAR

Sections 12.212 and DFARS Section 227.7202.

Symantec Corporation

20330 Stevens Creek Blvd.

Cupertino, CA 95014

http://www.symantec.com

Printed in the United States of America.

10987654321

Technical support

As part of Symantec Security Response, the Symantec global Technical Support

group maintains support centers throughout the world. The Technical Support

group’s primary role is to respond to specific questions on product feature/

function, installation, and configuration, as well as to author content for our

Web-accessible Knowledge Base. The Technical Support group works

collaboratively with the other functional areas within Symantec to answer your

questions in a timely fashion. For example, the Technical Support group works

with Product Engineering as well as Symantec Security Response to provide

Alerting Services and Virus Definition Updates for virus outbreaks and security

alerts.

Symantec technical support offerings include:

■ A range of support options that give you the flexibility to select the right

amount of service for any size organization

■ Telephone and Web support components that provide rapid response and

up-to-the-minute information

■ Upgrade insurance that delivers automatic software upgrade protection

■ Content Updates for virus definitions and security signatures that ensure

the highest level of protection

■ Global support from Symantec Security Response experts, which is

available 24 hours a day, 7 days a week worldwide in a variety of languages

for those customers enrolled in the Platinum Support Program

■ Advanced features, such as the Symantec Alerting Service and Technical

Account Manager role, offer enhanced response and proactive security

support

Please visit our Web site for current information on Support Programs. The

specific features available may vary based on the level of support purchased and

the specific product that you are using.

To receive the latest product information by email, go to:

http://www.symantec.com/techsupp/bulletin/enterprise.html

and join our support bulletin mailing list.

Licensing and registration

If the product that you are implementing requires registration and/or a license

key, the fastest and easiest way to register your service is to access the

Symantec licensing and registration site at www.symantec.com/certificate.

Alternatively, you may go to www.symantec.com/techsupp/ent/enterprise.html,

select the product that you wish to register, and from the Product Home Page,

select the Licensing and Registration link.

Contacting Technical Support

Customers with a current support agreement may contact the Technical

Support group via phone or online at http://www.symantec.com/techsupp/

enterprise/ .

Customers with Platinum support agreements may contact Platinum Technical

Support via the Platinum Web site at http://www-secure.symantec.com/

platinum/ .

When contacting the Technical Support group, please have the following:

■ Product release level

■ Hardware information

■ Available memory, disk space, NIC information

■ Operating system

■ Version and patch level

■ Network topology

■ Router, gateway, and IP address information

■ Problem description

■ Error messages/log files

■ Troubleshooting performed prior to contacting Symantec

■ Recent software configuration changes and/or network changes

Customer Service

To contact Enterprise Customer Service online, go to www.symantec.com, select

the appropriate Global Site for your country, then choose Service and Support.

Customer Service is available to assist with the following types of issues:

■ Questions regarding product licensing or serialization

■ Product registration updates such as address or name changes

■ General product information (features, language availability, local dealers)

■ Latest information on product updates and upgrades

■ Information on upgrade insurance and maintenance contracts

■ Information on Symantec Value License Program

■ Advice on Symantec's technical support options

■ Nontechnical presales questions

■ Missing or defective CD-ROMs or manuals

Contents

Chapter 1 About Symantec Mail Security for SMTP

Key features ..........................................................................................................11

Functional overview ............................................................................................12

Architecture .......................................................................................................... 13

Where to get more information .........................................................................14

Chapter 2 Configuring system settings

Configuring certificate settings ........................................................................17

Configuring host (Scanner) settings ................................................................. 20

Working with the Services page ................................................................20

HTTP proxies ................................................................................................21

SMTP Scanner settings ...............................................................................22

Advanced SMTP settings ............................................................................ 25

Configuring internal mail hosts ................................................................28

Testing Scanners ................................................................................................. 28

Configuring LDAP settings ................................................................................. 29

Replicating data to Scanners .............................................................................37

Starting and stopping replication .............................................................38

Replication status information .................................................................. 38

Troubleshooting replication ......................................................................39

Configuring Control Center settings ................................................................40

Control Center administration .................................................................. 41

Control Center certificate ...........................................................................42

Configuring, enabling and scheduling Scanner replication .................. 42

SMTP host ..................................................................................................... 44

System locale ................................................................................................44

