3Com 3CR3MFA-92 manual

http://www.3com.com/ Part No. DUA-MFA100-AA A01 Published January 2005 Email Firewall User Guide User Guide for the 3Com ® Email Firewall[...]

3Com Corporation 350 Campus Drive Marlborou gh, MA 01752-3064 Copyright © 2000-2005, BorderWare Technol ogies Inc. Used under licen se by 3Com Corporation. All rights reserved. No part of this documentation may be reproduce d in any form or by any means or used to make any derivative work (such as translation, transformatio n , or adaptation) w it[...]

C ONTENTS A BOUT T HIS G UIDE Conventions 10 Related Documen tation 11 Documentation Comments 11 1 3C OM E MAIL F IREWALL O VERVIEW Deployment an d Installation 13 Installation 14 Features 14 Anti-Spam 14 Anti-Virus Scannin g 14 Malformed Email Checks 14 Attachment Control 15 Email Security 15 Reporting 15 System Administration 16 Main Menu 17 2 C [...]

Virtual Mappings 28 Uploading Virtual Mapping List 29 3 C ONFIGUR ING M AIL S ECURITY Anti-Virus 31 Notificatio ns 33 Pattern Files 33 Attachment Control 34 Notificatio ns 35 Editing Attachment Types 36 Mail Access/Filtering 37 Specific Access Patterns 38 Pattern Based Message Filtering 39 Message Restrictions 39 SMTP Authentica ted Relay 40 SMTP B[...]

59 Objectionable Content Filtering 61 Actions 61 Notificatio ns 62 Upload and Download Filter List 62 Trusted Senders List 62 Adding Trusted Sen ders 63 Spam Quarantine 64 Spam Quarantine Configuration 64 User Notification 65 Set Redirect Action for Anti -Spam Features 65 Enabling User Access on a Network Interface 66 Examining the Quarantine 66 Qu[...]

Time Zone 84 Network Configuration 85 Mail Configuration 85 Admin Account 86 System Users 86 Creating an Admin User 87 Upload and Download User Lists 88 Enabling User Access on a Network Interface 88 Network Settings 89 Network Int erfaces 90 Advanced Parameters 90 Web Proxy 91 Static Routes 92 Licensing 93 Installed License 93 License Agreements 9[...]

8 M ONITORING A CTIVIT Y A ND S TATUS Monitoring Mail Proce ssing Activity 115 Mail Server Status 116 Mail Queue (Mail Q) 116 Mail Queue Statistics 116 Mail Received Recently 116 Troubleshooting Mail Queue Problems 116 Email Firewall Status 117 System Alarms 118 Licensing 118 BorderWare Mail Security Services 118 Network Settings 118 Report P roble[...]

[...]

A BOUT T HIS G UIDE The instructions in this gu ide are designed to help you with configur ation and system administration tasks for the 3Com ® Email Firewall. This guide is inten ded for the system or network administrator who is responsible for configurin g, usin g, and managing the 3Com Email Firewall. It assumes a working knowledge of TCP/IP n[...]

10 A BOUT T HIS G UIDE Conventions Table 1 and Table 2 list conventions that are used throughout this guide. Table 1 Notice Icons Icon Notice Type Description Information note Information that describes important features or instructions Caution Information that alerts you to potential loss of data or potential damage to an application, sy stem, or[...]

Related Documentation 11 Related Documentation In addition to this guide, each 3C om Email Firewall documentation set includes the follo wing: ■ 3Com Email Firewall Installation Guide This guide contains detailed inform ation on installing the 3Com Email Firewall. ■ Releas e Notes These notes provide information about the current soft ware rele[...]

12 A BOUT T HIS G UIDE[...]

1 3C OM E MAIL F IREWALL O VERVIEW This chapter provides an overview of the 3Com E mail Firewall and its features, and includes the following topics: ■ Deployment and Installation ■ Features ■ System Administration Deployment and Installati on The 3Com Email Firewall is designed to be situated between you r mail servers and the Interne t so t[...]

14 C HAPTER 1: 3C OM E MAIL F IREWALL O VERVIEW Installation For detailed information on installation, see the Installation Guide that came with your 3Com Email Firewall. Features The following sections provide an ove rview of the main features of the 3Com Email Firewall. Anti-Spam The 3Com Email Firewall contains a va riety of powerful featu res t[...]

Features 15 Attachment Control Attach ment filtering can be used to control a wide range of problems originating from the use of attachme nts, such as viruses, objectionable content, and confidential documents leaving your network. Both inbound and o utbound email can be scanned . Messages containing forbidden attachments can be rejected or quarant[...]

16 C HAPTER 1: 3C OM E MAIL F IREWALL O VERVIEW System Administration The 3Com Email Firewall is admi nistered via a web browser. The following web browsers are supported: ■ Microsoft Internet Explorer 5.5 or greater ■ Netscape 7.0 or greater ■ Mozilla Firefox 1.0 or greater ■ Safari 1.2.3 or greater Your web browser must ha ve cookies enab[...]

System Administration 17 Main Menu The main menu provides quick ac cess to the 3Com Email Firewall’ s configuration and management options. The menu is divided into the following sections: ■ Activity — The Activity screen provides you with a variety of information on mail pr ocessing activity, such as the n umber of messages in the mail queue[...]

18 C HAPTER 1: 3C OM E MAIL F IREWALL O VERVIEW ■ Reporting — This menu allows you to view and configure the reporting and system log features of th e 3Com Email Firewall. ■ System Configuration — This menu allows you to view and modify system configuration settings such as: ■ The Setup Wizard ■ Admin Account ■ System Users ■ Networ[...]

2 C ONFIGURING M AIL D ELIVERY This chapter describes how to conf igure yo ur 3Com Email Firewall to accept and deliver mail, and includes the following topics: ■ Mail Routing ■ Delivery Settings ■ Mail Mappings ■ Virtual Mappings Mail Routing Mail Routes are used to define th e domains you will be accepting mail for, and where locally to d[...]

