Avira AntiVir UNIX MailGate 3 years 10 Units 03MAIL_10_24 manual

A vir a AntiVir MailGate | MailGate Suite www.avira.c om User Manual[...]

Avira GmbH Avira AntiVir MailGate 2 Contents 1 About this Manual ............ ........................................................ ........... 3 1.1 Introduction .............................................................................................................. .....3 1.2 The Structure of the Manual ..................................[...]

About this Manual Avira GmbH Avira AntiVir MailGate 3 1A b o u t t h i s M a n u a l In this Chapter you can find an overview of the structure and contents of this manual. After a short introduction, you can read information about the following issues: • The S tructure of the Manual – P age 4 • Signs and Symbols – Page 4 • Abbr eviations [...]

About this Manual Avira GmbH Avira AntiVir MailGate 4 1.2 T he Structure of the Manual The manual of your AntiVir software con sists of a number of Chapters, providing the following information: 1.3 Signs and S ymbols The manual uses the foll owing signs and symbols: Chapter Cont ents 1 About this Manual The structure of the ma nual, signs and symb[...]

About this Manual Avira GmbH Avira AntiVir MailGate 5 For improved legibility and clear marking, the following types of emphasis are also used in the text: 1.4 Abbreviations The manual uses the following abbreviations: Emphasis in text E xplanation Ctrl+Alt Key or key combination /usr/lib/AntiVir/avmailgate Path and file name ls /usr/lib/AntiVir Us[...]

Product Information Avira GmbH Avira AntiVir MailGate 6 2P r o d u c t I n f o r m a t i o n Email file transfer is a natural part of modern communic ation and we can no longer imagine everyday life withou t it. However, emails frequently also transport viruses or unwanted programs. Many of these viruses/unwanted programs were conceived especially [...]

Product Information Avira GmbH Avira AntiVir MailGate 7 2.1 Featur es Avira AntiVir MailGate supp orts a variety of configuration settings to ensure that you have control of the em ail traffic on your system. The essential features of Avira AntiVir MailGate are: • real-time scanning of inco ming and outgoing emails; • scanning for vir uses and [...]

Product Information Avira GmbH Avira AntiVir MailGate 8 2.2 Modules and Op erating M ode of Avir a AntiVir MailGate Avira AntiVir MailGate is an SMTP scanner, which scans al l incoming and outgoing emails, including attachments, on your UNIX mail server for viruses/unwanted programs (see figure below). The program has a high scanning speed and is e[...]

Product Information Avira GmbH Avira AntiVir MailGate 9 Warnings: The postmaster receives an email containing detailed alerts when viruses, unwanted programs or suspicio us files are detected. The al erts can also be sent to the sender and recipient of the email. The program contains alert templates that you can adjust and use. Updater: Avira Updat[...]

Product Information Avira GmbH Avira AntiVir MailGate 10 The license file must have the suffix .key (case insensitive). The new scanner backend (savapi) does not display information about the license file, when called with --version . 2.4 System R equirements For Avira AntiVir MailGate to work p roperly on your server, the following minimum require[...]

Milter Mode Avira GmbH Avira AntiVir MailGate 11 3M i l t e r M o d e 3.1 O ver vie w AntiVir Milter has been a stand-alone product up to now. The product has been available only for Sendmail, using the Sendmail Milter interface. Now, the Milter functionality is integrated in MailGate. In order to start MailGate in Milter mode, the option ListenAdd[...]

Milter Mode Avira GmbH Avira AntiVir MailGate 12 3.2 AntiVir MailGate (Milter Mode) F eatures AntiVir MailGate (Milter mode) is a plug-i n for Sendmail, starting with version 8.11, and communicates through Sendmail’s libmilter interface. It scans all incoming and outgoing emai ls. Infected emails are not forwarded. A status notification is shown [...]

Milter Mode Avira GmbH Avira AntiVir MailGate 13 Directly modify sendmail.cf X Inser t the following two lines in the configuration file sendmail.cf : Xavmilter, S=inet:3333@localhost, F=R, T=S:2m;R:2m;E:10m O InputMailFilters=avmilter Va l u e m e a n i n g z F : determines what should happen if the filter is not available: – T: emails are tempo[...]

Installation Avira GmbH Avira AntiVir MailGate 14 4 Installation You can find the current versio n of AntiVir MailGate on Avir a website . AntiVir is supplied as a packed archive. You can instal l the program on your system using the install script. Requirements You have to be logged in as r oot in order to install Anti Vir MailGate. You also need [...]

Installation Avira GmbH Avira AntiVir MailGate 15 4.1 Preparing the Installation Files Downloading pr ogram files from the Internet X Download the current files from our website http://www .avir a.com to your local computer . T he file name is antiv ir-mailgate-prof-<version>.tar .gz X Copy the file to a director y of your choice on the compu[...]

Installation Avira GmbH Avira AntiVir MailGate 16 4.3 Installation with the Installation Scr ipt "install" The install script performs the in stallation of AntiVir MailGate automatically. It performs the following tasks: z checks the integr ity of the installation files; z checks for the r equired aut horizations for installation; z check[...]

Installation Avira GmbH Avira AntiVir MailGate 17  The AntiVir Engine is being in stalled. Then the script asks for the path to the license file: X Type the path t o the license file and press Ent er – OR – If you want to copy the license file later, just click Enter .  The next step is installing the automatic Internet Updater. Then you [...]

Installation Avira GmbH Avira AntiVir MailGate 18 X Confir m the default path with Ente r or type another one.  The following questions regard the local and relayed hosts: X Ch ange the host name, if necessar y , and pr ess Ent er .  The next question is: X Change the settings if necessar y and pr ess Ent er .  Then you are asked whether a[...]

Installation Avira GmbH Avira AntiVir MailGate 19 X Finally , you can start AntiVir MailGate: /usr/lib/AntiVir/avmailgate start 4.4 Reinstalling and Uninstalling AntiVir You can re-launch the install script at any time. There are several possible situations: • Install a new version (upgrade). The inst allation script ch ecks the previous version [...]

Installation Avira GmbH Avira AntiVir MailGate 20 X Make the changes you need during installation proc edure. AntiVir MailGate is installed with the required settings. Uninstalling AntiVir You can use the uninstall script, located in the temp orary AntiVir directory, to remove Avira AntiVir MailGate. The syntax is: uninstall [--product=productname][...]

Installation Avira GmbH Avira AntiVir MailGate 21 z Proxy mode Content Filter AntiVir MailGate configuration : X Modify (or add) the following entries in avm a i l ga te . co n f : ListenAddress 127.0.0.1 port 10024 ForwardTo SMTP: 127.0.0.1 port 10025 X Restar t AntiVir MailGate. Exim configuration : X Modify (or add) the following entries in exim[...]

Installation Avira GmbH Avira AntiVir MailGate 22 X Restar t AntiVir MailGate. Exim configuration : X Modify (or add) the following entries in exim.conf : daemon_smtp_port = 825 X Restar t E xim. Config uring Qmail There are two ways to integrate AntiVir MailGate with Qmail: z Sendmail wr apper z Backdoor me chanism Replace SMTP with SMTP-Backdoor [...]

Installation Avira GmbH Avira AntiVir MailGate 23 X Change these entr ies as below : # ForwardTo /usr/sbin/sendmail -oem -oi # Or if you want the mail to be sent by SMTP ForwardTo SMTP: localhost port smtp-backdoor If you use inetd with Qmail: X Inser t the following line in inetd.conf (one line!): smtp-backdoor stream tcp nowait qmaild /var/qma il[...]

Installation Avira GmbH Avira AntiVir MailGate 24 X Change these entr ies as below : # Select how mail should be forwarded. # Send mail by piping it thru sendmail (this is the default) # ForwardTo /usr/sbin/sendmail -oem -oi # Or if you want the mail to be sent by SMTP ForwardTo SMTP: localhost port smtp-backdoor # The location of the scanner'[...]

Installation Avira GmbH Avira AntiVir MailGate 25 Listen on port 25 X Loo k i n mast er .cf for : smtp inet n - n - - smtpd X Comment it out: # smtp inet n - n - - smtpd  It prevents Postfix from listening on SMTP port. SMTP daemon can listen on this port. Emails forwarded by the SMTP daemon will be processed by the Sendmail wrapper /usr/lib/sen[...]

Configuration Avira GmbH Avira AntiVir MailGate 26 5 Config uration You can adjust AntiVir MailGate for op timum performance on your system. During installation with the install script, some of the settings are suggested and you can make changes at any time. In this section, you will be guided step by step through the configuration process. It cont[...]

Configuration Avira GmbH Avira AntiVir MailGate 27 5.1 MailGate Spool Directories AntiVir MailGate isolates infected ema ils in "quarantine". Depending on the configuration, a message about the detectio n of a virus/unwanted program is sent to postmaster and/or the sender and/or recipient of the email. These parameters can be set in the f[...]

Configuration Avira GmbH Avira AntiVir MailGate 28 Spool files processing If there is a virus/unwanted p rogram detection, the directory /var/spool/avmailgate/r ejected/ contains: z df- file z vf- file or mf- file These files can be processed by external programs or scripts, such as those set by the ExternalProgram parameter (see MailGate Configura[...]

