Surf Control 5.2.4 manual

™ SurfContro l Risk Filter - E-mail Administrator's Guide V ersio n 5. 2 .4[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide i C ONTENTS Notices ............. ................ ............. ................. ............ ................. ............. ................ ...................... .... i F INDING YOUR WAY AROUN D .............. ................. .................. .............. ............. ....[...]

ii Administrator’s Guide SurfControl RiskFil ter - E-mail V5.2. 4 Help .............. ............. ................ ............. ................ ............. ................ ............. ....................... .......... 61 Admin Guide ...... ................. ................ ............. ................ ................ ............. .[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide iii Querying the Message Report .. ................ ................ ................. ................ ................ .......... 110 Policy Report ............. ............. ................ ............. ................ ............. ................ ............. . .............[...]

iv Administrator’s Guide SurfControl RiskFil ter - E-mail V5.2. 4 Update RiskFilter - E-mail ................ ................ ............. ................ ................ ................ ....... 154 Key Points ........................... ............. ................ ............. ................ ............. ................ ... ........[...]

Chapter 1 Finding your way around How RiskFilter works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . page 2 Load balancing with RiskFilter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . page 4 Launching SurfControl RiskFilter . . . . . . . . . . . . . . . . .[...]

2 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 F INDING YOUR WAY AROUND How RiskFilter works 1 H OW R ISK F ILTER WORKS Figure 1- 1shows how a message is processed by RiskFilter: Figure 1- 1 The RiskFilter filtering process M ANAGING YOUR MESSAGES WITH R ISK F ILTER RiskFilter gives you access to several tools w ith which you ca [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 3 F INDING YOUR WAY AROUND How RiskFilter works 1 Connection Control Limit the number of simultaneous connections made on your server . Determine whether to perform real-time blacklist checking. See Receive Setti ngs > Connection Co ntrol in the System Settings chapter . Dictionary [...]

4 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 F INDING YOUR WAY AROUND Load balancing with RiskFilter 1 L OAD BALANCING WITH R ISK F ILTER Y ou can deploy RiskFilter in a cluster and load-b alance using MX records: 1 On the DNS server hosting your do main, create an MX record for each primary RiskFilter ser ver using the same M [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 5 F INDING YOUR WAY AROUND Load balancing with RiskFilter 1 A lower MX preference number gives higher prio rity than a lower one. In Figure 1-2, e-mail is sent in the following way: • E-mail sent to site A.com round-r obins between mail exchangers 1, 2,and 3, because each RiskFilter [...]

6 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 F INDING YOUR WAY AROUND Launching Sur fControl Ris kFilter 1 L AUNCHING S URF C ONTROL R ISK F ILTER SurfControl RiskFilter cons ists of two interfaces: • RiskFilter System Management Co nsole • RiskFilter Management Console (Admin istrator) There is also a third interface avail[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 7 F INDING YOUR WAY AROUND Launching SurfContr ol RiskFilter 1 R ISK F ILTER M ANAGEMENT C ONSOLE (A DMINISTRATOR ) The SurfControl RiskFilter Management Console is where you manage the RiskFilter sof tware. Y ou can use this interface to: • Manage user account s and licensing. • S[...]

8 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 F INDING YOUR WAY AROUND Before you start 1 B EFORE YOU START This Administrator ’s guide assumes th at you have completed the following step s: 1 Mounted the appliance using the supplied hardware set up guide. 2 Gathered the network information that is required for the con figurat[...]

Chapter 2 System Settings The System Settings tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .p a g e 1 0 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . page 11 Receive Settings . . . . . . . . . [...]

10 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS The System Settings tab 2 T HE S YSTEM S ETTINGS TAB This chapter expla ins how to us e the Syst em Settings tab to: • Configure the tran sport of e-mails. • Authenticate the se nders and recipi ents of e-mails. T ERMINOLOGY USED The following terminology is us[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 11 S YSTEM S ETTINGS General 2 G ENERAL The General menu con tains sub-men us that enable you to set up the delivering and rece iving of e-mails. This includes specifying ho w RiskF ilter should treat connection s fr om other administr ators, and where to send alert messages and notifi[...]

12 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS General 2 T able 1 Other Settings Setting What it does SMTP greeting message The greeting mess age can indicate that the system is working correctly when you first start to set up the RiskFilter applianc e using Hyper T erminal. An example of where this message app[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 13 S YSTEM S ETTINGS General 2 U SER D IRECTORIES User Directories provide RiskFilter with recipient address validati on and en d-user authenticatio n: • Address validation t akes place when a message is received. • User authentication is used by end-users to log in and check their[...]

14 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS General 2 2 This will show a screen containing all of the details of the User Directory th at you want to edit. The following example shows a Generic LDAP User Directory: Figure 2 - 5 Generic LDAP Server Information 3 Make changes to the User Dire ctory by editing [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 15 S YSTEM S ETTINGS General 2 Microsoft Active Directory This is the defa ult server type. Microsof t Active Directory supports Address Gro up Import, User Authentication, User Aliases and Recipien t V alidation. T o add a Microsoft Active Directory server: 1 Click Add in the User Dir[...]

16 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS General 2 – Enable Partial Address C aching – This is the default setting. Enter a value into the Maximum Cache Entry field to specify how many entries shoul d be stored in the m emory cach e. The default is 10000. – Disable Address Caching - No addresses wil[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 17 S YSTEM S ETTINGS General 2 Generic LDAP Generic LDAP supports Address Group Import, User Authentication, User Aliases and Recipient V alidation. T o add an Generic LDAP server: 1 Click Add in the User Directories screen. 2S e l e c t Generic LDAP . 3 Click Next . The Generic LDAP s[...]

18 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS General 2 Validation settings V ariables which can be used for validation. These can be set when you are adding your LDAP server . Search Filter . There are three variab les which can be used in the Search filter for valida tion: • %user% = the user name of the u[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 19 S YSTEM S ETTINGS General 2 • Cache Setting – Select the option that corresponds to ho w you want to treat Address Caching : – Enable Partial Address Caching – This is the de fault setting. Enter a value in to the Maxim um Cache Entry field to specify how many entries sho ul[...]

