background image

42

List of the most important settings in 

spamcatcher.conf

:

Parameter name

Details

approved_ip_list

List of approved IP addresses. There's no need to add the list to the 

spamcatcher.conf

 file. You

can define it in the GUI of the program (see chapter 

Antispam engine parameter setup

).

blocked_ip_list 

List of blocked IP addresses. There's no need to add the list to the 

spamcatcher.conf

 file. You

can define it in the GUI of the program (see chapter 

Antispam engine parameter setup

).

ignored_ip_list 

List of ignored IP addresses. There's no need to add the list to the 

spamcatcher.conf

 file. You

can define it in the GUI of the program (see chapter 

Antispam engine parameter setup

).

rbl_list

List of Realtime Blackhole servers to be used when evaluating messages. The RBL request
checks for presence of a specific IP address on a given RBL server. Subject to these checks are
IP addresses in the Received: sections in the mail header.
The entry format is as follows:

 

rbl_list=server:response:offset,server2:response2:offset2,... 

Meaning of used parameters:

1) server - RBL server name
2) response -  RBL server response if IP address was found (standard responses are 127.0.0.2,
127.0.0.3, 127.0.0.4., etc.). This parameter is optional, and if not set, all answers will be
considered.
3) offset - value from 0 to 100. Influences overall spam score. Standard value is 100, i.e. in case
of a positive check the message is assigned the spam score of 100 and is evaluated as spam.
Negative values lower the overall spam score of a message. Expect the 0 value also with
messages from senders in the 

approvedsenders

 file and the value 100 with messages from

senders in the 

blockedsenders

 file (see below). 

Example 1:

rbl_list=ent.adbl.org

RBL check is performed using the 

ent.adbl.org

 server. If the check is positive, the message

will be assigned a standard offset of 100 and marked as spam.

Example 2:

rbl_list=ent.adbl.org::60

RBL check is performed using the 

ent.adbl.org

 server. If the check is positive, the message

will be assigned an offset of 60 which increases its overall spam score.

Example 3:

rbl_list=bx9.dbl.com::85, list.dnb.org:127.0.0.4:35, req.gsender.org::-75

RBL check is performed using the defined servers (from left to right). In case of a positive check
on 

bx9.dbl.com

 the offset of 85 will be added. If the check on 

list.dnb.org

 will be positive

giving a response of 

127.0.0.4

 offset of 35 will be used. The offset will not be applied in cases

of answers other than 127.0.0.4. If a check is positive on 

req.gsender.org

 the spam score will

be decreased by 75 point (negative value).

rbl_max_ips

Maximum IP addresses that can be sent to RBL server check. Total number of RBL requests is
the total amount of IP addresses in the Received: sections in the email header (up to the set
limit in rbl_maxcheck_ips) multiplied by the number of RBL servers set in the rbl_list. The value
of 0 means there is no limit to the maximum number of IP addresses that can be checked.
IP addresses on the ignored_ip_list (i.e. the 

Ignored IP addresses

 list in the ESET Mail Security

settings).
This parameter is applied only if the rbl_list is enabled (i.e. contains a minimum of 1 server).

approved_domain_list  Is a list domains and IP addresses in the email body, that are to be considered as allowed. Do

not use to whitelist emails by sender's domain!

blocked_domain_list

Is a list domains and IP addresses in the email body, that are to be considered as permanently
blocked. This is not a blacklist of sender's addresses! There's no need to add the list to the 

spamcatcher.conf

 file. You can define it in the GUI of the program (see chapter 

Antispam engine

parameter setup

).

ignored_domain_list 

List of domains in the email body, that are to be permanently excluded from DNSBL checks
and ignored. There's no need to add the list to the 

spamcatcher.conf

 file. You can define it in the

GUI of the program (see chapter 

Antispam engine parameter setup

).

dnsbl_list

List of DNSBL servers to be used in checks of domains and IP adrresses in the email body.
Format of entry is as follows: 

dnsbl_list=server:response:offset,server2:response2:offset2,...

 

40

40

40

40

40

Содержание MAIL SECURITY 4

Страница 1: ...ESET Mail Security 4 for Microsoft Exchange Server Version 4 2 Installation Manual and User Guide Microsoft Windows Server 2000 2003 2008...