Configuration Avira GmbH Avira AntiVir MailGate 29 MyHostName Host name : FQDN (Fully Qualified Doma in Name) of the local host. If not set, the default setting is given by gethostname(2) . Otherwise, the default is: MyHostName localhost SpoolDir Spool directory : Emails are kept in the sub-directories incoming , re j e cte d and outgoing while bei[...]

Configuration Avira GmbH Avira AntiVir MailGate 30 PidDir PID directory : This directory saves the PID files for MailGate’s main processes. You must stop AntiVir MailGate before changing this parameter. PidDir /var/tmp Syslog Fac il i t y Syslog facility: It sets the log category that Syslo g should apply for MailGate messages. SyslogFacility mai[...]

Configuration Avira GmbH Avira AntiVir MailGate 31 MaxMessage Size Maximum message size (not in milter mode): A value greater than 0 means that only em ails up to the given size are scanned. Larger emails are rejected. If the value is 0, all messages of any size are scanned. e.g.: 4KB, 3MB, 2GB. MaxMessageSize 0 MinFree Blocks Minimum free system s[...]

Configuration Avira GmbH Avira AntiVir MailGate 32 hostA,@hostB:user@hostC If source r outing is allowed, the email is sent to hostA , other wise to hostC. InEnvelopeAddressesBangIs REFUSED InEnvelope Addresses Pe r c e n t I s Percent sign in envelope address (not in milter mode): If REFUSED is set and a '%' sign is in the recipient&apos[...]

Configuration Avira GmbH Avira AntiVir MailGate 33 According to the result, the procedures are: z if there is no mat ch in the fi rst list, the nex t list is checked. z if there is no mat ch in the second list either , th e email is scanned. z if there is a mat ch in the igno re list, the email is not scanned. z if there is a mat ch in the sc an li[...]

Configuration Avira GmbH Avira AntiVir MailGate 34 command (not in milter mode). SMTPHeloTimeout 300 SMTP MailFrom Tim eout Defines the maximum timeout, in seconds, for receiving a reply to the MAIL FROM command (not in milter mode). SMTPMailFromTimeout 300 SMTP Rcpt Tim eout Defines the maximum timeout, in seconds, for receiving a reply to the RCP[...]

Configuration Avira GmbH Avira AntiVir MailGate 35 requests. ScannerListenAddress /var/run/avmailgate/scanne r Max Attachments Maximum number of em ail attachments (MIME) : Defines the maximum number of atta chments for a single MIME email. MaxAttachments 100 Bloc k Suspicious Mime Blocking suspicious emails (MIME) : Blocks suspicious MIME emails. [...]

Configuration Avira GmbH Avira AntiVir MailGate 36 Expose SenderAlerts Sending alerts to sen ders of concerning emails : You can send alerts about viruses and unwanted programs to senders. The available values are: • NO : the sender will receive no virus aler t . • LOC AL : aler t messa ges are sent only if th e sender is local user in your dom[...]

Configuration Avira GmbH Avira AntiVir MailGate 37 If the setting is YES, non-MIME em ails are transformed into MIME emails. ForwardAllEmailAsMIME NO ScanInAr chiv e Scan in archives : If the setting is NO, the ar chives are not scanned for viruses/unwanted programs. If the setting is YES, all files in archives are unpacked and scanned, depending o[...]

Configuration Avira GmbH Avira AntiVir MailGate 38 Bloc k Encr ypted Archive Blocking emails with pa ssword-protected archives : If the setting is YES , emails containing password-prot ected files in archives are rejected. If NO is set, emails containing encryp ted archives are also delivered. BlockEncryptedArchive NO Detect... Detection of other t[...]

Configuration Avira GmbH Avira AntiVir MailGate 39 Quarantine Ale rt Sending alert emails to quarantine: (Available only in Milter mode) If QuarantineAlert is YES and RejectAlertMail is YES , an email containing an al ert will be rejected and the email will be quarantined. If QuarantineAlert is NO and RejectAlertMail is YES , the email will be reje[...]

Configuration Avira GmbH Avira AntiVir MailGate 40 Boun ce MessageUser Recipient for email failure (not in milter mode): This is the user that receives email failure reports when an email cannot be sent by MTA. BounceMessageUser MAILER-DAEMON Boun ce Messa ge SizeBody Size of the email failure - mail body (not in milter mode): Sets the size in byte[...]

Configuration Avira GmbH Avira AntiVir MailGate 41 Not if y En d OfLi c en se Information on license expiry date : Sends a message to postmaster, 30 days bef ore license expiration date. The 0 value means no alert. NotifyEndOfLicense 30 Add Precedence Hea de r Adding precedence header : If the setting is YES, the following line is added in the head[...]

Configuration Avira GmbH Avira AntiVir MailGate 42 Options and parameters for spam filter Enable SpamCheck Activates/deactivates spam filter. EnableSpamCheck NO SpamAction Defines an action for spam mails: BLOCK, TAG, NONE. • T AG inser ts a header line into the email. F or example: X-AntiVir us - Spam- C heck: clean (checked by Avir a MailGate: [...]

Configuration Avira GmbH Avira AntiVir MailGate 43 this file can be used as a blac k and white list for the spam filter. Each list consists of an address, given as regular expression. E.g.: /^someone@somewhere.tld$/i blacklist The above example treats emails from someone@somewhere.tld as spam, independently of the spam check result. " blackli[...]

Configuration Avira GmbH Avira AntiVir MailGate 44 Another example : • in /etc/a vmailgate.c onf: DangerousAttachmentAction TAG DangerousIFrameAction TAG • in /etc/asmailgate.ex cept: /^me@here.tld$/i r !tag_dangerous_attachment !tag_dangerous_iframe Don't tag DangerousAttachment and DangerousIFrame mails. SpamFilter DetectGTUBE The GTUBE[...]

Configuration Avira GmbH Avira AntiVir MailGate 45 SpamFilter Modif yS ubj ect Inserts the spam check result into the "Subject:" header line: Subject: [spamcheck : spam] this is the or igin al subject tex t This is the default message.It can be overridden using a template: " spamfilter- subjects ". This template allows you to sp[...]

Configuration Avira GmbH Avira AntiVir MailGate 46 5.4 Scanner Conf iguration in avmailga te-s canner .conf A new configuration file has been introd uced, starting with MailGate v 3.0.0: avm a i lg a te - s c a n ne r. co nf . It contains config uration options specific to the new scanner backend. Usually, you don't have to change the options [...]

Configuration Avira GmbH Avira AntiVir MailGate 47 UseSavapiProxy 0 P oolScanners The number of AntiVir scanners set in the pool. Default: PoolScanners 24 Po o l Connections The maximum number of simultaneous co nnections MailGate allows to the scanner pool. Default: PoolConnections 128 Syslog Fac il i t y It sets the log category that Syslog shoul[...]

Configuration Avira GmbH Avira AntiVir MailGate 48 X Set which hosts and networks ma y send emails. For example: relay: 127.0.0.1/8 192.168.0.0/16 IP addresses You can specify IP addresses in various ways: 192.168.0.0/16 or 192.168 Both have the same meaning. /16 means 16 bit and signifies the first two numbers of the IP address. Therefore, all IP [...]

Configuration Avira GmbH Avira AntiVir MailGate 49 X Copy the example templates in the requ ir ed language from the templates direct or y /usr/lib/AntiV ir/templates/examples/<langua ge>/ in the direct or y /usr/lib/AntiVir/templates . X Change the director y to /usr/lib/A ntiVir/templates . T his director y contains the following files: path[...]

Configuration Avira GmbH Avira AntiVir MailGate 50 Exam ple f o r aler t-sender SUBJECT: AntiVir ALARM [Your email: "SUBJECT"] **********************AntiVir ALARM************ ******* AntiVir has discovered the following in the email sent from your address: ALERTS This email has not been sent, but isolated on y our server. Please scan your[...]

Configuration Avira GmbH Avira AntiVir MailGate 51 5.8 Upd ater Configura tion in av update.conf Updates ensure that AntiVir MailGate co mponents (MailGate, scanner, VDF and engine), which provide security against viruses or unwanted programs, are always kept up to date. With Avira Updater you can update Av ira software on your computers, using Avi[...]

Configuration Avira GmbH Avira AntiVir MailGate 52 • 1 - email notifications are sent in case of "successful update", "unsuc cessful up date ", or " up to d ate". • 2 - email notification only in case of "unsucc essful update". • 3 - email notification only in ca se of "succe ssful update" (de[...]

Operation Avira GmbH Avira AntiVir MailGate 53 6O p e r a t i o n After concluding installa tion and configuration and when AntiVir MailGate is running, MailGate guarantees continuous monitoring of your system. During operation you might have to make occasion al changes in settings, as described in Configuration – Page 26. In some cases, it may b[...]

