Symantec Mail Security Administration Manual

Symantec Mail Security

Administration Guide

Symantec Mail Security Administration Guide

The software described in this book is furnished under a license agreement and may be used

only in accordance with the terms of the agreement.

Legal Notice

Federal acquisitions: Commercial Software - Government Users Subject to Standard License

Terms and Conditions.

Symantec, the Symantec Logo, Brightmail, LiveUpdate, and Norton AntiVirus are trademarks

or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other

countries. Other names may be trademarks of their respective owners.

Other names may be trademarks of their respective owners.

Symantec Mail Security is protected under U.S. Patent Nos. 6,052,709; 5,999,932; and

6,654,787.

The product described in this document is distributed under licenses restricting its use,

copying, distribution, and decompilation/reverse engineering. No part of this document

may be reproduced in any form by any means without prior written authorization of

Symantec Corporation and its licensors, if any.

THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS,

REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT,

ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO

BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL

OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING,

PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED

IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.

The Licensed Software and Documentation are deemed to be "commercial computer software"

and "commercial computer software documentation" as defined in FAR Sections 12.212 and

DFARS Section 227.7202.

Symantec Corporation

20330 Stevens Creek Blvd.

Cupertino, CA 95014 USA

http://www.symantec.com

Technical Support

Symantec Technical Support maintains support centers globally. Technical

Support’s primary role is to respond to specific queries about product feature and

function, installation, and configuration. The Technical Support group also authors

content for our online Knowledge Base. The Technical Support group works

collaboratively with the other functional areas within Symantec to answer your

questions in a timely fashion. For example, the Technical Support group works

with Product Engineering and Symantec Security Response to provide alerting

services and virus definition updates.

Symantec’s maintenance offerings include the following:

■ A range of support options that give you the flexibility to select the right

amount of service for any size organization

■ A telephone and web-based support that provides rapid response and

up-to-the-minute information

■ Upgrade insurance that delivers automatic software upgrade protection

■ Global support that is available 24 hours a day, 7 days a week worldwide.

Support is provided in a variety of languages for those customers that are

enrolled in the Platinum Support program

■ Advanced features, including Technical Account Management

For information about Symantec’s Maintenance Programs, you can visit our Web

site at the following URL:

www.symantec.com/techsupp/ent/enterprise.html

Select your country or language under Global Support. The specific features that

are available may vary based on the level of maintenance that was purchased and

the specific product that you are using.

Contacting Technical Support

Customers with a current maintenance agreement may access Technical Support

information at the following URL:

www.symantec.com/techsupp/ent/enterprise.html

Select your region or language under Global Support.

Before contacting Technical Support, make sure you have satisfied the system

requirements that are listed in your product documentation. Also, you should be

at the computer on which the problem occurred, in case it is necessary to recreate

the problem.

When you contact Technical Support, please have the following information

available:

■ Product release level

■ Hardware information

■ Available memory, disk space, and NIC information

■ Operating system

■ Version and patch level

■ Network topology

■ Router, gateway, and IP address information

■ Problem description:

■ Error messages and log files

■ Troubleshooting that was performed before contacting Symantec

■ Recent software configuration changes and network changes

Licensing and registration

If your Symantec product requires registration or a license key, access our technical

support Web page at the following URL:

www.symantec.com/techsupp/ent/enterprise.html

Select your region or language under Global Support, and then select the Licensing

and Registration page.

Customer service

Customer service information is available at the following URL:

www.symantec.com/techsupp/ent/enterprise.html

Select your country or language under Global Support.

Customer Service is available to assist with the following types of issues:

■ Questions regarding product licensing or serialization

■ Product registration updates such as address or name changes

■ General product information (features, language availability, local dealers)

■ Latest information about product updates and upgrades

■ Information about upgrade insurance and maintenance contracts

■ Information about the Symantec Value License Program

■ Advice about Symantec's technical support options

■ Nontechnical presales questions

■ Issues that are related to CD-ROMs or manuals

Maintenance agreement resources

If you want to contact Symantec regarding an existing maintenance agreement,

please contact the maintenance agreement administration team for your region

as follows:

■ Asia-Pacific and Japan: contractsadmin@symantec.com

■ Europe, Middle-East, and Africa: semea@symantec.com

■ North America and Latin America: supportsolutions@symantec.com

Additional Enterprise services

Symantec offers a comprehensive set of services that allow you to maximize your

investment in Symantec products and to develop your knowledge, expertise, and

global insight, which enable you to manage your business risks proactively.