20 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS General 2 T o add a local database: 1 Click Add in the User Directories screen. 2S e l e c t Local Database . 3 Click Next . The Local Database Inform ation screen is displayed: Figure 2 - 8 Local Database Information 4 Enter the following information: • Director[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 21 S YSTEM S ETTINGS General 2 Adding addresses to a local dat abase. Y ou can add specific addresses from a user list by adding them manually . This can also be used if you have created your user directory before you created your user list and now want to add this list to the user dir[...]

22 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS General 2 7T h e Local Database - Add/Ed it Address screen is displayed. Figure 2 - 11 Adding an address to the database 8 Enter the address that you want to add into the Address field. 9 If the database you are adding has a password then you need to enter this pas[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 23 S YSTEM S ETTINGS General 2 2 In the Total Simultaneous Connections field, en ter the maximum nu mb er of connections that you want to be connected at any one time. The default settin g is 200 . 3S e l e c t Enable POP3 Proxy . 4 Enter the following information: • Incoming POP3 Po[...]

24 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS General 2 L OGS AND A RCHIVES SurfControl RiskFilter stores messa ges that have been isol ated. Initially these me ssages will be stored in the default directory . If you want RiskF ilter to sto r e messages in a dif ferent place, you must change the default direct[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 25 S YSTEM S ETTINGS General 2 • Archive level – Define whether or n ot to archive files and what type of messages to archive if archiving takes place: –S e l e c t None for no archiving. –S e l e c t All messages except then select the releva nt check bo xes if you want to ar [...]

26 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS General 2 Importing Certificates A default certificate is supplied with RiskFilter but th is will need to be renewed when it expires. The Import Certificate feature enables yo u add a new version to Ri skFilter . Y ou can also import a certificate that you have pre[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 27 S YSTEM S ETTINGS Receive Settings 2 R ECEIVE S ETTINGS The Receive Settings menu cont ains all the sub-men u s that are concerned with how mail is accepted before it is filtered . These settings specify how the ma il should be treated when it is delive red to RiskFilter for process[...]

28 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS Receive Settings 2 RBL Real-T ime Blacklis t (RBL) checking verifies the valid ity of messa ge senders. If a send er is listed on an RBL, they will be prevented from sendi ng messages to your internal MT A. Reverse DNS enables you to make sure that e-mails sent to [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 29 S YSTEM S ETTINGS Receive Settings 2 D IRECTORY A TTACK C ONTROL Directory Att ack is used by questionable sour ces to gain access to internal e-mail ac counts. A directory attack no t only occupies large amount s of system resource but also, through the acquisition of e-ma il accou[...]

30 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS Receive Settings 2 R ELAY C ONTROL RiskFilter enables you to stop your e-mail system from being used as an ope n relay by spammers. Relay control limits the server to only re laying e-mails for specific domains. Use the Relay Co ntrol sc reen to control relaying to[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 31 S YSTEM S ETTINGS Receive Settings 2 • Reject mail from senders w hen SPF so ftfails – When SPF checking finds that the senders domain does not match the publishe d SPF polic y and ends with a SoftFail, reject the mail. • Reject mail from senders wh en there is an SPF error ?[...]

32 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS Receive Settings 2 T o import a list: 1 In the Relay Control screen, click Import . 2 In the dialog that follows, enter the path to the file or click Browse to navigate to it. 3 Click OK . Exporting a list of domains. Y ou can create a list of domains which can be [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 33 S YSTEM S ETTINGS Receive Settings 2 R ECIPIENT V ALIDATION The Recipient E-mail Address V alidation screen enables you to improve the performance of the RiskFilter gateway system. Receivers’ a ddresses are validated by user directorie s in order to prevent directory attack before[...]

34 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS Receive Settings 2 M ESSAGE C ONTROL Y ou can limit the message size, data size per con nection, number of messages per connection, and the number of recipients per m essage. Us e the Mess age Contro l screen t o do this: Figure 2 - 19 The Message Control screen[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 35 S YSTEM S ETTINGS Receive Settings 2 T o configure message control: 1S e l e c t Receive Settings > Message Control fr om the System Settings ta b. 2S e l e c t Limit message size and enter a maximum messa ge size into the correspo nding Maximum size (KB) field. This can prevent [...]

36 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS Receive Settings 2 T o configure exception control: 1S e l e c t Receive Settings > Exception Control from the Syst em Settings tab. 2 Choose a filter action from the When messages fail to be processed drop-down list box: • Deliver message – Deliver th e mes[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 37 S YSTEM S ETTINGS Receive Settings 2 7 Enter the subject that you want to be d isplayed when the no tification is received, into the Subject field. For example: ‘Caution: Invalid e-mail message forma t’. 8 Enter the message that you want to be displayed in the Not ification body[...]

38 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS Receive Settings 2 Importing and exporting Lists If you already have a list of IP addresses that yo u want to block you can import this list to your blacklist. Conversely once you have this list in your blacklist List (perhaps because you have been ad ding them dyn[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 39 S YSTEM S ETTINGS Receive Settings 2 W HITE L IST Messages will bypass Anti-S pam checking if they come from addresses or domains , which are listed in the White List. Use the White List scre en to configure your White List. : Figure 2 - 23 The White List screen Adding an IP or subn[...]

40 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS Receive Settings 2 above the section will change to matc h the amount of IP s t hat you have added, and you will see text stating that the up date was successf ul. 4 If you want t o import or ex port a list c lick Import or Export . This will show an Explorer dialo[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 41 S YSTEM S ETTINGS Send Settings 2 S END S ETTINGS The Send Settings menu provides sub-menus that enable you to specify how messages will be delivered when they are sent on to the user via RiskFilter E-m ail. D OMAIN -B ASED D ELIVERY Domain-Base d Delivery enab les you to c onfigure[...]