20 C HAPTER 2: C ONFIGURING M AIL D ELIVERY ■ Route-to — Enter the address for the mail server to which mail will be delivered. This is your local mail se rver, such as a Microsoft Exchange mail system. ■ MX — (Optional) Select the MX check box if you need to look up the mail routes in DNS before delivery. If this is not enabled, MX records[...]

Mail Routing 21 Additional Mail Route Rules When adding an additional mail route for a local email server, you must add a Specific Access Pat tern and a Pattern Based Message Filter to trust mail from that server for Anti-Spam training purposes. These procedures are not required for the default mail route you configured at installation time with th[...]

22 C HAPTER 2: C ONFIGURING M AIL D ELIVERY 4 Select Client Access 5 Select Trus t for the action if the pa ttern matches, and click OK . Adding a Pattern Based Messa ge Filter 1 Select Mail Delivery -> Mail Access/Filtering from the menu. Select Pattern Based Message Filtering . 2 Click Add to add a new filter rule. 3 Select Client IP as the Me[...]

Delivery Settings 23 Delivery Settings You can customize various delivery sett ings that affect how you accept and deliver mail messages. Select Mail Delivery -> Delivery Settings from t he menu. Delivery Settings ■ Maximum time in mail queue — Enter the number of days for a message to stay in the queue before being returned to the sender as[...]

24 C HAPTER 2: C ONFIGURING M AIL D ELIVERY checked against the Mail Routing table, and if the destination is not specified the email will be sent to the Default Mail Relay server for delivery. This option is typically us ed when the 3Com Email Fir ewall cannot deliver email directly to remote mail ser vers. ■ Ignore MX record — Enable this opt[...]

Delivery Settings 25 Advanced Delivery Settings Click the Advanced button to reveal options for advanced SMTP (Simple Mail Transport Protocol) setting s and SMTP notifications. Advanced SMTP Settings ■ SMTP Pipelining — Pipelinin g allows more than one SMTP command to be inserted into a networ k pa cket which reduces SMTP connection times. Some[...]

26 C HAPTER 2: C ONFIGURING M AIL D ELIVERY double bounce message with a copy of the en tire single bounce message. ■ Delay — Inform the postmaster of delayed mail. In this case, the postmaster receives message headers only. ■ Policy — Inform the postmaster of cl ient requests that were rejected because of unsolicited mail policy restrictio[...]

Mail Mappings 27 Click Add to add a new mapping to your list. ■ External mail address — Enter the external mail addr ess that you want to be converted to the specified internal email address for incoming mail. The specified internal address will be converted to this external address for outgoing mail. ■ Internal mail address — Enter the in [...]

28 C HAPTER 2: C ONFIGURING M AIL D ELIVERY Virtual Mappings Virtual Mappings are used to redirect mail addressed for one domain to a different domain. This process is performed without modifying the To: and From: headers in the mail, as virtual mappings modify the envelope-recip i ent address. For example, the 3Com Email Firewall can be configured[...]

Virtual Mappings 29 Uploading Virtual Mapping List A list of virtual mappings can also be uploaded in one text file. The file must contain comma or tab separated entries in the form: [map_in],[map_out] For example: user@example.com,user user@example.com,user@example2.com @example.com,@example2.com The file ( virtmap.csv ) should be created in csv f[...]

30 C HAPTER 2: C ONFIGURING M AIL D ELIVERY[...]

3 C ONFIGURING M AIL S ECURITY This chapter describes how to conf igure mail security settings on your 3Com Email Firewall, and includes the following topics: ■ Anti-Virus ■ Attachment Control ■ Mail Access/Filtering ■ SMTP Secur ity ■ Malformed Email Anti-Virus The 3Com Email Firewall provides a built-in virus scanning service. When enab[...]

32 C HAPTER 3: C ONFIGURING M AIL S ECURITY Select Mail Delivery -> Anti-Virus from the menu to enable and configure virus scanning. ■ Enable virus scanning — Select the check box to enable virus scanning. ■ Quarantine unopenable attachment s —This option is enabled by default to quarantine attach ments that are passwor d-protected and f[...]

Anti-Virus 33 Notifications Notifications for inbound and outbound messages can be enabled for all recipients, the sender, and the admini strator. Customize the content for the Inbound and Outbound notification in the corr esponding text boxes. See Appendix A “ Customizing System Messages ” on page 125 for a full list of variables that can be u[...]

34 C HAPTER 3: C ONFIGURING M AIL S ECURITY Attachment Control Attachment filtering can be used to contro l a wide range of problems originating from the use of atta chments, inclu ding the following: ■ Viruses — Attachments that can po tentially contain viruses can be blocked. ■ Offensi ve Content — The 3Com Emai l Firewall can bl ock the [...]

Attachment Control 35 Notifications Notifications for inbound and outbound messages can be enabled for all recipients, the sender, and the admini strator. Customize the content for the Inbound and Outbound notification in the corresp onding text boxes. See Appendix A “ Customizing System Messages ” on page 125 for a full list of variables that [...]

36 C HAPTER 3: C ONFIGURING M AIL S ECURITY Editing Attachment Types Click the Edit bu tton to edit your attach me nt types. You can add file extensions ( .mp3 ), or MIME content ty pes ( image/gif ). For each attachment type, choose whether you want to "BLOCK" or "Pass" the attachment. Select the DS (Disable Con tent Scan) chec[...]

Mail Access/Filt ering 37 Mail Access/Filtering The 3Com Email Firewall provides a n umber of filtering options t o ensure that specific mail messa ges are no t accepted from the incoming SMTP connection. In the Mail Access/Mail Filtering settings, you can specify patterns to match for on incoming connections and configure an approp riate action. T[...]

38 C HAPTER 3: C ONFIGURING M AIL S ECURITY Specific Access Patterns Click th e Add Pattern button to add a new specific access pattern. ■ Pattern — Enter a mail address, hostname, domain name, or IP Address. ■ Client Access — This parameter is used for domain, hostname, or IP address patterns. This item is the most relia ble and may be use[...]

Mail Access/Filt ering 39 Pattern Based Message Filtering Pattern Based Message Filtering is th e primary tool for whitelisting and blacklisting messages. An administrator can specify t hat mail is rejected or whitelisted according to the contents o f the message envelope, message header (such as the sender, recipient, subject), and body text. See [...]