Enterprise services that are available include the following:

These solutions provide early warning of cyber

attacks, comprehensive threat analysis, and

countermeasures to prevent attacks before they occur.

Symantec Early Warning Solutions

These services remove the burden of managing and

monitoring security devices and events, ensuring

rapid response to real threats.

Managed Security Services

Symantec Consulting Services provide on-site

technical expertise from Symantec and its trusted

partners. Symantec Consulting Services offer a variety

of prepackaged and customizable options that include

assessment, design, implementation, monitoring and

management capabilities, each focused on establishing

and maintaining the integrity and availability of your

IT resources.

Consulting Services

Educational Services provide a full array of technical

training, security education, security certification,

and awareness communication programs.

Educational Services

To access more information about Enterprise services, please visit our Web site

at the following URL:

www.symantec.com

Select your country or language from the site index.

Symantec Software License Agreement

Symantec Mail Security or SMTP

1. License:

You may:

You may not:

2. Limited Warranty:

3. Disclaimer of Damages:

4. U.S. Government Restricted Rights:

5. Export Regulation:

6. General:

7. Additional Uses and Restrictions:

Technical Support

Chapter 1 About Symantec Mail Security

Key features ................................................................................ 15

New features ............................................................................... 16

Functional overview ...................................................................... 18

Architecture ............................................................................... 19

Where to get more information ....................................................... 20

Chapter 2 Configuring system settings

Configuring certificate settings ...................................................... 23

Manage certificates ................................................................ 24

Configuring host (Scanner) settings ................................................. 25

Working with Services ............................................................. 26

HTTP proxies ........................................................................ 27

SMTP Scanner settings ........................................................... 27

Configuring Default SMTP Settings ........................................... 31

Configuring internal mail hosts ................................................ 35

Testing Scanners .......................................................................... 35

Configuring LDAP settings ............................................................. 36

Configure LDAP settings .......................................................... 37

Synchronization status information .......................................... 43

Replicating data to Scanners .......................................................... 45

Starting and stopping replication .............................................. 46

Replication status information .................................................. 46

Troubleshooting replication ..................................................... 47

Configuring Control Center settings ................................................. 48

Control Center administration .................................................. 49

Control Center certificate ......................................................... 50

Configuring, enabling and scheduling Scanner replication ............. 50

Control Center Settings ........................................................... 51

System locale ........................................................................ 52

Contents

Chapter 3 Configuring email settings

Configuring address masquerading ................................................. 53

Importing masqueraded entries ................................................ 54

Configuring aliases ...................................................................... 55

Managing aliases ................................................................... 56

Importing aliases ................................................................... 57

Configuring local domains ............................................................. 58

Importing local domains and email addresses .............................. 59

Understanding spam settings ........................................................ 60

Configuring suspected spam .................................................... 61

Choosing language identification type ....................................... 61

Software acceleration .............................................................. 62

Configuring spam settings ....................................................... 62

Configuring virus settings .............................................................. 62

Configuring LiveUpdate .......................................................... 63

Excluding files from virus scanning ........................................... 64

Configuring Bloodhound settings .............................................. 64

Configuring invalid recipient handling ............................................. 65

Configuring scanning settings ........................................................ 66

Configuring container settings .................................................. 66

Configuring content filtering settings ........................................ 67

Chapter 4 Configuring email filtering

About email filtering ..................................................................... 69

Notes on filtering actions ......................................................... 78

Multiple actions per verdict ...................................................... 79

Multiple group policies ............................................................ 81

Security risks ........................................................................ 81

About precedence ................................................................... 83

Creating groups and adding members .............................................. 84

Add or remove members from a group ........................................ 84

Assigning filter policies to a group ................................................... 87

Selecting virus policies for a group ............................................ 87

Selecting spam policies for a group ............................................ 89

Selecting compliance policies for a group .................................... 89

Enabling and disabling end user settings .................................... 90

Allowing or blocking email based on language ............................. 92

Managing Group Policies ............................................................... 92

Manage Group Policies ............................................................ 93

Creating virus, spam, and compliance filter policies ............................ 94

Creating virus policies ............................................................. 94

Creating spam policies ............................................................ 96

Contents10

Creating compliance policies .................................................... 98

Managing Email Firewall policies ................................................... 107

Configuring attack recognition ................................................ 107

Configuring sender groups ..................................................... 108

Configuring Sender Authentication ................................................ 119

Managing policy resources ........................................................... 120

Annotating messages ............................................................ 120

Archiving messages .............................................................. 122

Configuring attachment lists .................................................. 124

Configuring dictionaries ........................................................ 126

Adding and editing notifications .............................................. 128

Chapter 5 Working with Spam Quarantine

About Spam Quarantine ............................................................... 131

Delivering messages to Spam Quarantine ........................................ 132

Working with messages in Spam Quarantine for administrators .......... 132

Accessing Spam Quarantine ................................................... 132

Checking for new Spam Quarantine messages ............................ 133

Administrator message list page .............................................. 133

Administrator message details page ......................................... 135

Searching messages .............................................................. 137

Configuring Spam Quarantine ....................................................... 140

Delivering messages to Spam Quarantine from the Scanner .......... 140

Configuring Spam Quarantine port for incoming email ................ 141

Configuring Spam Quarantine for administrator-only access ........ 141

Configuring the Delete Unresolved Email setting ........................ 142

Configuring the login help ...................................................... 142

Configuring recipients for misidentified messages ...................... 142

Configuring the user and distribution list notification

digests .......................................................................... 143

Configuring the Spam Quarantine Expunger .............................. 149

Specifying Spam Quarantine message and size thresholds ............ 150

Troubleshooting Spam Quarantine ........................................... 150

Chapter 6 Working with Suspect Virus Quarantine

About Suspect Virus Quarantine .................................................... 157

Routing messages to Suspect Virus Quarantine ................................ 157

Accessing Suspect Virus Quarantine .............................................. 158

Checking for new Suspect Virus Quarantine messages ................. 158

Suspect Virus Quarantine messages page .................................. 158

Searching messages .............................................................. 160

Configuring Suspect Virus Quarantine ............................................ 162

11Contents

Configuring Suspect Virus Quarantine port for incoming

email ............................................................................ 162

Configuring the size for Suspect Virus Quarantine ...................... 163

Chapter 7 Testing Symantec Mail Security

Verifying normal delivery ............................................................ 165

Verifying spam filtering ............................................................... 165

Testing antivirus filtering ............................................................ 166

Verifying filtering to Spam Quarantine ........................................... 167

Chapter 8 Configuring alerts and logs

About alerts .............................................................................. 169

Configuring alerts ................................................................ 171

Viewing logs .............................................................................. 171

Working with logs ................................................................. 172

About logs ................................................................................. 173

Configuring logs ................................................................... 173

Chapter 9 Working with Reports

About reports ............................................................................ 177

Selecting report data to track ........................................................ 178

Choosing a report ....................................................................... 178

About charts and tables ............................................................... 188

Setting the retention period for report data ..................................... 188

Running reports ......................................................................... 189

Saving and editing Favorite Reports ............................................... 190

Running and deleting favorite reports ............................................ 190

Troubleshooting report generation ................................................ 191

No data available for the report type specified ............................ 191

Sender HELO domain or IP connection shows gateway

information ................................................................... 191

Reports presented in local time of Control Center ....................... 191

By default, data are saved for one week ..................................... 192

Processed message count recorded per message, not per

recipient ....................................................................... 192

Recipient count equals message count ...................................... 193

Deferred or rejected messages are not counted as received ............ 193

Reports limited to 1,000 rows .................................................. 193

Printing, saving, and emailing reports ............................................ 193

Print, save, or email reports .................................................... 194

Scheduling reports to be emailed ................................................... 194

Contents12

Schedule, Edit, or Delete Reports ............................................. 194

Chapter 10 Administering the system

Getting status information .......................................................... 197

Overview of system information ............................................. 198

Message status .................................................................... 198

Host details ......................................................................... 203

LDAP Synchronization .......................................................... 204

Log details .......................................................................... 204

Version Information ............................................................. 204

Scanner replication ............................................................... 205

Managing Scanners .................................................................... 205

Editing Scanners ................................................................. 205

Enabling and disabling Scanners ............................................ 206

Deleting Scanners ................................................................. 207