42 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS Send Settings 2 Using TLS authentication (Transport Layer Security) If a message is sent via TLS then RiskFilter will be able to receive it, if ST ARTTLS Advertisement is enabled. However , if your mail serv er will only ac cept messages that are sent using TLS , t[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 43 S YSTEM S ETTINGS Send Settings 2 T RAFFIC C ONTROL After completing the security verifica tion for mail, RiskFilter will forward it to the e-mail server according to the route config uration. T o protect e-mail syst ems from the impact of heavy traffic, T raffic Contro l is designe[...]

44 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS Send Settings 2 2 Enter a time in minutes into the Retry interval’ field . This specifies how long the server sh ould wait before attempting to deliver the message again. 3 Enter a time in minutes into the Maximum retry period field. Once this period of time is r[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 45 S YSTEM S ETTINGS User Management 2 U SER M ANAGEMENT Once you have completed th e initial configuration of Sur fControl RiskFilter there are othe r settings to implement that are vit a lly importan t to enable the pr od uct to work at it s best. SurfControl recommends that you enha[...]

46 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS User Manageme nt 2 Changing the Administrator Account Password SurfControl recomm ends that you change the supplied defa ult passwords as soo n as possible to enh ance the security of the SurfControl RiskFilter appliance. The RiskFilter E-mail C onsole adm inistrat[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 47 S YSTEM S ETTINGS User Management 2 For each of the users you elect to ca rry out some of the administrative tasks within RiskFilter you need to: • Create an account for ea ch user (administrator). • Add their appliance IP addr ess as an authorized user . Once you have created a[...]

48 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS User Manageme nt 2 4 Select Configuration from the General menu. 5 In the Trusted IP(s) field enter the IP addresses of all of the administr ator ’s machines that you want to be able to access the RiskFilter appliance. If you en ter more than one, then each IP ad[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 49 S YSTEM S ETTINGS User Management 2 The PEM screen is composed of th ree sections: • Digest Notification Sch edule – Set the time that a message will be se nt to a user to inform them that they have spam me ssages waiting to be actioned. • Digest Message Templat e – Set up t[...]

50 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS User Manageme nt 2 • Description – This lists the prod uct that is filteri ng spam messag es. Y ou can change the default title by entering your own details here. • Sender – The default setting is postma ster@$(domain). Y ou can change this to some thing th[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 51 S YSTEM S ETTINGS User Management 2 Adding users Y ou can add users or lists of users to PEM. T o add users: 1 Enter the user details of any u ser that you want to add to the Recipient s List into the Enter recipient address: fiel d. 2 Click Add . This will add them to the righ t-ha[...]

52 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS User Manageme nt 2 E ND - USER C ONTROL Authorized users can log in to PEM with their own ac count and p assword, validated by a ‘User V alidation’ connection and, depending on th e settings in the Us ers List p ane, can manage their own Black and White lists. [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 53 S YSTEM S ETTINGS User Management 2 5 Click Add . The item will be added to the list on the right. If you want to delete a domain or e-mail address in the group, select the relevant addr ess from the list and click Remove . 6 Click Submit to put the new settings into effect or Reset[...]

54 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS User Manageme nt 2 6 Choose the server that will provid e the authentication for this user from the ‘Server ’ drop-down list. 7 Click Add>> . This will add it to the list pane on the right. T o remove a server , select it and click <<Remove . 8 Clic[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 55 S YSTEM S ETTINGS License & Update s 2 L ICENSE & U PDATES T o ensure that RiskFilter is filtering at its optimum level you must upda te it regularly . This can either be a manual update which updates the prod uct (and it’ s componen ts) imme diat ely , or you can specify [...]

56 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS License & Up dates 2 Updating your Anti-S pam Agent Definitions T o update your Anti-S pam Agent definitions: 1S e l e c t License & Updates > Update Now from the System Settings tab. 2 Click the Anti-Spa m Agent Definiti ons link to expand the list. Th [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 57 S YSTEM S ETTINGS License & Update s 2 S CHEDULED U PDATE It is important to schedule update s to the Anti-S pam and Anti-V irus agent s so that you can be sure of the maximum protection. The Anti-S pam database is update d three times a day so the level of protection you are re[...]

58 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS License & Up dates 2 Updating the Anti-Spam Agent T o update the Anti-S pam Agent: 1 Select the Anti-Spa m Agent Update check box. 2 S pecify how often the update is to occur by choosing an interval from the Repeat Interval list box. By default this is set to E[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 59 S YSTEM S ETTINGS License & Update s 2 Viewing component licenses T o view your component licenses: 1S e l e c t License & Updates > License Status from the System Settings tab. 2T h e License Status screen is displayed. Y ou will see a list of licens es that are re giste[...]

60 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS License & Up dates 2 L ICENSE S ERVER If you need to view the details of your licens e update server or specify an alternative one then yo u can do this in the License Server Co nfiguration screen. Figure 2 - 39 The License Server Configuration screen The reaso[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 61 S YSTEM S ETTINGS Help 2 H ELP The Help menu gives you access to tools that can he lp you solve problems with RiskFilter E-mail. A DMIN G UIDE A direct link to this guide. Selecti ng this menu will launch this RiskFilter Administrator ’s Guid e in pdf format. C ONTACT S UPPORT Y o[...]

62 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS Help 2 7 Select the relevant check boxes from the At tach list to send configurat ion files to Support: • Surfcontrol RiskFilte r configuration – This gives a sum mary of the RiskFilter sof tware configuration and includes: – RiskFilter E-Mail V ersion – Cl[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 63 S YSTEM S ETTINGS Key Points 2 K EY P OINTS The following list is a summary of the main points covere d in Chapter 2. Use this lis t as a quick reminder of what you ca n do within the System Settin gs tab: Q RiskFilter can notify the administ rator by sending a message to a prede fi[...]

64 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 S YSTEM S ETTINGS Key Points 2 Q Y ou can block either a single IP or a block of IPs by using the Subnet Mask. Q If you already ha ve a list of IP addresses that yo u want to block, you can import this list to your blacklist. Q A Dynamic White List can be auto-ge nerated based on th[...]