Operation Avira GmbH Avira AntiVir MailGate 54 Star ting AntiVir MailGate X Type: /usr/lib/AntiVir/avmailgate start  The program starts with the following message: Stopping AntiVir MailGat e X Type: /usr/lib/AntiVir/avmailgate stop  The program stops with the following message: Restar ting AntiVir MailGate This is used, for example, after mak[...]

Operation Avira GmbH Avira AntiVir MailGate 55 6.2 P arameters f or SMTP and Scanner Daemon The following tables describe the possible command line parameters that overrule avm a i lg a te . co n f settings. Syntax: avmailgate.bin [-V|--version] [-i] [-C config -file] [-D debug-level] [--stop] [--status] [--avq] P arameters for a vmailgate.bin The [...]

Operation Avira GmbH Avira AntiVir MailGate 56 6.3 Queue Mana ger avq The Queue Manager avq is integrated in av m ai l g at e. b i n . The Queue Manager enables manipulation of the AntiVir MailGate spool directory /var/spool/avmailgate/ and its sub-directories. Here you can see and modify the status of the pe nding emails (see MailGate Spool Direct[...]

Operation Avira GmbH Avira AntiVir MailGate 57 You can control the outcome with the following parameters after --avq (the Help provides more parameters, which you can call with --avq --help ). Deleting emails fr om que ue Deleting emails from the queu e is important in the event of infected emails. Forwarded emails are automatically deleted from th[...]

Operation Avira GmbH Avira AntiVir MailGate 58 X Type the command (wher e <ID> is t he ID of the infected email): /usr/lib/AntiVir/avmailgate.bin --avq --remove= <ID>  The email is deleted from the queue. For cing email for war ding This procedure may forward po tentially dangerous viruses. X Always check which email is going to be f[...]

Operation Avira GmbH Avira AntiVir MailGate 59 6. 4 Pro ce d u res w he n De t e ct i n g V i r us e s / Unw a nte d P ro g ra m s If configured correctly, AntiVir MailGate has already automatically carried out all important antivirus ta sks on your system: z Infected emails ar e not f orwarded. z Infected emails ar e moved to /var/spool/a vmailgat[...]

Updates Avira GmbH Avira AntiVir MailGate 60 7U p d a t e s With Avira Updater you can update Av ira software on your computers, using Avira update servers. The program can be configured eit her by editing the configuration file (see 5.8 Updater Configurati on in avupdate.conf ), or by using parameters in the command line. It is recommended to run [...]

Updates Avira GmbH Avira AntiVir MailGate 61 As [product] , you can use: • Scanner - (rec ommended) to update the scanner , eng ine and vdf files. • MailGate - complete update (MailGate, scanner , eng ine and vdf files). X Star t the upd ate pr ocess to test the settings : /usr/lib/AntiVir/avupdate --product=[product] where [product] takes the [...]

Service Avira GmbH Avira AntiVir MailGate 62 8S e r v i c e 8.1 Suppor t Support Ser v ice Our website http://www .a vira.com contains all the necessary information on our extensive support service. The expertise and experience of our developers is available to you. The experts from Avira answer your questions and help you with difficult technical [...]

Service Avira GmbH Avira AntiVir MailGate 63 8.3 Contact Address Avira GmbH Lindauer Strasse 21 D-88069 Tettnang Germany Interne t You can find further information on us and our products by visiting http://www .avira.com .[...]

Appendix Avira GmbH Avira AntiVir MailGate 64 9 A ppendix 9.1 Glossar y Te r m M e a n i n g cron (daemon) A daemon which starts other programs at specified times. Daemon A background process for admi nistration on UNIX systems. On average, there are about a dozen daemons running on a computer. These processes usually start up and shut down with th[...]

Appendix Avira GmbH Avira AntiVir MailGate 65 9.2 Fur ther Information You can find further information on vi ruses, worms, macro viruses and other unwanted programs at http://www .a vira.com . syslog daemon A daemon used by programs for logging various information. These reports are written in different logfiles. The syslog daemon configuration is[...]

Appendix Avira GmbH Avira AntiVir MailGate 66 9.3 Golden Rules for Pr otection Against Vir uses X Always keep boot f loppy disks for your network ser ver and for your workstations. X Always remove f loppy disk s from the drive after finishing work. Even if they have no ex ecutable pr ograms, disks can contain program code in the boot sector and the[...]

A vir a AntiVir MailGate | A vira AntiVir MailGate Suite www.avira.c om © Avira GmbH. All rights r eserved. This manual was cr eated with gr eat car e. However , err ors in design and contents cannot be ex clu- ded. The r eproduction of this publication or parts ther eof in any form is pr ohibited without pr evious written consent fr om Avir a Gmb[...]