Administering the system through the Control Center ...................... 208

Managing system administrators ............................................ 208

Managing software licenses ................................................... 209

Administering the Control Center ................................................. 209

Starting and stopping the Control Center .................................. 209

Checking the Control Center error log ....................................... 210

Increasing the amount of information in BrightmailLog.log .......... 211

Starting and stopping UNIX and Windows services ........................... 213

Starting and stopping Windows services ................................... 213

Starting and stopping UNIX services ........................................ 215

Periodic system maintenance ....................................................... 215

Backing up logs data ............................................................. 216

Backing up the Spam and Virus Quarantine databases ................ 216

Maintaining adequate disk space ............................................. 219

Appendix A Integrating Symantec Mail Security with Symantec

Security Information Manager

About Symantec Security Information Manager ............................... 221

Interpreting events in the Information Manager ............................... 222

Configuring data sources ....................................................... 223

Firewall events that are sent to the Information Manager ............. 224

Definition Update events that are sent to the Information

Manager ....................................................................... 224

Message events that are sent to the Information Manager ............ 225

Administration events that are sent to the Information

Manager ....................................................................... 226

13Contents

Glossary

Index

Contents14

About Symantec Mail

Security

This chapter includes the following topics:

■ Key features

■ New features

■ Functional overview

■ Architecture

■ Where to get more information

Key features

Symantec Mail Security offers enterprises an easy-to-deploy, comprehensive

gateway-based email security solution through the following features:

■ Antispam technology – Symantec's state-of-the-art spam filters assess and

classify email as it enters your site.

■ Antivirus technology – Virus definitions and engines protect your users from

email-borne viruses.

■ Content Compliance – These features help administrators enforce corporate

policies, reduce legal liability, and ensure compliance with regulatory

requirements.

■ Group policies and filter policies – An easy-to-use authoring tool lets

administrators create powerful, flexible ad hoc filters for users and groups.

1

Chapter

New features

The following table lists the features that have been added to this version of

Symantec Mail Security:

Table 1-1

New features for Symantec Mail Security (all users)

DescriptionFeaturesCategory

Protects against directory-harvest attacks,

denial-of-service attacks, spam attacks, and virus

attacks.

Improved email

firewall

Threat

protection

features

Protects against phishing attacks, using the Sender

Policy Framework (SPF), Sender ID, or both.

Sender

Authentication

Additional virus verdicts protect against suspected

viruses, spyware, and adware and quarantine

messages with suspicious encrypted attachments.

Email messages that may contain viruses can be

delayed in the Suspect Virus Quarantine, then

refiltered, with updated virus definitions, if available.

This feature tcan be effective in defeating virus

attacks before conventional signatures are available.

View a list of available virus-definition updates.

Improved virus

protection

Automatically detects file types without relying on

file name extensions or MIME types.

True file type

recognition for

content compliance

filtering

Inbound

and

outbound

content

controls

Scan within attachments to find keywords from

dictionaries you create or edit. Specify a number of

occurrences to look for.

Keywords filtering

within attachments,

keyword frequency

filtering

Use regular expressions to further customize filter

conditions by searching within messages and

attachments.

Regular expression

filtering

Specify conditions that result in email being sent to

an archival email address or disk location.

Support for

Enterprise Vault and

third-party archival

tools

About Symantec Mail Security

New features

16

Table 1-1

New features for Symantec Mail Security (all users) (continued)

DescriptionFeaturesCategory

Dynamic group population via any of several

supported LDAP servers

LDAP integrationFlexible

mail

management

More than two dozen actions that can be taken,

individually or in combination, on messages

Expanded variety of

actions and

combinations

SMTP connection management, including support for

secure email (TLS encryption, with security level

depending on platform); for user-based routing and

static routes; for address masquerading, invalid

recipient handling, and control over delivery-queue

processing

Expanded mail

controls

Distribution lists automatically expanded, mail

filtered and delivered correctly for each user

Aliasing

More than 50 graphical reports that you can generate

ad-hoc or on a scheduled basis. Reports can be

exported for offline analysis and emailed.

Extensive set of

pre-built reports,

scheduled reporting,

and additional alert

conditions

Improved

reporting

and

monitoring

View a trail of detailed information about a message,

including the filtering processing applied to a

message.