Chapter 3 Policy Manager The Policy Manager tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .p a g e 6 6 Creating a Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . page 67 Address Group. . . . . . . . . . . . . [...]

66 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER The Policy Manage r tab 3 T HE P OLICY M ANAGER TAB This chapter explains h ow to use th e Policy Man ager tab to configure anything to do with the manage ment of e-mail messages that pass through RiskFilter . By controlling who has po licies applied to them and wha[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 67 P OLICY M ANAGER Creating a Pol icy 3 C REATING A P OLICY There are three ste ps to creating a policy: Step 1 - Defining users – Add the users, and grou ps of users, that you want to filter . Ste p 2 - De fining ac tions – De fine what shou ld be done wi th a message that trigge[...]

68 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Creating a Policy 3 • Save to Isolate Message – Send the messag e to the isolated message store for further pro cessing. • Save to Spam Message : – Send the message stoppe d by an An ti-S pam filter to the S pam Message store for further processing. • Save[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 69 P OLICY M ANAGER Address Group 3 A DDRESS G ROUP Y ou can add one or more address grou p(s) to the address group list, and each addr ess group can include a group of e-mail address list s. Addresses are added using the Address Group screen . Figure 3 - 4 The Address Group screen I M[...]

70 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Address Group 3 • Enter *@ followe d by the do main to have a ll users in that domain included in the list e.g.*@my domain.co m • Enter *@* to have all users included in the list regardless of their domain e.g.*@*.com 6 Click Add , the item will be added to the [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 71 P OLICY M ANAGER Queue Manage r 3 Q UEUE M ANAGER When a message triggers a filter it can be sent to a queue , where it can be stored until you are ready to deal with it. Queue Manager enables you to manage the three supp lied queues as well as any queue that you create. Th e defaul[...]

72 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Queue Manager 3 T o add a Queue: 1S e l e c t Queue Manager from the Po licy Manager tab. 2 Click Add in the Queue Manager screen. 3 Enter a name for the Queue into the Queue Name field. 4 Enter a description of the Queue into the Description field. 5S e l e c t Ena[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 73 P OLICY M ANAGER Dictionary Ma nager 3 D ICTIONARY M ANAGER Y ou can use the supplied SurfControl dictiona ries or create your own using the Dictionary Ma nager . These then be us ed for the following: • Setting a threshold for a word wi thin the Dictionary Th reshold Filter for t[...]

74 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Dictionary Manag er 3 Changing the value of words in the SurfContro l Dictionaries Y ou can change the value of a word or phrase to fine-tune your filtering. Y ou may want to do this for the following reasons: • Y ou find that messages containing a cert ain word a[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 75 P OLICY M ANAGER Dictionary Ma nager 3 T o remove a word or phrase: 1S e l e c t Dictionary Manager > SurfControl Dictionar ies from the Policy Manager tab. 2 Click the title of the dictionary that you are interested in. 3 Select the check box alongside the word or ph rase that y[...]

76 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Dictionary Manag er 3 7 Click Add . 8 Enter the word or phrase you want to add into the Word or Phrase field. 9 Enter a phrase value into the Phrase Value field. Figure 3 - 11 Add a Word or Phrase or Phrase V alue 10 Repeat steps 8 and 9 till you have added all of t[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 77 P OLICY M ANAGER Dictionary Ma nager 3 By default, the appliance installs the English la nguage dictionaries bu t you can add other languag e dictionaries using the Import-Export utility . Use the Import Dictionaries screen to import dictionaries. Figure 3 - 12 The Import Dictionari[...]

78 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Dictionary Manag er 3 Importing a unic ode text file T o import a text file: 1S e l e c t Dictionary Manager > Custom Dictiona ries from the Policy Manage r tab. 2 Click Import . 3 Enter the path to the dictionary file you want to import into the Select f ile fie[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 79 P OLICY M ANAGER Global Policy 3 G LOBAL P OLICY RiskFilter provides a global filtering Po licy Manager . With this you can de fine filters, and the actions to be taken when these filter s are triggered. Po licy and filt er configuration is carried out in the Policy Manage r tab . F[...]

80 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 T o create a sub-policy: 1S e l e c t Global Policy from the Policy Manager tab. 2 Click Add . The Sub-policy Management screen is displayed. Figure 3 - 15 Enter the details of the new Sub-policy 3 Enter a name for your Sub-policy into the Sub-policy[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 81 P OLICY M ANAGER Global Policy 3 • S pecify single sender address to all users of SurfControl.com domain: si mo n@SurfControl.com to *@SurfControl.com • S pecify single sender address to all recipient s: simon@SurfControl.com to * (* indicates any e-mail address). 9 Select which[...]

82 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 • Message Attachme nt Filter – Enable s you to scan for m aximum me ssage size or sp ecify the types of attachment s that you want to filter . These include ty pes of attachment, such as *.gif, *.mp 3 files, and executable files, such as *.ex e a[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 83 P OLICY M ANAGER Global Policy 3 Creating a new filter T o create a new filter: 1 In the Global Policy Filter List screen click Add . The Create New Filter screen is displa yed. 2 Select the type of filter that you want to create. Details of the dif ferent types of filter available [...]

84 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 • Treat encryp ted files as in fected – If a message is encrypted in a way that th e anti-virus engine does not understand, it w ill be assumed to be infected and trea ted as such. The de fault setting is on . • Treat macros as inf ected – If[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 85 P OLICY M ANAGER Global Policy 3 T HE A NTI -S PAM A GENT F ILTERS The Anti-S pam filters check messages to see if they are likely to be spam. • Anti-Spam Agent - DFP – Compares mail messag es to known spam from different cate gories. • Anti-Spam Agent - Heurist ics – Uses r[...]

86 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 Configuring the Anti-Spam Agent - Heuristics Filter The Anti-S pam Agent - Heuristics filter is conf igured in the Anti- S pam Agent Heuristics screen. Figure 3 - 21 The Anti-S pam - Heuristics screen T o cofigure the Anti-S pam Agent - Heuristics fi[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 87 P OLICY M ANAGER Global Policy 3 • High – Any message that could be spam will be stopped. Althou gh this offers the most comprehensive protection , more messages will be stop ped that are not spam. • Highest – Virtually all sp am will be stopped but there coul d be quite a f[...]