40 C HAPTER 3: C ONFIGURING M AIL S ECURITY SMTP Authentica ted Relay This feat ure allows authen ticated c lients to use the 3Com Email Firewall as an ext ernal mail relay fo r sendin g mail. For example, you may have remote users that need to send mail via this system. Client systems must use a login and password to authenticate to the system bef[...]

SMTP Security 41 SMTP Security The 3Com Email Firewall offers a simple mechanism for enc rypting mail delivery via SSL (Secure Sockets Laye r) and TLS (Transpor t Layer Security) support. A flexible policy can be im plemented to allow other servers and clients to establish encrypted sessio ns with the 3Com Email Firewall to send and receive mail. T[...]

42 C HAPTER 3: C ONFIGURING M AIL S ECURITY Select Mail Delivery -> SMTP Security from the menu to enable and configure email encryption. Incoming Mail ■ Accept TLS — Enable th is option to accept SSL/TLS for incoming mail connections. ■ Require TLS for SMTP AUTH — This va lue is used to require SSL/TLS when accepting mail for authentica[...]

SMTP Security 43 Specific Site Policy This option supports the specification of exceptions to the d efault settings for SSL/TLS. For example , y ou may need to e xempt a mail serve r from using SSL/TLS because of lack of TLS support. To exempt a system, spe cify the IP Address or FQDN (Fully Qualified Domain Name) of the remo te mail server in the [...]

44 C HAPTER 3: C ONFIGURING M AIL S ECURITY Malformed Email Many viruses try to elude virus scan ners by concealing themselves in malformed messages. The scanning engi nes cannot detect the attachment and pass the comp lete message through to an internal server. Some mai l clients try to rebuild ma lf ormed messages and may rebuild or activate a vi[...]

Malformed Email 45 ■ Actions — Select an action to be per formed. Options include: ■ Just log: Log the event and take no further action. ■ Reject mail: The message is reje cted with notification t o the sending system. ■ Quarantine mail: Th e message is placed into quarantine . ■ Discard mail: The message is discarded without notificati[...]

46 C HAPTER 3: C ONFIGURING M AIL S ECURITY[...]

4 A NTI -S PAM C ONFIGURATION This chapter describes how to configure the Anti-Spam features of your 3Com Email Firewall, and includes the following topics: ■ Anti-Spam Features ■ DCC ■ STA ■ Pattern Based Message Filtering ■ Objectionable Content Filtering ■ Trusted Senders List ■ Spam Quarantine ■ Quarantine and Trusted Sende rs L[...]

48 C HAPTER 4: A NTI -S PAM C ONFI GURATION Select Mail Delivery -> Anti-Spam from the menu to configure the 3Com Email Firewall’ s An ti-Spam feat ures. The Default Anti-Spam Action defines the type of action to be used for the preselected Anti-Spam featu res. Possible actions include: ■ Disable Anti-Spam — The Anti-Spam fe atures are dis[...]

DCC 49 DCC DCC (Distributed Checksum Clearinghouse) is a tool used to identify bulk mail and is based on a number of server s that maintain databases of message checksums. Thes e checksums a re derived from n umeric values that uniquely identify a message. DCC provides a simple but very effective way to successfully identify spam an d control its d[...]

50 C HAPTER 4: A NTI -S PAM C ONFI GURATION ■ Redirect to: The message will be deliver ed to the mail address specified in Action Data. ■ Reject mail: The mail will not be accepted and the connecting mail server is force d to return it. ■ BCC (Blind Carbon Copy): The messa ge will be copied to the mail address specified in Action Data. ■ Ac[...]

STA 51 ■ Mail identified as "bulk" by DCC is also anal yzed to provide an example of local spa m. Select STA from the Mail Delivery -> Anti-Spam menu to conf igure STA settings. ■ STA Mode — Use one of the fo llowing three modes for STA: ■ Normal: This is the default mode and is recommended in most cases. The STA upper threshol[...]

52 C HAPTER 4: A NTI -S PAM C ONFI GURATION Spam Action Specify an action when STA flags a message as spam. ■ Action — The action can be one of the following: ■ Just log: An entry is made in the log and no other action is taken. ■ Modify Subject Header: The text specified in Action Data will be inserted into the message subject line. ■ Ad[...]

STA 53 ■ Redirect to: The message will be deliver ed to the mail address specified in Action Data. ■ Reject mail: The mail will not be accepted and the connecting mail server is force d to return it. ■ BCC: The message will be copied to the mai l address specified in Action Data. ■ Action data — Depending on the specified action: ■ Modi[...]

54 C HAPTER 4: A NTI -S PAM C ONFI GURATION STA Training The STA training section displays st atistics of all mail analyzed by the 3Com Email Firewall. Click the Rebuild STA button to reb uild the STA database. The STA run-time engine is built and rebuilt at 12 hour intervals using several sources such as the supplied spam da ta, the DCC spam (if e[...]

Pattern Based Message Filtering 55 Some default PBMF rules are provided and more can be added b y clicking the Add button. Message Part Select a Message Part from the dropdown list. The following diagram and sections explain each pa rt of the mail message.[...]

56 C HAPTER 4: A NTI -S PAM C ONFI GURATION Message Envelope Parameters These parameters will no t be visible to the user. They are the “handshake” part of the SMTP protocol . You will need to look for these in the transport logs or have other knowledge of them. ■ <<Mail Envelope>> — This parameter allows for a match on any part[...]

Pattern Based Message Filtering 57 Message Header Parameters Spammers will typically enter false in formation into these fields and, except for the Subject field, they are usually not useful in controlling spam. These fie lds may be useful in wh itelisting certain users or legitimate source of email. ■ <<Mail Header>> — This pa rame[...]

58 C HAPTER 4: A NTI -S PAM C ONFI GURATION Match Opt ion The match option looks for the specified text in each line. You can specify one of the following: ■ Contains — Looks for t he text to be contained in a line or field. This allows for spaces or other characte rs that may make an exact match fail. ■ Ends with — Looks for the text at th[...]

Pattern Based Message Filtering 59 ■ Do Not Train — Do not use the message for STA training purposes. This option will not overri de other PBMF’ s if it applies to the same message. ■ BCC — Send a blind carbon copy mail to the mail address specified in Action Data. This option only appears if you have a BCC Email Address set up in the Pre[...]

60 C HAPTER 4: A NTI -S PAM C ONFI GURATION ■ Modify Subject Header: The text specified in Action Data will be inserted into the message subject line. ■ Add header: An "X-" mail header will be added as specified in the Action Data. ■ Redirect to: The message will be deliver ed to the mail address specified in Action Data. ■ Reject[...]

Objectionable Cont ent Filtering 61 Objectionable Content Filtering The Objectionable Content Filt er defines a list of key words that will cause a message to be blocked if any of those word s appear in the message. Select Objectionable Co ntent Filtering fr om the Mail Delivery -> Anti-Spam menu to configure t he filter. Actions You can set act[...]

62 C HAPTER 4: A NTI -S PAM C ONFI GURATION Notifications Notifications for inbound and outbound messages can be enabled for all recipients, the sender, and the ad ministrator. The content for the Inbound and Outbound notification can be customized. See Appendix A “Customizing System Messages” on page 125 for a full list of variables that can b[...]

Trusted Senders List 63 ■ Maximum number of entries per us er — Enter a maximum number of list entries for each user. Adding Tr usted Sende rs When the Trusted Senders List option is enabled glob ally, local 3Com Email Firewall users can log in and add their own addresses using the same interface as they use for ch ecking the Spam Quarantine . [...]

64 C HAPTER 4: A NTI -S PAM C ONFI GURATION Spam Quarantine The Spam Quarantine contains quara ntined mail messages for each local user on the 3Com Email Firewall. For each Anti-Spam feature (DCC, STA, and so on) that you want to use the user Spam Quarantine, you must set the Action to Redirect To , and the Action Data to the 3Com Email Firewall ad[...]

Spam Quarantine 65 User Notification ■ Enable Summary Email — Select the check box to enable a summary email notification that alerts users to mail that has been placed in their quarantine folder. ■ Notification Domain — Enter the do main for which notificat ions are sent to. This is typi ca lly the FQDN (Fully Qua lified Domain Name) of th[...]

66 C HAPTER 4: A NTI -S PAM C ONFI GURATION Enabling User Access on a Network Interface You must enable User Access on the network interface to allow users to login to the Spam Quaran tine via that interface. Select System Conf ig -> Network Settings and go to the Network Interface section. Select the User Access check box to allow access to the[...]

Quarantine and Trusted Senders List Us ers 67 Quarantine and Trusted Senders List Users You must add local users to the 3Com Email Firewall if you require the ability for users to view the Spam Quarantine or configure the ir Trusted Senders Lists. Select System Config -> Users from the menu. Click the Add a New User button to add a new user to t[...]

68 C HAPTER 4: A NTI -S PAM C ONFI GURATION Upload and Downlo ad User Lists You can upload lists of users using comma or tab separated text files. You can specify the login ID, password, email ad dress, and disk quota in megabytes. Use the following format: [login],[password],[e mail address],[quota] For example, user,ajg7rY,user @example.com,0 The[...]

Advanced Anti-Spam Options 69 Advanced Anti-Spam Options Click the Advanced button to reveal the following advanced Anti-Spam options. RBL (Realtime Blackhole List) RBLs contain the addresses of known sources of spam and are maintained by both commercial and non-commercial organizations. The RBL mechanism is based on DNS. Every server t hat attempt[...]

70 C HAPTER 4: A NTI -S PAM C ONFI GURATION ■ Add header: An "X-" mail header w ill be added as specified in the Action Data. ■ Redirect to: The messa ge will be delivered to the mail address specified in Action Data. ■ Reject mail: The mail will not be accepted and the connecting mail server is force d to return it. ■ BCC: The me[...]

5 R EPORTING This chapter d escribes the reportin g fe atures of the 3Com Email Firewall, and includes th e following topics: ■ Generating Reports ■ System Logs ■ Email History ■ System History ■ Configure History Settin gs Generating Reports The 3Com Email Firewall's reporting features provide a comprehensive range of informative re[...]

72 C HAPTER 5: R EPORTING Administrators can sp ecify which data is to be included in each report, how it is to be displayed, the order of d ata, and the number of ent ries to report, such as “Top 10 Disk Space Users”. Select Reporting from the menu to view and config ure reports. To view a previously generated re port, click on the report name[...]

Generating Reports 73 ■ Paper Size — For PDF format, select the paper size such as Letter, A4, or Legal. ■ Describe fields in report — Select this option to include a short description of each field in the report. Report Ge neration ■ Enable Auto Generate — Se lect this check box to automatically generate reports. ■ Auto Generate Repo[...]

74 C HAPTER 5: R EPORTING Report Fields Th e Fields section allows you t o choose which fields or items of information you wish to include in t h e report. You can include or exclude fields as req uired. Use the Limit column to limit the number of items for that field, such as listing the “Top Ten” viruses. Table 3 Report Field Descriptions Fie[...]

Generating Reports 75 Blocking pie chart A pie chart of the same data as the right hand column of Traffic Blocking (timespan). Total traffic Received Graphs of the number of messages received per hour over the reporti ng period (timespan). Total traffic sent Graphs of the number of messages sent per hour over the reporti ng period (timespan). Total[...]

76 C HAPTER 5: R EPORTING Top senders The top sender (j udged by Envelope from, no t Header from) during the report timespan, sorted by number of messages. If the title contains one or more comma characters, the list will be restricted to those senders which include any string after the first comma. The limit parameter in the report configuration s[...]

System Logs 77 System Logs The system logs provide det ailed information on all mail transport and system related events. Select Reporting -> System Logs from the menu to view the log files. The Mail Transport log is the most important log to monitor becau se it contains a record of all mail proc essed by the 3Com Email Fi rewall. Other logs inc[...]

78 C HAPTER 5: R EPORTING Viewing Log Det ails Select a specific log to view, search, and download its detailed entry information. Configuring a Syslog Server Logs can also be forwarded to a syslo g server which is a host that collects and stores log files from many sources. You can define a syslog host in the System Config -> Network Settings s[...]

Email History 79 Email History Every message that p asses through the 3Com Email Firewall generates a database entry that records inform ation about how it was processed, including a detailed journal identifying the results of the mail processing. Select Reporting -> Email History from the menu to view the message history. You can quickly search[...]

80 C HAPTER 5: R EPORTING System History The system history is a record of syst em events, such as login failures, and disk space and CPU usage . Select Reporting -> System History from the menu to view the system event history. Event Types The following table descr ibes the ev ent types that can appear in the System History database. Table 4 Sy[...]

System History 81 DCC Preferred The round trip time to preferred DCC server Name of preferred server Disk IO MB p er seco nd transfer, KB per transfer, transfers per second for a disk Disk Usage Amount of used and total available disk space for each disk slice Logins A single web based lo gin UserID and IP address Logouts A single web based logout [...]

82 C HAPTER 5: R EPORTING Configure History Settings In the Configure Report ing History Size screen, you can configure how many emails and system events to keep in the logs and how long you want to keep them. Setting higher values will use up more disk space and cause backups to take much longer to complete if they include the reporting data. Sele[...]

6 S YSTEM C ONFIGURATION This chapter describes how to view and modify the system configuration of the 3Com Email Firewall, a nd includes the following topics: ■ Setup Wizard ■ Admin Account ■ System Users ■ Network Settings ■ Web Proxy ■ Static Routes ■ Licensing ■ SSL Certificates ■ Software Updates Setup Wizard The Setu p Wizar[...]

84 C HAPTER 6: S YSTEM C ONFIGURATION Select System Config -> Setup Wizard from the menu to start the Setup Wizard. Click Finish at any time to exit the Setup W izard. Click Back to go to the previous step. Change Password Enter your old password and set a new password if required. Click Apply if you have mad e any changes. If you do not want to[...]

Setup Wizard 85 Network Config uration Mo dify your network settings if required , and click Apply if you have made any changes. If you do not want to modify your networ king information, click Next to continue. Mail Configuration Modify your mail conf iguration and pr oxy settings if required, and click Apply if you have made any changes. If you d[...]

86 C HAPTER 6: S YSTEM C ONFIGURATION Admin Account Select System Conf ig -> Admin Accoun t from the menu to mo dify the administrator accoun t settings. You can modify the address to which mail to the administrat or is forwarded to, and ch ange the admin account passw ord. CAUTION: If you forget your admin passwor d, you will have to reinstall [...]

System Users 87 Click the Add a New User button to add a new user to the system. Enter a User ID and a Password . Creating an Admin User If this user will be an additional administrator for this 3Com Email Firewall, select the Full Admin option in the Administrator Privileges section. When a Full Admin user logs into the 3Com Email Firewall, they m[...]

88 C HAPTER 6: S YSTEM C ONFIGURATION Upload and Downlo ad User Lists You can upload lists of users using comma or tab separated text files. You can specify the login ID, password , email address, and disk quota in megabytes. Use the following format: [login],[password],[e mail address],[quota] For example, user,ajg7rY,user @example.com,0 The file [...]

Network Settings 89 Network Settings The Network Settings screen allows you to modify your network settings such as the Hostname, Domain name, IP add ress, Name Server, an d network interface settings. Select System Conf ig -> Network Settings fr om the menu to manage your networking information. ■ Hostname — Enter the hostname (not the full[...]

90 C HAPTER 6: S YSTEM C ONFIGURATION Network Interfaces In the Network Interf aces section, you can modify yo ur network interf ace information such as the IP addr ess, netmask, and enable local user access. ■ IP Address — Enter the IP addre ss for this 3Com Email Firewall. ■ Netmask — Enter the appropriate netmask for your network. ■ Me[...]

Web Proxy 91 Web Proxy A secure proxy server may be used to cache and proxy requests to systems external to your network, such as an HTTP web proxy se rver. If you use a proxy server on your network, yo u must enter the proxy server address and a username and password to allow Anti-Virus, Anti-Spam, and Licensing se rvices to retrieve updates. Sele[...]

92 C HAPTER 6: S YSTEM C ONFIGURATION Static Routes Static routes are requ ired if the mail servers to wh ich mail must be relayed are located on another network, such as behind an internal firewall or accessed via a V PN. Select System Config -> Static Routes from the menu to define any static routes. To add a new static route , enter the netwo[...]

Licensing 93 Licensing Your 3Com Email Firewall must be li censed be fore it can p rocess mail. The Licensing screen allows you to view y our current license information and enter a new license key if you are renewing or upgrad ing your current license. Select System Config -> Licensing from the menu to view and manage your license information. [...]

94 C HAPTER 6: S YSTEM C ONFIGURATION License Agreements Click the specified button to view the license agreements for th e 3Com Email Firewall, the Anti-Virus soft ware, and Third Party Open Source products. License Renewal or Upgrade To renew or upgrade your license, y ou will need an an nual subscription renewal key or an additional user key. Yo[...]

SSL Certificates 95 To install a commercial certificate: 1 Select System Config -> SSL Certificates from the menu to view and manage your certificates. 2 Create a new self-signed ce rtificate by clicking the Generate a 'self-signed' certificate button. 3 Click Apply . You must then reboot to install the new certificate. 4 Click the Sho[...]

96 C HAPTER 6: S YSTEM C ONFIGURATION Software Updates It is important to keep your 3Com Email Firewall so ftware updated with the latest patches and upgrades. A key aspect of good security is responding quickly to new attacks a nd exp osures by updating the system software when updates are available. Software updates can be delivered or retrieved [...]

Software Updates 97 When the system restarts, th e update will appear in the Installed Updates section. Before applying any update, backup y our system configuratio n and data. Select System Mgmt -> Backup & Re store from the menu to perform a backup. Security Connection Th e Security Connection is a service running on the 3Com Email Firewal[...]