Chapter 3 Configuring email settings

Configuring address masquerading .................................................................. 45

Importing masqueraded entries ................................................................46

Configuring aliases ..............................................................................................47

Importing aliases ......................................................................................... 49

Configuring local domains ................................................................................. 50

Importing local domains and email addresses ........................................ 51

6 Contents

Understanding spam settings ............................................................................ 51

Configuring suspected spam ...................................................................... 52

Choosing language identification type ..................................................... 52

Software acceleration ................................................................................. 53

Configuring spam settings ......................................................................... 53

Configuring virus settings .................................................................................. 54

Configuring LiveUpdate ............................................................................. 54

Excluding files from virus scanning ......................................................... 55

Configuring general settings ..................................................................... 56

Configuring invalid recipient handling ............................................................ 56

Configuring scanning settings .......................................................................... 57

Configuring container settings .................................................................. 57

Configuring content filtering settings ..................................................... 58

Chapter 4 Configuring email filtering

About email filtering ........................................................................................... 61

Notes on filtering actions ........................................................................... 66

Multiple actions ........................................................................................... 67

Multiple policies ........................................................................................... 69

Security risks ................................................................................................ 70

About precedence ........................................................................................ 71

Creating groups and adding members ............................................................. 72

Assigning filter policies to a group ................................................................... 75

Selecting virus policies for a group ........................................................... 75

Selecting spam policies for a group .......................................................... 77

Selecting compliance policies for a group ............................................... 78

Enabling and disabling end user settings ................................................ 79

Allowing or blocking email based on language ....................................... 80

Managing Group Policies .................................................................................... 81

Creating virus, spam, and compliance filter policies ..................................... 82

Creating virus policies ................................................................................ 83

Creating spam policies ................................................................................ 85

Creating compliance policies ..................................................................... 86

Managing Email Firewall policies ..................................................................... 93

Configuring attack recognition ................................................................. 94

Configuring sender groups ......................................................................... 95

Configuring Sender Authentication ...............................................................105

Managing policy resources ..............................................................................106

Annotating messages ................................................................................106

Archiving messages ...................................................................................109

Configuring attachment lists ...................................................................110

Configuring dictionaries ...........................................................................112

Adding and editing notifications .............................................................114

7Contents

Chapter 5 Working with Spam Quarantine

About Spam Quarantine ...................................................................................117

Delivering messages to Spam Quarantine .....................................................117

Working with messages in Spam Quarantine for administrators .............118

Accessing Spam Quarantine ....................................................................118

Checking for new Spam Quarantine messages .....................................118

Administrator message list page .............................................................118

Administrator message details page .......................................................121

Searching messages ...................................................................................123

Configuring Spam Quarantine .........................................................................126

Delivering messages to Spam Quarantine from the Scanner .............126

Configuring Spam Quarantine port for incoming email .....................127

Configuring Spam Quarantine for administrator-only access ...........128

Configuring the Delete Unresolved Email setting ................................128

Configuring the login help .......................................................................128

Configuring recipients for misidentified messages .............................129

Configuring the user and distribution list notification digests ..........130

Configuring the Spam Quarantine Expunger ........................................135

Specifying Spam Quarantine message and size thresholds ................136

Troubleshooting Spam Quarantine ........................................................137

Chapter 6 Working with Suspect Virus Quarantine

About Suspect Virus Quarantine .....................................................................143

Accessing Suspect Virus Quarantine ..............................................................143

Checking for new Suspect Virus Quarantine messages .......................144

Suspect Virus Quarantine messages page .............................................144

Searching messages ...................................................................................146

Configuring Suspect Virus Quarantine ..........................................................148

Configuring Suspect Virus Quarantine port for incoming email .......148

Configuring the size for Suspect Virus Quarantine .............................148

Chapter 7 Testing Symantec Mail Security for SMTP

Verifying normal delivery ................................................................................151

Verifying spam filtering ...................................................................................151

Testing antivirus filtering ................................................................................152

Verifying filtering to the Spam Quarantine ..................................................153

Chapter 8 Configuring alerts and logs

Configuring alerts ..............................................................................................155

Viewing logs ........................................................................................................157

Configuring logs .................................................................................................159

8 Contents

Chapter 9 Working with reports

About reports .....................................................................................................163

Choosing a report ..............................................................................................164

About charts and tables ....................................................................................172

Selecting report data to track ..........................................................................172

Setting the retention period for report data .................................................173

Running reports .................................................................................................173

Saving and editing Favorite Reports ..............................................................174

Running and deleting favorite reports ...........................................................175

Troubleshooting report generation ................................................................175

No data available for the report type specified .....................................175

Sender HELO domain or IP connection shows gateway

information .........................................................................................176

Reports presented in local time of Control Center ...............................176

By default, data are saved for one week .................................................176

Processed message count recorded per message, not per

recipient ..............................................................................................176

Recipient count equals message count ...................................................177

Deferred or rejected messages are not counted as received ...............177

Reports limited to 1,000 rows ..................................................................177

Printing, saving, and emailing reports ...........................................................177

Scheduling reports to be emailed ....................................................................178

Chapter 10 Administering the system

Getting status information ..............................................................................181

Overview of system information .............................................................182

Message status ...........................................................................................182

Host status ..................................................................................................186

LDAP synchronization ..............................................................................187

Log details ...................................................................................................188

Scanner replication ...................................................................................188

Version Information ..................................................................................188

Managing Scanners ...........................................................................................188

Editing Scanners ........................................................................................189

Enabling and disabling Scanners ............................................................189

Deleting Scanners ......................................................................................190

Administering the system through the Control Center ..............................191

Managing system administrators ...........................................................191

Managing software licenses .....................................................................192

9Contents

Administering the Control Center ..................................................................193

Starting and stopping the Control Center .............................................193

Checking the Control Center error log ...................................................194

Increasing the amount of information in BrightmailLog.log .............195

Starting and stopping UNIX and Windows services ....................................196

Starting and stopping Windows services ...............................................196

Starting and stopping UNIX services .....................................................198

Periodic system maintenance ..........................................................................198

Backing up logs data ..................................................................................198

Backing up the Spam and Virus Quarantine databases .......................199

Maintaining adequate disk space ............................................................200

Appendix A Feature Cross-Reference

New features for all users .................................................................................202

Changes for Symantec Mail Security for SMTP users .................................203

New feature names ....................................................................................204

Discontinued features ...............................................................................204

Changes for Symantec Brightmail Antispam users .....................................205

About email filtering and message handling options ..................................206

Appendix B Spam foldering and the Symantec Outlook Spam Plug-in

About foldering and the plug-in ......................................................................209

Installing the Symantec Outlook Spam Plug-in ............................................210

Usage scenarios ..........................................................................................210

End user experience ..................................................................................210

Software requirements .............................................................................212

Configuring automatic spam foldering ..........................................................217

Configuring the Symantec Spam Folder Agent for Exchange ............217

Configuring the Symantec Spam Folder Agent for Domino ...............218

Enabling automatic spam foldering ................................................................221

Enabling language identification ....................................................................222

Appendix C Integrating Symantec Mail Security with Symantec

Security Information Manager

About Symantec Security Information Manager ..........................................223

Interpreting events in the Information Manager .........................................224

Configuring data sources ..........................................................................225

Firewall events that are sent to the Information Manager .................226

Definition Update events that are sent to the Information

Manager ...............................................................................................226

Message events that are sent to the Information Manager ................227

Administration events that are sent to the Information Manager ....228

10 Contents

Appendix D Editing antivirus notification messages

Modifying notification files .............................................................................231

Changing the notification file character set ..........................................232

Editing messages in the notification file ................................................232

Notification file contents .................................................................................233

Glossary

Index

Chapter

1

About Symantec Mail

Security for SMTP

This chapter includes the following topics:

■ Key features

■ Functional overview

■ Architecture

■ Where to get more information

Key features

Symantec Mail Security for SMTP offers enterprises an easy-to-deploy,

comprehensive gateway-based email security solution through the following:

■ Antispam technology – Symantec’s state-of-the-art spam filters assess and

classify email as it enters your site.

■ Antivirus technology – Virus definitions and engines protect your users

from email-borne viruses.

■ Content Compliance – These features help administrators enforce corporate

email policies, reduce legal liability, and ensure compliance with regulatory

requirements.

■ Group policies and filter policies – An easy-to-use authoring tool lets

administrators create powerful and flexible ad hoc filters for individuals and

groups.

12 About Symantec Mail Security for SMTP

Functional overview

You can deploy Symantec Mail Security for SMTP in different configurations to

best suit the size of your network and your email processing needs.