88 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 5 Click Next . 6 Enter a name in to the Filter Name field. 7 This filter is enabled by default. Select the disable option if you want to switch it off. 8 If you want to make the filter so th at it can be overwrit ten by a sub-policy change the Filter[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 89 P OLICY M ANAGER Global Policy 3 Editing the Internet Threat Database Filter Y ou can fine-tune either (or bo th) of the Inte rnet Threat Database filte r to your company’ s filtering requirement s. T o edit the Internet Threat Database filter: 1S e l e c t Global Policy from the [...]

90 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 For example, if yo u have added two sub-policies, In coming and Outgoing, you could crea te disclaimers for each of them: • Global Policy – ‘Innovation makes your life be tter ’ • Incoming – ‘All messages have been scanned by RiskFilter[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 91 P OLICY M ANAGER Global Policy 3 G ENERAL C ONTENT F ILTER The General Content Filter enable s you to filter a ll incoming and outgo ing messages p assing th rough the RiskFilter . Figure 3 - 25 General Content Filter screen Editing the General Content Filter Y ou can edit this filt[...]

92 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 ADVANCED CONTENT FILTER The Advanced Content Filter pr ovides more comp lex checking of message header , message body and message attachment s and s upports the dynamic evaluation of keyw ord frequency to enhance flexibility . Figure 3 - 26 The Advan[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 93 P OLICY M ANAGER Global Policy 3 Using the Expression List A valid keyword expression is composed of keywor ds and logical operators. Y ou can enter keyword expressions by either typing them manually o r choos ing them from the Content dictionaries. The Content dictionaries also hav[...]

94 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 5 Dictionary Category – the type of dictionary that you need to use is defined by the style of message you want to filter . 6 Select the logical operator that you want to use in this expression (se e Using Logical Op erators on page 94 for more det[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 95 P OLICY M ANAGER Global Policy 3 Examples showing the use of Operands The following examples show how ope rands can be inserted and how Ri skFilter will use them to decide whether to trigger the action defined in the Advanced Content Filter: RiskFilter <AND> Gate way <AND&g[...]

96 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 • RiskFilter <AND> innovation < AND> Solution • RiskFilter <OR> innovation • RiskFilter <OR> innovation <OR> Messaging Gateway • <OCCUR> RiskFilter • <OCCUR> RiskFilter <OCCUR> Innovation M ES[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 97 P OLICY M ANAGER Global Policy 3 Editing the Message Attachment Filter Y ou can edit this filter to exactl y match your company’ s requirements. T o edit the Message Attachment filter: 1S e l e c t Global Policy from the Policy Manager tab. 2 Click Filters . The Global Policy Filt[...]

98 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 C ONTENT G UARDIAN RiskFilter Content Guardian provides a mo re intelligent and flexib le filtering me thod. The filtering criteria of Content Guardian consist s of one or more filtering rule (s) which are made up of three part s: filtering tar get, [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 99 P OLICY M ANAGER Global Policy 3 • 2 of the items match • 3 of the items match • 4 of the items match • 5 of the items match 9 Each different filtering target has th e appropri ate matchin g condition( s). Choos e one of th e targets from the drop-dow n list: •I s • Is n[...]

100 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 7 Click Submit to save these new settings. Deleting a filtering rule Y ou can delete a filtering rule that is no long er needed. T o delete a filtering rule: 1S e l e c t Global Policy from the Policy Manager tab. 2 Click Filters . The Global Policy[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 101 P OLICY M ANAGER Global Policy 3 Configuring the Dictionary Threshold Filter T o configure the Dictionary Thre shold Filter you need to specify: • What kind of content you want the rule to detect. • Which part s of the e-mail message you want to scan for dictionary content. •[...]

102 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Global Policy 3 1 1 Enter the Dictionary Th reshold value for this filter into th e Dictionary Thresh old field. Figure 3 - 31 Enter the Dictionary Threshold value into the Select Threshold section 12 Set the action that will be taken if th e filter is triggered. S[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 103 P OLICY M ANAGER Key Points 3 K EY P OINTS The following list is a summary of the main points covere d in Chapter 3. Use this lis t as a quick reminder of what you can do within the Policy Manager t ab: Q Y ou can apply dif ferent filtering solutions to mess ages from specific addr[...]

104 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 P OLICY M ANAGER Key Points 3 Q With phrase value: – Increasing the value will increase filtering strength – Decreasing the value will dec rease filtering strength Q Rather than creating a new dictionary , you can im port a ready-made one fro m elsewhere. There are two ways in [...]

Chapter 4 Report s & Logs The Reports and Logs tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p age 106 Master Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . page 108 Message Report . . . . . . . . . . . . .[...]

106 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS The Reports and Log s tab 4 T HE R EPORTS AND L OGS TAB This chapter explains how to run det ailed report s on messages. From these you can learn about such things as the system st atus and message st atistics. Log re cords keep inform at ion on mail circulati[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 107 R EPORT S & L OGS The Reports an d Logs tab 4 D ASHBOARD RiskFilter enables you to query the st atus of all dist ributed RiskFilter se rvers, protected e -mail servers and LDAP servers via the da shboard on a real- time basis. At the same time, the dashbo ard presents a summary[...]

108 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS Master Report 4 M ASTER R EPORT The Master Report shows statistical result s of all legitimate spam, vir us and policy violation messages received and sent by RiskFilter . T he results include the st atistical re sult s for all domains (in graphical format) an[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 109 R EPORT S & L OGS Master Report 4 6 Click one of the following: • View Report – Logs are compo unded every day at various inter vals. Selecting View Report will show a report based on the last time one of these updates took place. • Today’s Report – Selecting T oday?[...]