Message tracking

Control which hosts and networks can access your

Control Center.

IP-based access

control

Expanded

administration

capabilities

Specify user-based and total limits, configure

automatic message deletions.

Control over

Quarantine size

limits

Support for double-byte character sets.

Language autodetection of messages for Quarantine

and of subject encodings for message handling.

Support for non-ASCII LDAP source descriptions.

Support for

non-ASCII character

sets

Enhanced

localization

capabilities

17About Symantec Mail Security

New features

Functional overview

You can deploy Symantec Mail Security in different configurations to best suit

the size of your network and your email processing needs.

Each Symantec Mail Security host can be deployed in the following ways:

Deployed as a Scanner, a Symantec Mail Security host filters email

for viruses, spam, and noncompliant messages. You can deploy

Scanners on exisiting email or groupware server(s).

Scanner

Deployed as a Control Center, a Symantec Mail Security host allows

you to configure and manage email filtering, SMTP routing, system

settings, and all other functions from a Web-based interface.

Multiple Scanners can be configured and monitored from your

enterprise-wide deployment of Symantec Mail Security, but only

one Control Center can be deployed to administer all the Scanner

hosts.

The Control Center provides information on the status of all

Symantec Mail Security hosts in your system, including system

logs and extensive customizable reports. Use the Control Center

to configure both system-wide and host-specific details.

The Control Center provides the Setup Wizard, for initial

configuration of all Symantec Mail Security instances at your site,

and also the Add Scanner Wizard, for adding new Scanners.

The Control Centrer also hosts the Spam and Suspect Virus

Quarantines to isolate and store spam and virus messages,

respectively. End users can view their quarantined spam messages

and set their preferences for language filtering and blocked and

allowed senders. Alternatively, you can configure Spam Quarantine

for administrator-only access.

Control Center

A single Symantec Mail Security host performs both functions.Scanner and Control

Center

Note: Symantec Mail Security provides neither mailbox access for end users nor

message storage. It is not intended for use as the only MTA in your email

infrastructure.

About Symantec Mail Security

Functional overview

18

Note: Symantec Mail Security does not filter messages that don't flow through

the SMTP gateway. For example, when two mailboxes reside on the same MS

Exchange Server, or on different MS Exchange Servers within an Exchange

organization, their messages will not pass through the Symantec Mail Security

filters.

Architecture

Figure 1-1 shows how a Symantec Mail Security installation processes an email

message, assuming the sample message passes through the Filtering Engine to

the Transformation Engine without being rejected.

Figure 1-1

Symantec Mail Security architecture

Messages proceed through the installation in the following way:

■ The incoming connection arrives at the inbound MTA via TCP/IP.

19About Symantec Mail Security

Architecture

■ The inbound MTA accepts the connection and moves the message to its inbound

queue.

■ The Filtering Hub accepts a copy of the message for filtering.

■ The Filtering Hub consults the LDAP SyncService directory to expand the

message's distribution list.

■ The Filtering Engine determines each recipient's filtering policies.

■ The message is checked against Blocked/Allowed Senders Lists defined by

administrators.

■ Virus and configurable heuristic filters determine whether the message is

infected.

■ Content Compliance filters scan the message for restricted attachment types,

regular exessions, or keywords as defined in configurable dictionaries.

■ Spam filters compare message elements with current filters published by

Symantec Security Response to determine whether the message is spam. At

this point, the message may also be checked against end-user defined Language

settings.

■ The Transformation Engine performs actions per recipient based on filtering

results and configurable Group Policies.

Where to get more information

The Symantec Mail Security documentation set consists of the following manuals:

■ Symantec Mail Security Administration Guide

■ Symantec Mail Security Planning Guide

■ Symantec Mail Security Installation Guide

■ Symantec Mail Security Getting Started

Symantec Mail Security also includes a comprehensive help system that contains

conceptual and procedural information.

You can visit the Symantec Web site for more information about your product.

The following online resources are available:

www.symantec.com/enterprise/supportProvides access to the technical support Knowledge

Base, newsgroups, contact information, downloads,

and mailing list subscriptions

About Symantec Mail Security

Where to get more information

20

Page is loading ...

Symantec Mail Security Administration Manual

This manual is also suitable for

Symantec Mail Security Administration Manual

Related papers

Other documents