Each Symantec Mail Security for SMTP host can be deployed in the following

ways:

■ Scanner – Deployed as a Scanner, a Symantec Mail Security for SMTP host

filters email. Your installation can have one or many Scanners. Symantec

Mail Security for SMTP runs alongside your existing email or groupware

server(s).

■ Control Center – Deployed as a Control Center, a Symantec Mail Security for

SMTP host is a Web-based configuration and administration center. Use it to

configure and manage email filtering, SMTP routing, system settings, and

all other functions. Your enterprise-wide deployment of Symantec Mail

Security for SMTP can have multiple Scanners but only one Control Center,

from which you configure and monitor all the Scanner hosts.

The Control Center provides status for all Symantec Mail Security for SMTP

hosts in your system, system logs, and extensive customizable reporting.

Use it to configure both system-wide and host-specific details.

The Control Center provides the Setup Wizard, for initial configuration of

all Symantec Mail Security for SMTP instances at your site, and also the

Add Scanner Wizard, for adding new Scanners.

It also hosts the Spam and Suspect Virus Quarantines, for storage of spam

and virus messages respectively. End users can access the Control Center to

view their quarantined spam messages and set their preferences for

language filtering and blocked and allowed senders. Alternatively, you can

configure the Spam Quarantine for administrator-only access.

■ Scanner and Control Center – A single Symantec Mail Security for SMTP

host performs both functions.

Note: Symantec Mail Security for SMTP provides neither mailbox access for end

users nor message storage; it is not intended for use as the only MTA in your

email infrastructure.

Note: Symantec Mail Security for SMTP does not filter messages that don’t flow

through the SMTP gateway. For example, when two mailboxes reside on the

same MS Exchange Server, or on different MS Exchange Servers within an

Exchange organization, the messages will not pass through the Symantec Mail

Security for SMTP filters.

13About Symantec Mail Security for SMTP

Architecture

Symantec Mail Security for SMTP processes a mail message as follows. For the

sake of discussion, our sample message passes through the Filtering Engine to

the Transformation Engine without being rejected.

■ The incoming connection arrives at the inbound MTA via TCP/IP.

■ The inbound MTA accepts the connection and moves the message to its

inbound queue.

■ The Filtering Hub accepts a copy of the message for filtering.

14 About Symantec Mail Security for SMTP

Where to get more information

■ The Filtering Hub consults the LDAP SyncService directory to expand the

message’s distribution list.

■ The Filtering Engine determines each recipient’s filtering policies.

■ The message is checked against Blocked/Allowed Senders Lists defined by

administrators.

■ Virus and configurable heuristic filters determine whether the message is

infected.

■ Content Compliance filters scan the message for restricted attachment types

or keywords, as defined in configurable dictionaries.

■ Spam filters compare message elements with current filters published by

Symantec Security Response to determine whether the message is spam. At

this point, the message may also be checked against end-user defined

Language settings.

■ The Transformation Engine performs actions per recipient based on

filtering results and configurable Group Policies.

Where to get more information

In addition to this Administration Guide, your Symantec Mail Security for SMTP

product comes with the following documentation:

■ Symantec Mail Security for SMTP Installation Guide

■ Symantec Mail Security for SMTP Planning Guide

■ Symantec Mail Security for SMTP Getting Started

Symantec Mail Security also includes a comprehensive help system that

contains conceptual and procedural information.

You can visit the Symantec Web site for more information about your product.

The following online resources are available:

Provides access to the technical support Knowledge

Base, newsgroups, contact information, downloads,

and mailing list subscriptions

www.symantec.com/

techsupp/ent/

enterprise.html

Provides information about registration, frequently

asked questions, how to respond to error messages,

and how to contact Symantec License Administration

www.symantec.com

/licensing/els/help/en/

help.html

Provides product news and updates www.enterprisesecurity.

symantec.com

15About Symantec Mail Security for SMTP

Where to get more information

Provides access to the Virus Encyclopedia, which

contains information about all known threats;

information about hoaxes; and access to white papers

about threats

www.symantec.com/

avcenter/global/index.html

16 About Symantec Mail Security for SMTP

Where to get more information

Chapter

2

Configuring system

settings

System settings apply to the Control Center and to attached and enabled

Scanners. This section explains the following:

■ Configuring certificate settings

■ Configuring host (Scanner) settings

■ Testing Scanners

■ Configuring LDAP settings

■ Replicating data to Scanners

■ Configuring Control Center settings

Configuring certificate settings

Manage your certificates using the Certificate Settings page.