110 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS Message Report 4 M ESSAGE R EPORT The Message Report includes in formation on the to tal number and size of all messages for all allowed messages going through RiskFilter . This includes in bound, outbound and messages that are sent bo th ways. The Message Rep[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 111 R EPORT S & L OGS Policy Report 4 P OLICY R EPORT The Policy Report provides st atistica l information on any p olicy violation messages detected b y any of the five filters: G eneral Con tent Filter , Advanced Content Filt er , Me ssage Attachment Filter , Content Gu ardian an[...]

112 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS V irus Report 4 V IRUS R EPORT The Viru s Report provides the statistica l information on all messages cont aining viruses that have been scanned by the RiskFilter Anti-V irus engine. The syst em automatically lists the top 10 viruses and the number of virus m[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 113 R EPORT S & L OGS Spam Report 4 S PAM R EPORT The S pam Report provides st atistical information on all sp am messages caught by the Anti-S pam engine. RiskFilter automatically list s the top 10 sp am recipien ts and the number of spam messages re ceived by them. Q UERYING THE [...]

114 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS Connection Repo rt 4 C ONNECTION R EPORT The Connection Report provides st atistical informat ion on connections mad e and released by RiskFilte r . It includes connection da ta relating to real-t ime black list, block hos t, directory at tack, reverse DNS lo [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 115 R EPORT S & L OGS Connection Repo rt 4 • RBL – How many of thes e connections were from black listed senders, listed in the RBL. This is set in System Settings> Rece ive Settings > Connection Cont rol > RBL (Perform real-time black list (RBL) check). • Directory [...]

116 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS System Report 4 S YSTEM R EPORT The System Report provides st atistical information on the current st atus of RiskFilter , including detaile d information on messages r eceived, processed and de livered by the system to date a nd message queue usage. Figure 4 [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 117 R EPORT S & L OGS Isolated Messages 4 I SOLATED M ESSAGES Isolated Messages archives all messages isolated by RiskFilter . This enables you to perform a variety of tasks on the messag es which include: query , delete, deliver , forward, reprocess or download and save specified [...]

118 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS Isolated Messages 4 7 T o view a message, click the subject. 8 Select the message that you want to process. 9 Y ou can process any of the messages archived in the isolated messa ges queue in any of the ways shown below : • Delete – Delete the se lected mes[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 119 R EPORT S & L OGS V irus Messages 4 V IRUS M ESSAGES Virus Messages arch ives all virus mes sages caug ht by RiskFilt er . This ena bles you to perf orm a variet y of tasks on the messag es which include: query , delete, release, downlo ad, reproc ess and f orward spec ified me[...]

120 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS V irus Messages 4 • Search with keywords such as Recip ient and Sender . • Jump to a new page b y specifying a page then clickin g Go . 6 T o view a message click the h yper-linked subject. Figure 4 - 14 An Archived message 7 Select the message that you wa[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 121 R EPORT S & L OGS Spam Messages 4 S PAM M ESSAGES S pam Messages archive s all spam messages caugh t by RiskFilter . This enables you to perform a variety of tasks on the me ssages which include: q uery , delete , release, download, reproc ess, add to a white list, specify as ?[...]

122 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS Spam Messages 4 6 T o view a message click the subject. Figure 4 - 16 Viewing a S pam message 7 Select the message that you want to process. 8 Y ou can process any of the messages arch ived in t he vir us messages queue in any of the ways sho wn below: • Del[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 123 R EPORT S & L OGS Archived Messages 4 A RCHIVED M ESSAGES Archived Messages archives all messag es (includi ng all virus, spam, policy violation and allowed messages) received by RiskFilter . This enables yo u to perform a variety of tasks on the message s. Figure 4 - 17 The Ar[...]

124 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS Archived Messages 4 Export Messages Y ou might want to download all the messages in the Arch ive, or just messages of a pa rticular type, in order to perform particula r actions on them. T o export messages: 1S e l e c t Archived Messages from the Reports and [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 125 R EPORT S & L OGS Archived Messages 4 Reprocess Messages Reprocessing messages en ables you to resen d all messages to the Archive fold er . This wou ld be useful in the event, for exa mple, of a mail serve r fa iling and messages not being delivered. Clicking Reproce ss Messag[...]

126 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS Archived Messages 4 5 R efresh the curr ent page display by clickin g Check New Messages , or search with ke ywords such as Recipient, Sender , Subject and Policy . 6 Select the check box alongside the message that you want to process. Figure 4 - 19 Select the[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 127 R EPORT S & L OGS Deferred Messages 4 D EFERRED M ESSAGES Deferred Messages is used to store all messages for later delivery , for example in the event of an e-mail server crashing. RiskFilter E-mail will enable you to query , delete, re try , download, empty and forw ard speci[...]

128 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS Deferred Messages 4 5 T o view a message click the subject. Figure 4 - 22 An Archived message 6 Select the message that you want to process. Figure 4 - 23 Select the check box alongside the message 7 Y ou can process all deferred messages as follows: • Delet[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 129 R EPORT S & L OGS Key Points 4 K EY P OINTS The following list is a summary of the main points covere d in Chapter 4. Use this lis t as a quick reminder of what you can do within the Report s and Logs t ab: Q RiskFilter enab les you to quer y the status of all distri buted Risk[...]

130 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R EPORT S & L OGS Key Points 4 Q S pam Messages archive s all spam messages ca ugh t by RiskFilter . This enables you to perform a variety of tasks on the messages wh ich include: query , delete, release, down load, reprocess, add to a white list, specify as ‘not spam ’ and[...]

Chapter 5 RiskFilter System Management Console Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . page 132 The Webmin T ab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . page 134 The System T ab [...]

132 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE Overvi ew 5 O VERVIEW The RiskFilter System Management Console enab les you to configure the RiskFilter applianc e and its interaction with the surround ing network. Y ou can also use the Risk Filter System Management Co nsole to manage th[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 133 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE Overview 5 A CCESSING THE R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE T o open the RiskFilter System Mana gement Console: 1 Open a web browser and enter: https://<hostna me_or_ipaddress>:100 00/ where ‘<hostnam e_or_ipaddress>[...]

134 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The Webmin T ab 5 T HE W EBMIN T AB This chapter ex plains how to use the Webmin tab to manage the RiskF ilter System M anagement console and its connectio ns. W HAT CAN BE CONFIGURED IN THE W EBMIN TAB ? The Webmin tab enables you to: •[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 135 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The We bmin T ab 5 W EBMIN A CTIONS L OG Use the Webmin Actions Log to gener ate report s on ac tions carried out by users within any of the modules such as changing passwor ds, booting up and shutti ng down the comput er and configuration[...]

136 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The Webmin T ab 5 Language This is the language that titles, prompts etc will be displayed in within the RiskF ilter appliance interfaces. T o change the language. 1S e l e c t Language from the Webmin Configuration screen. 2 Choose a lang[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 137 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The We bmin T ab 5 Proxy Servers The RiskFilter System Management Console ne eds to conn ect to the Internet to opera te correctly . If you use a proxy server to access web and FTP site s on the Internet you need to tell Webmin about these[...]

138 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The System T ab 5 T HE S YSTEM T AB This chapter explains h ow to use th e System tab for op erating syst em level con figuration. Y ou can also use this tab to monitor syst em processes and resources. W HAT CAN BE CONFIGURED IN THE S YSTE[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 139 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The System T ab 5 B OOTUP AND S HUTDOWN Use the Bootup and Shut down screen to immediately reboot or shut down the system by clicking th e relevant button: Figure 5 - 6 The Bootup and Shutdown screen C HANGE P ASSWORDS Y ou can use the Cha[...]

140 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The System T ab 5 M ULTI G ATEWAY P OLICY R OUTING This module set s up dynamic routing to preserve ipv4 source addresses. Multi Gateway Policy Routng enables you to override the default gatewa y setting in your routing ta ble. Connections[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 141 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The System T ab 5 N ETWORK C ONFIGURATION The Network Configuratio n tab enables yo u to spec ify how the RiskFilter System Management Co nsole server connects and inter acts with the network: Figure 5 - 8 The Network Configuration screen [...]

142 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The System T ab 5 Multi-NIC configurat ion in RiskFilter Y ou can use W ebmin to set up a multi NIC environment. Once th is is done, both IPs can be used to a ccess the System Management console, th e Management Console, the MT A and all o[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 143 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The System T ab 5 Figure 5 - 11 The Create Bootup In terface screen Routing and Gateways Y ou can set the interface and Gateway that you want to act as your default within the Routing and Gateways screen: Figure 5 - 12 The Routing and Gate[...]

144 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The System T ab 5 T o configure routing and gatewa ys: 1S e l e c t Routing and Ga teways from the Network Configuration tab . 2 For each route, choose the interface from the drop-down list box and enter the corresponding gateway’s IP ad[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 145 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The System T ab 5 Host Addresses Y ou can add new RiskFilter System Manag ement Co nsole host s to the Host Addresses screen. T o add hosts: 1S e l e c t Host Addresses in the Network Configuration tab. 2 In the Host Addresses screen, sele[...]

146 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The System T ab 5 R UNNING P ROCESSES This screen tells you which processe s are currently runn in g, as well as when it first s tarted up and t he command used to run it: Figure 5 - 18 The Run ning Processe s screen S YSTEM T IME The syst[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 147 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The System T ab 5 5 Click Sync system time . 6 S pecify where the RiskFilter System Ma nagement Co nsole server is located by choosing from the Current location lis t boxes in the T imezone section. 7 Click Change timezone to make the chan[...]

148 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The RiskFilter Tab 5 T HE R ISK F ILTER T AB This chapter expla ins how to use the RiskFilt er tab to manage the configuration of services as well as backing up and upda ting of the sof tware. W HAT CAN BE CONFIGURED IN THE R ISK F ILTER T[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 149 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The RiskFilter T ab 5 R ISK F ILTER S ERVICES M ANAGER Enables you to start, stop and rest art RiskFilter . This screen also gives you the status of the following services: • Msoft smg – The mail proces sor and SMTP server • Msoft ad[...]

150 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The RiskFilter Tab 5 4 Click Apply Schedule . If you want to perform an immedi ate backup of y our files, click Backup Now . View these files in th e Backup Files on Appliance section: Figure 5 - 24 The Backup Files on Appliance section 5 [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 151 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The RiskFilter T ab 5 Load balancing with RiskFilter Once you have configured your RiskFilter cl uster , you can set up load balancing using MX records: 1 On the DNS server hosting your do main, create an MX record for each primary RiskFil[...]

152 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The RiskFilter Tab 5 A lower MX pr eference n umber gives h igher prior ity than a lo wer one. In F igure 5- 25, e-mail is sent in the following way: • E-mail sent to site A.com round-robin s between mail exchanger s 1, 2,and 3, because [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 153 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The RiskFilter T ab 5 R ISK F ILTER W EB A CCESS M ANAGER The Web Acce ss Manager manages two HTTP servers: W ebmin and the Administrator Co nsole. Access can be set to be by HTTP and HTTPS. T o set up the access: 1S e l e c t Web Access M[...]

154 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE The RiskFilter Tab 5 U PDATE R ISK F ILTER - E- MAIL This screen is where you can down load the latest ve rs ion of the RiskFilter sof tware as you did when you first set up RiskFilter . There is more informati on about this facility in th[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 155 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE Key Points 5 K EY P OINTS The following list is a summary of the main points covere d in Chapter 5. Use this lis t as a quick reminder of what you ca n do within t he RiskF ilter System Management Console: Q T o open the RiskFilter System [...]

156 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 R ISK F ILTER S YSTEM M ANAGEMENT C ONSOLE Key Points 5 Q System and Serve r S tatus enable s you to add monito ring of different types by ena bling you to: – Set up watchdog scripts – These can monitor the system and notify the adminis trator of pr oblems such as low disk sp a[...]

Chapter 6 Appendix Using the Command Line Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . page 15 8 Internet Threat Database Categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . page 16 5[...]

158 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 A PPENDIX Using the Command Li ne Interface 6 U SING THE C OMMAND L INE I NTERFACE ‘rfmngr’ is a non-root Linux user on the RiskFilter app liance. It is created in a ll out-of-the-box RiskFilter appliances and has the default p assword “$rfmngr$” . Fo r security reasons thi[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 159 A PPENDIX Using the Command Line Interface 6 QTOOL . SH qtool.sh is the Receive Queue Ma nagement Utility and pr ovides the command line management for the RiskFilter receive queue. Command: /opt/riskfilter/smg/bin/qtool.sh -h -l -d -e -i -c -h - launch help -l [filter clause] - li[...]

160 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 A PPENDIX Using the Command Li ne Interface 6 Queue Id = 4 SegmentOffset = 184259131 SegmentDataOffset = 184259155 Message Id = 3944800 Message Position: Queue Id = 4 SegmentOffset = 189968858 SegmentDataOffset = 189968882 Message Id = 3945000 Message Position: Queue Id = 4 Segment[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 161 A PPENDIX Using the Command Line Interface 6 # sudo /etc/init.d/smgd start A mysqld process already exists Starting Msoft smg: [ OK ] Starting Msoft admin: [ OK ] Example 4 - listing all message s in the receive qu eue. You can also list mes sages using a specifie d filter. Command[...]

162 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 A PPENDIX Using the Command Li ne Interface 6 # sudo /etc/init.d/smgd start A mysqld process already exists Starting Msoft smg: [ OK ] Starting Msoft admin: [ OK ][...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 163 A PPENDIX Using the Command Line Interface 6 UNINSTALL . SH Y ou must run this command under ‘r oot’. This command uninstalls RiskFilter sof tware and is located in / opt/riskfilter/smg/bin . It will remove features inst alled by Inst allAnywhere bu t will not uninstall files a[...]

164 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 A PPENDIX Using the Command Li ne Interface 6 ...* * ************************* ************************* ************************* ************************ ...* * ************************* ************************* ************************* ************************ ...* * *********[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 165 A PPENDIX Internet Thr eat Database Categories 6 I NTERNET T HREAT D ATABASE C ATEGORIES T able 1 shows a summary of the Internet Threat Dat abase Categories: Table 1 Internet Theat Dat abase Categories Category Summary Core / Liability Categories • Adult • Gambli ng • Illega[...]

166 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 A PPENDIX Internet Threat Database Categories 6 C ORE / L IABILITY C ATEGORIES T able 2 describes the Core/Liability categories . These are the categories that c ould result in legal or confidentialit y issues should a user be accessing them . Table 2 Core / Liability categor ies C[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 167 A PPENDIX Internet Thr eat Database Categories 6 P RODUCTIVITY C ATEGORIES T able 3 describes the Productivity Catego ries. Th ese are the categories that are not dangerous to company confidentia lity or legality , but could result in loss of band-width and productivity should user[...]

168 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 A PPENDIX Internet Threat Database Categories 6 Special Events • Graphics •M o v i e s • Sound •T e x t • Festive and Seasonal messages, files, promotions • Messages pertaining to a current event that may be objectionable based on content, bandwidth, or negative impact [...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 169 INDEX A accept e-mail for relay from the following ips 30 actions if filt er triggered 71 add/edit phrase 74 admin console locale 12 admin console session timeou 12 allow access list 28 archive level 25 avagent.mcafee 149 B bypass rbl checks 28 C certificate signing request 26 copy[...]

170 Administrator’s Guide SurfControl Ri skFilter - E-mail V5 .2.4 lexirules 83, 85, 87 license expiry date 56 limit data size per connection 35 load balancing 41 logical operators 94, 94, 94 M managed modules 47 management console 132 managing messages 46 master 150 master/slave cluste r configuration 137 mcafee 83 message log 110 message statis[...]

SurfControl RiskFilter - E-mai l V5.2.4 Administrator’s Guide 171 validation settings 18 view report 110 W watchdog scripts 147 webmin actions log 135 X x header 67 Z zip log files older than... 24[...]

SurfControl RiskFilter - E-mail V5.2.4 Administrator’s Guide 172 N OTICES Updates to the SurfCont rol documentation an d software, as well as Support infor mation are available at www .SurfControl.com/support. Copyright ©1998 -2007 SurfControl plc. All right s reserved. No part of this publication may be reproduced, stored in a retrieval system,[...]

173 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 Sun RPC * Sun RPC is a product of Sun Micr osystems, Inc. and is provided for * unrestricted use provided that this leg end is included on all tape * media and as a part of th e software program in whole or p art. Users * may copy or modify Sun RPC without charge, but are not autho[...]

SurfControl RiskFilter - E-mail V5.2.4 Administrator’s Guide 174 VEILLARD BE LIABLE FO R ANY CLAIM, DAMAGES OR OTHER LIABILITY , WHETHE R IN AN ACTION OF CO NTRACT , TORT OR OTHER WISE, ARISING FROM, OUT OF OR IN CO NNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Except as cont ained in this n otice, the name of Daniel V [...]

175 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 This library is distributed in th e hope that it will be useful, but WITHOUT ANY W ARRANTY ; without even the implied warrant y of MERCHANT ABILITY or FITNESS FOR A P ARTICULAR PURPOSE. See the GNU Lesser General Public License for more det ails. Y ou should have received a copy of[...]

SurfControl RiskFilter - E-mail V5.2.4 Administrator’s Guide 176 * advertising or publicity per taining to dist ribution of the sof tware * without specific, written prior pe rmission. This software is made * available "as is", and THE UNIVERSITY OF W ASHING TON AND THE LELAND * ST ANFORD JUNIOR UNIVERSITY DISCLAIM ALL W ARRANTIES, EXPR[...]

177 Administrator’s Guide SurfCont rol RiskFilter - E-mail V5.2.4 GNU Libidn is an implementat ion of the S tringprep, Punycode and IDNA specifications defined by th e IETF Internationalized Domai n Names (IDN) working group, used for interna tionalized domain names. The Java version is JNet-T ool.jar . Copyright (C) 2 005 V entruba This library [...]