98 C HAPTER 6: S YSTEM C ONFIGURATION[...]

7 S YSTEM M ANAGEMENT This chapter describes how to use the system management features of the 3Com Email Firewall, and includes the follo wing topics: ■ Status and Utility ■ Mail Queues ■ Quarantine ■ Daily Tasks ■ Backup and Restore ■ Reboot and Shutdown ■ Reset to Factory Settings Status and Utility Select System Mgmt -> Status a[...]

100 C HAPTER 7: S YSTEM M ANAGEMENT Utility Functions The Utility Functions section allows you to c ontrol mail services and run network an d diagnostic utili ties. ■ Mail System Control — Use this button to Stop and Start all mail queues. ■ Mail Receiving — Use this button to disable and enable mail receiving only. ■ Mail Sending — Use[...]

Status and Utility 101 SMTP Probe The SMTP (Simple Mail Transp ort Protocol) Probe is used to te st email connectivity with a remote SMTP server . This allows you to verify that a specific SMTP server is responding to connection requests and returning a valid response. In the SMTP Probe screen you must enter the destination SMTP server, the envelop[...]

102 C HAPTER 7: S YSTEM M ANAGEMENT The response field will show the resu lt of the SMTP diagnostic probe, including the response for each SMTP command sent: Sending mail... <<< 220 ESMTP Postfix (2.1.0) HELO example.com <<< 250 mail.example.com MAIL FROM:sende r@exa mple.com <<< 250 Ok RCPT TO:joe@example.com <<<[...]

Status and Utility 103 Traceroute Utility Traceroute is used to see the routin g steps between two hosts. If yo u are losing connectivity somewhere in between the two hosts, you can use traceroute to see where exactly th e packet is losing its connection. The traceroute utility will show each network “hop” as it passes through each router to it[...]

104 C HAPTER 7: S YSTEM M ANAGEMENT Current Admin and Spam Quarantine Users The Current Admin and Spam Quarantine Us ers section displays who is logged in via the admin interface or through a Spam Quarantine session. Configuration Information The configuration infor mation screen shows you important system information such as the current version of[...]

Quarantine 105 Quarantine The Quarantine area contains messages th at have been quarantined because of a virus, malformed mess age, illegal attachment, or other issue. Select System Mgmt -> Quarantine to view an d manage the qua rantine area. You can view the details of a message by clicking on its ID number or remove the message from quarantine[...]

106 C HAPTER 7: S YSTEM M ANAGEMENT ■ Expire automatically — Enable th is featur e to expire messages automatically. ■ Days — Enter how many days to ke ep a quara ntined message before deleting it. ■ Maximum Quarantine Disk Usage (pe rcentage) — Enter a percenta ge of disk usage that can be used by the quarantine area. If the quarantine[...]

Backup and Resto re 107 Backup and Restore The 3Com Email Firewall can backup all data, in cluding the database, quarantined items, mail queues, ma ilboxes, uploaded user lists, SSL certificates, report s, and system configuration dat a. The restore feature can restore any of these items indi vidually. Th e 3Com Email Firewall should be backed up b[...]

108 C HAPTER 7: S YSTEM M ANAGEMENT Confirm the listed options, and then click C reate backu p now to be gin. The file ( backup.g z) will be then be download ed to your local system. FTP Options If you choose the FTP option you must specify the address of the destination FTP server, includ ing a valid login and password. ■ Encrypt b ackup — Sel[...]

Backup and Resto re 109 ■ Use PASV mode — PASV (Passive) mode may be required for some types of FTP servers. Choose this option if you are having problems with connecting to your FTP server. Click Next >> to continue. Confirm the listed options, and then click C reate backu p now to begi n. Alternately , you can click Create scheduled bac[...]

110 C HAPTER 7: S YSTEM M ANAGEMENT Confirm the listed options, and then click C reate backu p now to be gin. Alternatel y, you can click Create schedu led backup to go to the Daily Tasks menu to create a recurring Email backup.[...]

Backup and Resto re 111 Restores To perform a system restor e, select the type of re store to perform (Local Disk or FTP) and click the Next >> button. Restore from Local Disk To perform a restore from a file on a local disk, click the Browse button to find the backup file. If you are restor ing from an email backup, you must save the email a[...]

112 C HAPTER 7: S YSTEM M ANAGEMENT Restore from FTP To restore from FTP, enter the follow ing required information to connect to your FTP server. ■ Remote FTP server name or IP — En ter the hostname or IP add ress of the destinat ion FTP serve r. ■ Username on FTP server — Enter the username to log in to this FTP server. ■ Password on FT[...]

Reboot and Shutdown 113 Reboot and Shutdown The 3Com Email Firewall can be safely rebooted or shut down f rom the System Mgmt -> Reboot and Shut down screen. Before shutting down, remove any media from t he floppy and CDROM drives. Click Reboot n ow to shutdown the system and reboot. Click Shutdo wn now to shutdown the system completely. Reset t[...]

114 C HAPTER 7: S YSTEM M ANAGEMENT[...]

8 M ONITORING A CTIVITY A ND S TATUS This chapter describes how to monitor the 3Com Email Firewall’ s mail processing activity and sy stem status, an d includes the following topics: ■ Monitoring Mail Processing Activity ■ Email Firewall Status Monitoring Mail Processing Activity Select Activity from th e main menu to view the 3Com Email Fire[...]

116 C HAPTER 8: M ONIT ORING A CTIVITY A ND S TATUS Mail Server Status The mail system status is shown in the top left window. Mail will either be running or stopped. Use t he Stop or Start button to control mail processing. Mail Queue (Mail Q) The mail queue activity (Mail Q) section di splays the number of Queued , Deferred , and Total messages i[...]

Email Firewall Status 117 Email Firewall Status Select St atus from the main menu to determ ine if all services and servers are functioning pr operly. For each service, a status icon will indicate if the se rvice is running properly, if t here is a warnin g, or the service is unable to connect.[...]

118 C HAPTER 8: M ONIT ORING A CTIVITY A ND S TATUS Ensure that the follo wing services are running and the information displayed is correct. System Alarms Indicates if there are any pending sy stem alarms. You wil l receive an alarm if there is an FTP backup error or if a license expires. Licensing ■ License — Displays your license in formatio[...]

Email Firewall Status 119 If there are issues with a certain servic e, click the service check icon beside the help button to perform a test of that particular subsystem. Report Prob lems Click th e Report Prob lems button at the b ottom of the Status page to send select ed repor ts back to 3Com for analysis if you experiencing problems with your 3[...]

120 C HAPTER 8: M ONIT ORING A CTIVITY A ND S TATUS Troubleshootin g Mail Delivery Problems When experiencing any mail delivery problems, the first step is to examine if the problem is affecti ng only incoming mail, out going, or both. For example, if you are rece ivin g mail, but not sending outgoing mail, it is certain that your Internet connecti[...]

Troubleshooting Mai l Delivery Problems 121 a period of time. You can view the Mail Transport logs to see the relevant messages that may indi cate why you cannot connect to that particular mail server. The server could be down, too busy, or not currently accepting connect ions. Examining Log Files Examine the system log files in the Reporting ->[...]

122 C HAPTER 8: M ONIT ORING A CTIVITY A ND S TATUS Utility Functions In the System Mgmt -> Status and Utility screen, there are utilities that can be used to help troubleshoot n e twork connectivity and mail queue issues. ■ Flush Mail Queue — Use this utilit y if you have a high amount of deferred mail that you would like to try and deliver[...]

Troubleshooting Co ntent Issues 123 Troubleshooting Content Issues If the mail has been de livered to th e 3Com Email Firewall successfully, it will undergo security proc essing before delivery to its final destination. Many of the security tools used by the 3Com Email Firewall, such as Anti-Spam, Content Filtering, Anti-V irus scanning, Attachment[...]

124 C HAPTER 8: M ONIT ORING A CTIVITY A ND S TATUS Click on a specific message to see th e details of its pr ocessing and final disposition.[...]

A C USTOMIZING S YSTEM M ESSAGES Message variables can be used to cu stomize the content o f notification, annotation, and delivery messages. The 3Com Email Firewall will substitute your local settings for the variables at the time the message is sent. For example, in the following Delivery Failure Notification message from Mail Delivery -> Deli[...]

126 A PPENDIX A: C USTOMIZING S YSTEM M ESSAGES %HOSTNAME% Hostname entered on the Network Settings screen mail.example.com %POSTMASTER_MAIL _ADDR% Email address of the admin user admin@example.com %DELAY_WARN_TIME % In Delivery Settings - Time before Delay Warning 4 hours %MAX_QUEUE_TIME % In Delivery Settings - Maximum Time in Mail Queue 5 days %[...]

B R ESET TO F ACTORY D EFAULT S ETTINGS FROM C ONSOLE If you need to return the 3Com Em ail Firewall to its factory default settings, you should use the System Mgmt -> Factory Settings screen from the main menu. If you have forgotten your admin pa ssword, it cann ot be recovered and you will not be able to login to the 3Com Email Fire wall. In t[...]

128 A PPENDIX B: R ESET TO F ACTORY D EFAULT S ETTINGS FROM C ONSOLE 8 You will need to reinstall and license the system using the Setup Wizard and License Wizard . See the Installation Guide for details on installing the 3Com Email Firewall.[...]

C T HIRD P ARTY C OPYRIGHT AND L ICENSE A GREEMENTS APACHE Apache Licens e Version 2.0, January 2004 http://www .apache. org/licenses/ TERMS AND COND ITIONS FOR USE, REPRODUCTION, A ND DISTRIBUTION 1. Definitions. "License" shall mean the terms an d conditions f or use, reproduction , and di stributi on as defined by Sections 1 through 9 [...]

130 A PPENDIX C: T HIRD P ARTY C OPYRIGHT AND L ICENSE A GREEMENTS "Contributor" sh all mean Licensor and any individu al or Legal Entity on behalf of w hom a Contributio n has been received by Licensor and subsequently incorporated wi thin the Work. 2. Grant of Copyright License. Subject to the terms an d co nditions of this License, eac[...]

131 9. Accepting Warranty or Additional Li abilit y. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support , warranty, indemn ity, or other liabil ity obligations and/or rights cons istent with this Licens e. However, in accepting such obligations , You may act only on Your o[...]

132 A PPENDIX C: T HIRD P ARTY C OPYRIGHT AND L ICENSE A GREEMENTS DCC Distribut ed Checks um Clearinghouse Copyright (c) 200 4 by Rhyolite Software Permission to use, copy, modif y, and distribute this so ftware for any purpose with or without fee is hereby granted, provided that the above copyrigh t notice and this permission notic e appear in al[...]

133 FreeBSD Copyright 1994-200 4 The FreeBSD Project. All rights reserved. Redistributi on and use in source and binary forms, with or witho ut modifi cation , are permitted provided that the following cond itions are met: Redistributions of source code must retain the above c opyright notice, this lis t of conditions and the followi ng disc laime [...]

134 A PPENDIX C: T HIRD P ARTY C OPYRIGHT AND L ICENSE A GREEMENTS Legal Terms =========== Definitions -------------- Throughout this license, the terms `p ackage', `FreeType Proj ect', and `FreeTyp e archive' refer to the set of files originally distr ibuted by the authors (David Turner, Robert Wilhelm, and Werner Lemberg) as the `F[...]

135 4. Contacts ----------- There are two mailing lists related to FreeType: * freetype@freetype.org Discusses general use and applicatio ns of FreeType, as we ll as future and wanted additions to the library and distributi on. If you are looking for sup port, start in this list if you haven't found anyth ing to help you in the documentation. [...]

136 A PPENDIX C: T HIRD P ARTY C OPYRIGHT AND L ICENSE A GREEMENTS JPEG The authors make NO WARRANTY or representation, either express or implied, w ith respect to this software, its quality, accuracy, mer chantability, or fitness for a pa rti cular purpose. This softw are is provided "AS IS" , and you, its user, assume the enti re risk a[...]

137 ModSSL Copyright (c) 199 8-2004 Ralf S. Engelschall. All rights reserved. Redistributi on and use in source and binary forms, with or witho ut modifi cation, are permitted provided that the following cond itions are met: 1. Redistributions of s ource code must retain the ab ove copyright no tice, this list of conditions and the following discla[...]

138 A PPENDIX C: T HIRD P ARTY C OPYRIGHT AND L ICENSE A GREEMENTS NTP Copyright (c) David L. Mills 1992-20 04 Permission to use, copy, modif y, and distribute this so ftware and its documentation for any purpos e and without fee is hereby granted, provided that the above copyrigh t notice appears in all copies and that both the copyright not ice a[...]

139 OpenSSH The licences which components of thi s software fall under ar e as follows. First, we will summarize and say that all components are under a BSD licence, or a licence more free than that. OpenSSH contains no GPL code. 1) Copyright (c) 1995 Tatu Ylonen <ylo@c s.hut.fi>, Esp oo, Finland All rights reserved As far as I am concerned, [...]

140 A PPENDIX C: T HIRD P ARTY C OPYRIGHT AND L ICENSE A GREEMENTS 4) The Rijndael implementat ion by Vincent Rijmen, Ant oon Bosselaers and Pau lo Barreto is in the public domain and di stributed with the follo wing license: @version 3.0 (D ecember 2000) Optimised ANSI C code for the Rijndael cipher (now AES) @author Vincent Rijmen <vincent.rij[...]

141 2. Redistributions in binary form must reproduce th e a bove copyrigh t notice, this list of condi tions and the following disclaimer in the documentati on and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE AUT HOR ``AS IS'' AND AN Y EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, TH [...]

142 A PPENDIX C: T HIRD P ARTY C OPYRIGHT AND L ICENSE A GREEMENTS PAM Redistributi on and use in source and binary forms of L inux-PAM, w ith or without modification, are permitted provided that the fol lowing conditions are met: 1. Redistributions of source code must retain an y existi ng copyrigh t notice, and this entire permi ssion notice in i[...]

143 Info-ZIP Copyright (c) 199 0-2003 Info-ZIP. All right s reserved. For the purposes of this copyri ght and license, "Info-ZIP" is defined as the following s et of individuals: Mark Adler, John Bush, Karl Davis, Harald Denker, Jean-Michel Dubois, Jean-loup Gailly, Hunter Goatley, Ian Gorman, Chris Herborth, Dirk Haase, Greg Hartw ig, Ro[...]

144 A PPENDIX C: T HIRD P ARTY C OPYRIGHT AND L ICENSE A GREEMENTS[...]

G LOSSARY Attachment Control A feature that allows you to block attachments based on their extensio n or MIME type. BCC Blind Carbon Copy. The copy of an em ail is sent to a specified address without the other recipient ’ s knowledge. Certificate A n a t t a c h m e n t t o a message that verifies its origin. Certificate Authority (CA) A centrali[...]

146 G LOSSARY IP Internet Protocol. IP is a layer 3 network protocol that is the standard for sending data throu gh a network. IP is part of the TCP/IP set of protocols that describe the routin g of packets to addresse d devices. IP addres s Internet Protocol address . A unique identifier for a device attached to a network using TCP/IP. The address[...]

147 Quarantine A protected area for storing messa ges that contain viruses or are considered spam. Messages can be deleted from the quarantine or released back into an email inbox. RBL Realtime Blackhole List. A list of serv ers that are considered sources of known spam. RFC Request for Comments. A series of notes on Internet technologies. RFC’ s[...]

148 G LOSSARY TLS Transport La yer Security. A protocol for encrypting and providing data integrity over the Internet. Traceroute A utility used to verify the routing path from o ne network host to another. Trusted Senders List A list of users who can bypass email secu rity controls when mailing local users. Virtual Mapping Redirects email for a sp[...]

A Activity 115 Admin Account 86 lost p assword 127 Administrator Privileges 67, 87 Advanced Anti-Spam Options 69 Annotations Delivery Settings 24 Anti-Spam 47 Header 70 Server status 118 Anti-Virus 32 Server status 118 Archive log 77 Attachment Control 34, 12 3 Attachment Types 34 Authentication log 77 Auto Generate Report 73 B Backup and Restore 1[...]

Distributed Checksum Cl earinghouse (DCC) 49 DNS 89, 10 3 DNS Server status 118 Domain 89 Double Bounce 26 E Email backup 106, 109 Email History 79, 123 Encryption 41, 94 Specific Site Policy 43 Envelope-From 38 Envelope-To 38 ESMTP (Extended SMTP) 25 Examining Log Files 121 F Factory default settings 113, 12 7 Flush Mail Queue 100, 122 Forgotten a[...]

Local Disk backup 107 Local users 86 Login failure 81 Lost admin password 127 M Mail Access 37, 70 Mail Configuration 85 Mail Filtering 37, 70 Mail Mappings 26 Mail Queue Statistics 116 Mail Queues 104, 116 Mail Received Recently 116 Mail Routing 19 Mail Server Status 116 Mail Transport log 77, 121 MAILER-DAEMON 23 Malformed Email 44 Masquerade Ad [...]

BCC Action 60 Preferences 59 priority 58 Ping 102, 122 Q Quarantine 105 Queue ID 79 Queue Sizes 81 R Raw Mail Body 57 RBL (Realtime Blackhole List) 69 Reboot and Shutdown 113 Relay 23 Report Configuration 72 Report Fields 74 Reporting 15, 71 Reporting History Size 82 Reset to Factory Settings 113, 127 Restore from FTP 112 Restore from Local Disk 11[...]

Tokens 57 Training 54 Status 117 Status an d Utility 99 Strip Received Headers 23 Swap usage 81 Syslog 78, 89 System History 80 System Logs 77 T TCP extensions 90 Time Server status 118 Time Zone 84 TLS 41, 42 Token 57 Traceroute 103, 122 Troubleshooting Content Issues 123 Troubleshooting Mail Delivery Probl ems 120 Troubleshooting Mail Queue Probl[...]

3C OM C ORPORATION L IMITED W ARRANTY This warranty applies to customers located in the United States, Australia, Canada (except Quebec), Ireland, New Zealand, UK and other English language countries, and countries for which a translation into the local language is not provided. 3C OM I NTELLI J ACK H ARDWARE 3Com warrants to the end user (“Custo[...]