The two types of certificates are as follows:

■ MTA TLS certificate—This is the TLS certificate used by the MTAs in each

Scanner. Every Scanner has separate MTAs for inbound messages, outbound

messages, and message delivery. Assign this certificate from the Inbound

Mail Settings and Outbound Mail Settings portions of the SMTP tab on the

Settings > Hosts page.

■ User interface HTTPS certificate—This is the HTTPS certificate used by the

Control Center for secure Web management. Assign this certificate from the

Settings > Certificates page.

18 Configuring system settings

Configuring certificate settings

You can add certificates to the certificate list in the following two ways:

■ Add a self-signed certificate by adding the certificate and filling out the

requested information as presented to you at the time.

■ Add a Certification Authority Signed certificate by submitting a certificate

request to a Certification Authority. When you receive the certificate back

from the Certification Authority, you then import the certificate into the

Control Center.

Manage certificates

Follow these steps to add either self-signed or Certification Authority Signed

certificates and to assign certificates.

To add a self-signed certificate to the list

1 In the Control Center, click Settings > Certificates.

2 Click Add.

3 In the Certificate type drop-down list, choose Self-Signed Certificate.

4 Complete the information on the Add Certificate page.

5 Click Create.

To add a Certification Authority Signed certificate to the list

1 In the Control Center, click Settings > Certificates.

2 Click Add.

3 In the Certificate type drop-down list, choose Certificate Authority Signed.

4 Fill in the information on the Add Certificate page.

5 Click Request.

A new page is displayed, showing the certificate information in a block of

text, designed for use by the Certification Authority.

6 Copy the block of text that appears and submit it to the Certification

Authority.

Each Certification Authority has its own set of procedures for granting

certificates. Consult your Certificate Authority for details.

7 When you receive the certificate file from the Certification Authority, place

the file in an easily accessed location on the computer from which you are

connecting to the Control Center.

8 On the Certificate Settings page, click Import.

19Configuring system settings

Configuring certificate settings

9 On the Import Certificate page, type the full path and filename or click

Browse and choose the file.

10 Click Import.

To view or delete a certificate

1 In the Control Center, click Settings > Certificates.

2 Check the box next to the certificate to be viewed or deleted.

3 Click View to read the certificate.

4 Click Delete to remove the certificate.

To assign an MTA TLS certificate

1 In the Control Center, click Settings > Hosts.

2 Select a host and click Edit.

3 Click the SMTP tab.

4 Check Accept TLS encryption as appropriate.

5 Choose the TLS certificate from the Certificate drop-down list for the

inbound or outbound MTA.

6 Click Save.

To assign a user interface HTTPS certificate

1 In the Control Center, click Settings > Control Center.

2 Select a certificate from the User interface HTTPS certificate drop-down

list.

3 Click Save.

20 Configuring system settings

Configuring host (Scanner) settings

The following sections describe changes that can be made to individual hosts.

Information is available on these topics:

■ Working with the Services page

■ HTTP proxies

■ SMTP Scanner settings

Working with the Services page

You can stop or start the following services on a Scanner.

■ Conduit

■ LiveUpdate

■ Filter Engine

■ MTA

Note: If you stop the filter-hub or the MTA service and wish to continue

receiving alerts, specify an operating MTA IP address in the settings for the

Control Center.

In addition, you can configure individual Scanner replication and MTA settings

that can help you take a Scanner offline on this page.

Work with the services page

Use the following procedures from the Services page to manage individual

Scanner services, replication, and stop the flow of messages through a Scanner.

To start and stop services

1 In the Control Center, click Settings > Hosts.

2 Check the Scanner to edit.

3 Click Edit.

4 Select the services to be started or stopped.

5 Click Stop to stop a running service or Start to start a stopped service.

To enable or disable Scanner replication for a host

1 In the Control Center, click Settings > Hosts.

2 Check the Scanner to edit.

Page is loading ...

Symantec 10490452 - Mail Security 8220 Administration Manual

This manual is also suitable for

Symantec 10490452 - Mail Security 8220 Administration Manual

Related papers

Other documents