Страница 2: ...sion 2 3 11 Installation in a clustered environment 2 4 13 License 2 5 14 Post Installation Configuration 2 6 16 3 Update 17 Proxy server setup 3 1 19 4 ESET Mail Security Microsoft Exchange Server pr...

Страница 3: ...x86 and x64 Microsoft Windows Server 2008 x86 and x64 Microsoft Windows Server 2008 R2 Microsoft Windows Small Business Server 2003 Microsoft Windows Small Business Server 2003 R2 Microsoft Windows S...

Страница 4: ...ntispam protection module is the Greylisting technique disabled by default The technique relies on the RFC 821 specification which states that since SMTP is considered an unreliable transport every me...

Страница 5: ...ith ease of use and high system performance Typical installation is the default option and is recommended if you do not have the particular requirements for specific settings After selecting the insta...

Страница 6: ...e By default the Enable ThreatSense Net Early Warning System option is selected which will activate this feature Click Advanced setup to modify detailed settings for the submission of suspicious files...

Страница 7: ...button 2 2 Custom Installation Custom installation is designed for users who have experience with fine tuning programs and who wish to modify advanced settings during installation After selecting the...

Страница 8: ...same as in Typical installation see Typical installation In the next step License Manager add the license file delivered via email after product purchase After entering your username and password clic...

Страница 9: ...roxy server select the I do not use a proxy server option To configure your proxy server settings select I use a proxy server and click Next Enter the IP address or URL of your proxy server in the Add...

Страница 10: ...on to display a confirmation window before downloading program components To download program component upgrades automatically select the Always update program components option NOTE After a program c...

Страница 11: ...single server This type of environment provides high accessibility and reliability of available services If one of the nodes in the cluster fails or becomes inaccessible its functioning is automatica...

Страница 12: ...llation process it is necessary to fulfill certain conditions on the target computers as well as on the ERA Server For further details refer to the ESET Remote Administrator User Guide Configuration F...

Страница 13: ...are protected and which ones are excluded from protection Resource mailboxes i e a conference room mailbox will be tallied in the mailbox count Email aliases are not tallied in the mailbox count In a...

Страница 14: ...kely it is to delete legitimate email Advantages of this method include very low consumption of system resources and less administration The drawback to this method is that if a legitimate email is de...

Страница 15: ...into account the configurations of the Approved IP addresses list the Ignored IP addresses list the Safe Senders and Allow IP lists on the Exchange server and the AntispamBypass settings for the recip...

Страница 16: ...name and password received at the time of purchase should be entered If the username and password were entered during installation of ESET Mail Security you will not be prompted for them at this point...

Страница 17: ...from the Advanced Setup tree Select the Use proxy server option and then fill in the Proxy server IP address and Port fields If needed select the Proxy server requires authentication option and then e...

Страница 18: ...18 profiles in Advanced Setup by clicking Update from the Advanced Setup tree...

Страница 19: ...column Number next to each rule name displays the number of times the rule was successfully applied The rules are checked against a message when it is processed by transport agent TA or VSAPI When bot...

Страница 20: ...ent size condition it is sufficient to fill in only part of a phrase as long as the Match whole words option is not selected Values are not case sensitive unless the Match case option is selected If y...

Страница 21: ...ter Message quarantine Submit file for analysis sends suspicious attachments to ESET s lab for analysis Send event notification sends a notification to the administrator based on settings in Tools Ale...

Страница 22: ...out being stored in the log cache By default ESET Mail Security components running in Microsoft Exchange Server store log messages in their internal cache and send them to the application log at perio...

Страница 23: ...p down menu at the bottom Mails are then delivered to quarantine by Exchange s internal mechanism using its own settings In the Message quarantine by recipient field you can define message quarantine...

Страница 24: ...orary folder NOTE In order to reduce the potential I O and fragmentation impact we recommend placing the Temporary folder on a different hard drive than the one on which Microsoft Exchange Server is i...

Страница 25: ...highly unlikely to be spam while a rating of 9 indicates that the message is very likely spam SCL values can be processed further by the Microsoft Exchange Server s Intelligent Message Filter or Cont...

Страница 26: ...ng the Enable antivirus and antispyware mail server protection option Note that antivirus and antispyware protection is turned on automatically after every service computer restart 4 2 1 Actions In th...

Страница 27: ...a notification tag to the email subject with the value defined in the Template added to the subject of infected messages text field by default virus VIRUSNAME The above mentioned modifications can au...

Страница 28: ...plication Programming Interface VSAPI Microsoft Exchange Server provides a mechanism to make sure that every message component is scanned against the current virus signature database If a message comp...

Страница 29: ...rus signature database Microsoft Exchange Server sends the message to ESET Mail Security to be scanned before opening the message in your e mail client Since background scanning can affect system load...

Страница 30: ...nfected content or delete the message This action will be applied only if the automatic cleaning defined in ThreatSense engine parameter setup Cleaning did not clean the message The Deletion option al...

Страница 31: ...and represents the period after which the client will retry accessing the file that had previously been inaccessible due to scanning 4 2 4 2 Microsoft Exchange Server 2000 VSAPI 2 0 This version of Mi...

Страница 32: ...eters available in the Scheduler Planner After the task has been scheduled it will appear in the list of scheduled tasks and as with the other tasks you can modify its parameters delete it or temporar...

Страница 33: ...time a thread waits for a message scan to complete If the scan is not finished within this time limit Microsoft Exchange Server will deny the client access to the email Scanning will not be interrupt...

Страница 34: ...se update we recommend using scheduled scanning outside working hours Scheduled background scanning can be configured via a special task in the Scheduler Planner When you schedule a Background scannin...

Страница 35: ...hment to zero size or replace the infected file with action information By activating Rescan you can scan the messages and files that have already been scanned again 4 2 4 3 2 Performance In this sect...

Страница 36: ...E Performance is not improved significantly if there are more ThreatSense scanning engines than scanning threads 4 2 4 4 Microsoft Exchange Server 2007 2010 VSAPI 2 6 This version of Microsoft Exchang...

Страница 37: ...the other tasks you can modify its parameters delete it or temporarily deactivate the task Enabling the Scan RTF email bodies option activates scanning of RTF message bodies RTF message bodies may con...

Страница 38: ...For the best program performance we advise using an equal number of ThreatSense scan engines and scan threads TIp To determine the Number of scan threads the Microsoft Exchange Server provider recomme...

Страница 39: ...mailbox or retain it If a threat is found you can choose to write a spam score to the scanned message and specify the value in Since botnets are responsible for sending the majority of infected messa...

Страница 40: ...pam module The Recommended profile is comprised of the recommended settings striking a balance between security and impact on system performance The Most accurate profile is focused solely on mail ser...

Страница 41: ...message scores 100 and no other checks are made In the Allowed domains tab you can specify domains used in the message body that should be approved In the Ignored domains tab you can specify domains u...

Страница 42: ...ck is positive the message will be assigned an offset of 60 which increases its overall spam score Example 3 rbl_list bx9 dbl com 85 list dnb org 127 0 0 4 35 req gsender org 75 RBL check is performed...

Страница 43: ...be decreased by 75 points negative value home_country_list List of countries that will be considered home Messages routed through a country not on this list will be evaluated using more strict rules h...

Страница 44: ...a domain domain policy to determine whether a sender is authorized to send messages from that domain enable_all_spf This option is to determine whether domains not on the spf_list or Mailshell file ca...

Страница 45: ...email subject By default the tag is SPAM although it can be a user defined string NOTE You can also use system variables when adding a template to the message subject 4 3 3 Transport Agent In this sec...

Страница 46: ...g protection As a result spam messages may be delivered to clients or messages may not be delivered at all Time limit for the initial connection denial min when a message is delivered for the first ti...

Страница 47: ...Where is the problem A The decision to scan all messages immediately or at the user s attempt to access a message depends on several factors including server load CPU time required to scan all message...

Страница 48: ...es from senders on the Safe Senders list All messages from servers on the Whitelist list e g MS Exchange IPAllow list or the Allowed IP addresses Q Users download messages to their email clients via P...

Отзывы: