Symantec 10490452 - Mail Security 8220 Instruction Manual

Symantec Mail Security for
SMTP
Administration Guide

Symantec Mail Security for SMTP
Administration Guide
The software described in this book is furnished under a license agreement and
may be used only in accordance with the terms of the agreement.
April 27, 2006
Copyright notice
Copyright © 1998-2006 Symantec Corporation. All rights reserved. Symantec, the
Symantec logo, Brightmail, LiveUpdate, SESA, and Norton AntiVirus are U.S. registered
trademarks or registered trademarks of Symantec Corporation or its affiliates in other
countries. Other names may be trademarks of their respective owners.
Symantec Mail Security for SMTP 5.0 is protected under U.S. Patent Nos. 6,052,709;
5,999,932; and 6,654,787.
The product described in this document is distributed under licenses restricting its use,
copying, distribution, and decompilation/reverse engineering. No part of this document
may be reproduced in any form by any means without prior written authorization of
Symantec Corporation and its licensors, if any.
THE DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED
CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED
WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-
INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH
DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL
NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION
WITH THE FURNISHING PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE
INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE
WITHOUT NOTICE.
The Licensed Software and Documentation are deemed to be “commercial computer
software” and “commercial computer software documentation” as defined in FAR
Sections 12.212 and DFARS Section 227.7202.
Symantec Corporation
20330 Stevens Creek Blvd.
Cupertino, CA 95014
http://www.symantec.com
Printed in the United States of America.
10987654321

Technical support
As part of Symantec Security Response, the Symantec global Technical Support
group maintains support centers throughout the world. The Technical Support
group’s primary role is to respond to specific questions on product feature/
function, installation, and configuration, as well as to author content for our
Web-accessible Knowledge Base. The Technical Support group works
collaboratively with the other functional areas within Symantec to answer your
questions in a timely fashion. For example, the Technical Support group works
with Product Engineering as well as Symantec Security Response to provide
Alerting Services and Virus Definition Updates for virus outbreaks and security
alerts.
Symantec technical support offerings include:
■A range of support options that give you the flexibility to select the right
amount of service for any size organization
■Telephone and Web support components that provide rapid response and
up-to-the-minute information
■Upgrade insurance that delivers automatic software upgrade protection
■Content Updates for virus definitions and security signatures that ensure
the highest level of protection
■Global support from Symantec Security Response experts, which is
available 24 hours a day, 7 days a week worldwide in a variety of languages
for those customers enrolled in the Platinum Support Program
■Advanced features, such as the Symantec Alerting Service and Technical
Account Manager role, offer enhanced response and proactive security
support
Please visit our Web site for current information on Support Programs. The
specific features available may vary based on the level of support purchased and
the specific product that you are using.
To receive the latest product information by email, go to:
http://www.symantec.com/techsupp/bulletin/enterprise.html
and join our support bulletin mailing list.
Licensing and registration
If the product that you are implementing requires registration and/or a license
key, the fastest and easiest way to register your service is to access the
Symantec licensing and registration site at www.symantec.com/certificate.
Alternatively, you may go to www.symantec.com/techsupp/ent/enterprise.html,
select the product that you wish to register, and from the Product Home Page,
select the Licensing and Registration link.

Contacting Technical Support
Customers with a current support agreement may contact the Technical
Support group via phone or online at http://www.symantec.com/techsupp/
enterprise/ .
Customers with Platinum support agreements may contact Platinum Technical
Support via the Platinum Web site at http://www-secure.symantec.com/
platinum/ .
When contacting the Technical Support group, please have the following:
■Product release level
■Hardware information
■Available memory, disk space, NIC information
■Operating system
■Version and patch level
■Network topology
■Router, gateway, and IP address information
■Problem description
■Error messages/log files
■Troubleshooting performed prior to contacting Symantec
■Recent software configuration changes and/or network changes
Customer Service
To contact Enterprise Customer Service online, go to www.symantec.com, select
the appropriate Global Site for your country, then choose Service and Support.
Customer Service is available to assist with the following types of issues:
■Questions regarding product licensing or serialization
■Product registration updates such as address or name changes
■General product information (features, language availability, local dealers)
■Latest information on product updates and upgrades
■Information on upgrade insurance and maintenance contracts
■Information on Symantec Value License Program
■Advice on Symantec's technical support options
■Nontechnical presales questions
■Missing or defective CD-ROMs or manuals

Contents
Chapter 1 About Symantec Mail Security for SMTP
Key features .......................................................................................................... 11
Functional overview ............................................................................................ 12
Architecture .......................................................................................................... 13
Where to get more information .........................................................................14
Chapter 2 Configuring system settings
Configuring certificate settings ........................................................................ 17
Configuring host (Scanner) settings ................................................................. 20
Working with the Services page ................................................................20
HTTP proxies ................................................................................................ 21
SMTP Scanner settings ...............................................................................22
Advanced SMTP settings ............................................................................ 25
Configuring internal mail hosts ................................................................28
Testing Scanners ................................................................................................. 28
Configuring LDAP settings ................................................................................. 29
Replicating data to Scanners .............................................................................37
Starting and stopping replication ............................................................. 38
Replication status information .................................................................. 38
Troubleshooting replication ...................................................................... 39
Configuring Control Center settings ................................................................ 40
Control Center administration .................................................................. 41
Control Center certificate ...........................................................................42
Configuring, enabling and scheduling Scanner replication .................. 42
SMTP host ..................................................................................................... 44
System locale ................................................................................................ 44
Chapter 3 Configuring email settings
Configuring address masquerading .................................................................. 45
Importing masqueraded entries ................................................................ 46
Configuring aliases .............................................................................................. 47
Importing aliases ......................................................................................... 49
Configuring local domains ................................................................................. 50
Importing local domains and email addresses ........................................51

6Contents
Understanding spam settings ............................................................................ 51
Configuring suspected spam ...................................................................... 52
Choosing language identification type ..................................................... 52
Software acceleration ................................................................................. 53
Configuring spam settings ......................................................................... 53
Configuring virus settings .................................................................................. 54
Configuring LiveUpdate ............................................................................. 54
Excluding files from virus scanning ......................................................... 55
Configuring general settings ..................................................................... 56
Configuring invalid recipient handling ............................................................ 56
Configuring scanning settings .......................................................................... 57
Configuring container settings .................................................................. 57
Configuring content filtering settings ..................................................... 58
Chapter 4 Configuring email filtering
About email filtering ........................................................................................... 61
Notes on filtering actions ........................................................................... 66
Multiple actions ........................................................................................... 67
Multiple policies ........................................................................................... 69
Security risks ................................................................................................ 70
About precedence ........................................................................................ 71
Creating groups and adding members ............................................................. 72
Assigning filter policies to a group ................................................................... 75
Selecting virus policies for a group ........................................................... 75
Selecting spam policies for a group .......................................................... 77
Selecting compliance policies for a group ............................................... 78
Enabling and disabling end user settings ................................................ 79
Allowing or blocking email based on language ....................................... 80
Managing Group Policies .................................................................................... 81
Creating virus, spam, and compliance filter policies ..................................... 82
Creating virus policies ................................................................................ 83
Creating spam policies ................................................................................ 85
Creating compliance policies ..................................................................... 86
Managing Email Firewall policies ..................................................................... 93
Configuring attack recognition ................................................................. 94
Configuring sender groups ......................................................................... 95
Configuring Sender Authentication ...............................................................105
Managing policy resources ..............................................................................106
Annotating messages ................................................................................106
Archiving messages ...................................................................................109
Configuring attachment lists ...................................................................110
Configuring dictionaries ...........................................................................112
Adding and editing notifications .............................................................114

7Contents
Chapter 5 Working with Spam Quarantine
About Spam Quarantine ...................................................................................117
Delivering messages to Spam Quarantine .....................................................117
Working with messages in Spam Quarantine for administrators .............118
Accessing Spam Quarantine ....................................................................118
Checking for new Spam Quarantine messages .....................................118
Administrator message list page .............................................................118
Administrator message details page .......................................................121
Searching messages ...................................................................................123
Configuring Spam Quarantine .........................................................................126
Delivering messages to Spam Quarantine from the Scanner .............126
Configuring Spam Quarantine port for incoming email .....................127
Configuring Spam Quarantine for administrator-only access ...........128
Configuring the Delete Unresolved Email setting ................................128
Configuring the login help .......................................................................128
Configuring recipients for misidentified messages .............................129
Configuring the user and distribution list notification digests ..........130
Configuring the Spam Quarantine Expunger ........................................135
Specifying Spam Quarantine message and size thresholds ................136
Troubleshooting Spam Quarantine ........................................................137
Chapter 6 Working with Suspect Virus Quarantine
About Suspect Virus Quarantine .....................................................................143
Accessing Suspect Virus Quarantine ..............................................................143
Checking for new Suspect Virus Quarantine messages .......................144
Suspect Virus Quarantine messages page .............................................144
Searching messages ...................................................................................146
Configuring Suspect Virus Quarantine ..........................................................148
Configuring Suspect Virus Quarantine port for incoming email .......148
Configuring the size for Suspect Virus Quarantine .............................148
Chapter 7 Testing Symantec Mail Security for SMTP
Verifying normal delivery ................................................................................151
Verifying spam filtering ...................................................................................151
Testing antivirus filtering ................................................................................152
Verifying filtering to the Spam Quarantine ..................................................153
Chapter 8 Configuring alerts and logs
Configuring alerts ..............................................................................................155
Viewing logs ........................................................................................................157
Configuring logs .................................................................................................159

8Contents
Chapter 9 Working with reports
About reports .....................................................................................................163
Choosing a report ..............................................................................................164
About charts and tables ....................................................................................172
Selecting report data to track ..........................................................................172
Setting the retention period for report data .................................................173
Running reports .................................................................................................173
Saving and editing Favorite Reports ..............................................................174
Running and deleting favorite reports ...........................................................175
Troubleshooting report generation ................................................................175
No data available for the report type specified .....................................175
Sender HELO domain or IP connection shows gateway
information .........................................................................................176
Reports presented in local time of Control Center ...............................176
By default, data are saved for one week .................................................176
Processed message count recorded per message, not per
recipient ..............................................................................................176
Recipient count equals message count ...................................................177
Deferred or rejected messages are not counted as received ...............177
Reports limited to 1,000 rows ..................................................................177
Printing, saving, and emailing reports ...........................................................177
Scheduling reports to be emailed ....................................................................178
Chapter 10 Administering the system
Getting status information ..............................................................................181
Overview of system information .............................................................182
Message status ...........................................................................................182
Host status ..................................................................................................186
LDAP synchronization ..............................................................................187
Log details ...................................................................................................188
Scanner replication ...................................................................................188
Version Information ..................................................................................188
Managing Scanners ...........................................................................................188
Editing Scanners ........................................................................................189
Enabling and disabling Scanners ............................................................189
Deleting Scanners ......................................................................................190
Administering the system through the Control Center ..............................191
Managing system administrators ...........................................................191
Managing software licenses .....................................................................192

9Contents
Administering the Control Center ..................................................................193
Starting and stopping the Control Center .............................................193
Checking the Control Center error log ...................................................194
Increasing the amount of information in BrightmailLog.log .............195
Starting and stopping UNIX and Windows services ....................................196
Starting and stopping Windows services ...............................................196
Starting and stopping UNIX services .....................................................198
Periodic system maintenance ..........................................................................198
Backing up logs data ..................................................................................198
Backing up the Spam and Virus Quarantine databases .......................199
Maintaining adequate disk space ............................................................200
Appendix A Feature Cross-Reference
New features for all users .................................................................................202
Changes for Symantec Mail Security for SMTP users .................................203
New feature names ....................................................................................204
Discontinued features ...............................................................................204
Changes for Symantec Brightmail Antispam users .....................................205
About email filtering and message handling options ..................................206
Appendix B Spam foldering and the Symantec Outlook Spam Plug-in
About foldering and the plug-in ......................................................................209
Installing the Symantec Outlook Spam Plug-in ............................................210
Usage scenarios ..........................................................................................210
End user experience ..................................................................................210
Software requirements .............................................................................212
Configuring automatic spam foldering ..........................................................217
Configuring the Symantec Spam Folder Agent for Exchange ............217
Configuring the Symantec Spam Folder Agent for Domino ...............218
Enabling automatic spam foldering ................................................................221
Enabling language identification ....................................................................222
Appendix C Integrating Symantec Mail Security with Symantec
Security Information Manager
About Symantec Security Information Manager ..........................................223
Interpreting events in the Information Manager .........................................224
Configuring data sources ..........................................................................225
Firewall events that are sent to the Information Manager .................226
Definition Update events that are sent to the Information
Manager ...............................................................................................226
Message events that are sent to the Information Manager ................227
Administration events that are sent to the Information Manager ....228

10 Contents
Appendix D Editing antivirus notification messages
Modifying notification files .............................................................................231
Changing the notification file character set ..........................................232
Editing messages in the notification file ................................................232
Notification file contents .................................................................................233
Glossary
Index

Chapter 1
About Symantec Mail
Security for SMTP
This chapter includes the following topics:
■Key features
■Functional overview
■Architecture
■Where to get more information
Key features
Symantec Mail Security for SMTP offers enterprises an easy-to-deploy,
comprehensive gateway-based email security solution through the following:
■Antispam technology – Symantec’s state-of-the-art spam filters assess and
classify email as it enters your site.
■Antivirus technology – Virus definitions and engines protect your users
from email-borne viruses.
■Content Compliance – These features help administrators enforce corporate
email policies, reduce legal liability, and ensure compliance with regulatory
requirements.
■Group policies and filter policies – An easy-to-use authoring tool lets
administrators create powerful and flexible ad hoc filters for individuals and
groups.

12 About Symantec Mail Security for SMTP
Functional overview
Functional overview
You can deploy Symantec Mail Security for SMTP in different configurations to
best suit the size of your network and your email processing needs.
Each Symantec Mail Security for SMTP host can be deployed in the following
ways:
■Scanner – Deployed as a Scanner, a Symantec Mail Security for SMTP host
filters email. Your installation can have one or many Scanners. Symantec
Mail Security for SMTP runs alongside your existing email or groupware
server(s).
■Control Center – Deployed as a Control Center, a Symantec Mail Security for
SMTP host is a Web-based configuration and administration center. Use it to
configure and manage email filtering, SMTP routing, system settings, and
all other functions. Your enterprise-wide deployment of Symantec Mail
Security for SMTP can have multiple Scanners but only one Control Center,
from which you configure and monitor all the Scanner hosts.
The Control Center provides status for all Symantec Mail Security for SMTP
hosts in your system, system logs, and extensive customizable reporting.
Use it to configure both system-wide and host-specific details.
The Control Center provides the Setup Wizard, for initial configuration of
all Symantec Mail Security for SMTP instances at your site, and also the
Add Scanner Wizard, for adding new Scanners.
It also hosts the Spam and Suspect Virus Quarantines, for storage of spam
and virus messages respectively. End users can access the Control Center to
view their quarantined spam messages and set their preferences for
language filtering and blocked and allowed senders. Alternatively, you can
configure the Spam Quarantine for administrator-only access.
■Scanner and Control Center – A single Symantec Mail Security for SMTP
host performs both functions.
Note: Symantec Mail Security for SMTP provides neither mailbox access for end
users nor message storage; it is not intended for use as the only MTA in your
email infrastructure.
Note: Symantec Mail Security for SMTP does not filter messages that don’t flow
through the SMTP gateway. For example, when two mailboxes reside on the
same MS Exchange Server, or on different MS Exchange Servers within an
Exchange organization, the messages will not pass through the Symantec Mail
Security for SMTP filters.

13About Symantec Mail Security for SMTP
Architecture
Architecture
Symantec Mail Security for SMTP processes a mail message as follows. For the
sake of discussion, our sample message passes through the Filtering Engine to
the Transformation Engine without being rejected.
■The incoming connection arrives at the inbound MTA via TCP/IP.
■The inbound MTA accepts the connection and moves the message to its
inbound queue.
■The Filtering Hub accepts a copy of the message for filtering.

14 About Symantec Mail Security for SMTP
Where to get more information
■The Filtering Hub consults the LDAP SyncService directory to expand the
message’s distribution list.
■The Filtering Engine determines each recipient’s filtering policies.
■The message is checked against Blocked/Allowed Senders Lists defined by
administrators.
■Virus and configurable heuristic filters determine whether the message is
infected.
■Content Compliance filters scan the message for restricted attachment types
or keywords, as defined in configurable dictionaries.
■Spam filters compare message elements with current filters published by
Symantec Security Response to determine whether the message is spam. At
this point, the message may also be checked against end-user defined
Language settings.
■The Transformation Engine performs actions per recipient based on
filtering results and configurable Group Policies.
Where to get more information
In addition to this Administration Guide, your Symantec Mail Security for SMTP
product comes with the following documentation:
■Symantec Mail Security for SMTP Installation Guide
■Symantec Mail Security for SMTP Planning Guide
■Symantec Mail Security for SMTP Getting Started
Symantec Mail Security also includes a comprehensive help system that
contains conceptual and procedural information.
You can visit the Symantec Web site for more information about your product.
The following online resources are available:
Provides access to the technical support Knowledge
Base, newsgroups, contact information, downloads,
and mailing list subscriptions
www.symantec.com/
techsupp/ent/
enterprise.html
Provides information about registration, frequently
asked questions, how to respond to error messages,
and how to contact Symantec License Administration
www.symantec.com
/licensing/els/help/en/
help.html
Provides product news and updates www.enterprisesecurity.
symantec.com

15About Symantec Mail Security for SMTP
Where to get more information
Provides access to the Virus Encyclopedia, which
contains information about all known threats;
information about hoaxes; and access to white papers
about threats
www.symantec.com/
avcenter/global/index.html

16 About Symantec Mail Security for SMTP
Where to get more information

Chapter 2
Configuring system
settings
System settings apply to the Control Center and to attached and enabled
Scanners. This section explains the following:
■Configuring certificate settings
■Configuring host (Scanner) settings
■Testing Scanners
■Configuring LDAP settings
■Replicating data to Scanners
■Configuring Control Center settings
Configuring certificate settings
Manage your certificates using the Certificate Settings page.
The two types of certificates are as follows:
■MTA TLS certificate—This is the TLS certificate used by the MTAs in each
Scanner. Every Scanner has separate MTAs for inbound messages, outbound
messages, and message delivery. Assign this certificate from the Inbound
Mail Settings and Outbound Mail Settings portions of the SMTP tab on the
Settings > Hosts page.
■User interface HTTPS certificate—This is the HTTPS certificate used by the
Control Center for secure Web management. Assign this certificate from the
Settings > Certificates page.

18 Configuring system settings
Configuring certificate settings
You can add certificates to the certificate list in the following two ways:
■Add a self-signed certificate by adding the certificate and filling out the
requested information as presented to you at the time.
■Add a Certification Authority Signed certificate by submitting a certificate
request to a Certification Authority. When you receive the certificate back
from the Certification Authority, you then import the certificate into the
Control Center.
Manage certificates
Follow these steps to add either self-signed or Certification Authority Signed
certificates and to assign certificates.
To add a self-signed certificate to the list
1In the Control Center, click Settings > Certificates.
2Click Add.
3In the Certificate type drop-down list, choose Self-Signed Certificate.
4Complete the information on the Add Certificate page.
5Click Create.
To add a Certification Authority Signed certificate to the list
1In the Control Center, click Settings > Certificates.
2Click Add.
3In the Certificate type drop-down list, choose Certificate Authority Signed.
4Fill in the information on the Add Certificate page.
5Click Request.
A new page is displayed, showing the certificate information in a block of
text, designed for use by the Certification Authority.
6Copy the block of text that appears and submit it to the Certification
Authority.
Each Certification Authority has its own set of procedures for granting
certificates. Consult your Certificate Authority for details.
7When you receive the certificate file from the Certification Authority, place
the file in an easily accessed location on the computer from which you are
connecting to the Control Center.
8On the Certificate Settings page, click Import.

19Configuring system settings
Configuring certificate settings
9On the Import Certificate page, type the full path and filename or click
Browse and choose the file.
10 Click Import.
To view or delete a certificate
1In the Control Center, click Settings > Certificates.
2Check the box next to the certificate to be viewed or deleted.
3Click View to read the certificate.
4Click Delete to remove the certificate.
To assign an MTA TLS certificate
1In the Control Center, click Settings > Hosts.
2Select a host and click Edit.
3Click the SMTP tab.
4Check Accept TLS encryption as appropriate.
5Choose the TLS certificate from the Certificate drop-down list for the
inbound or outbound MTA.
6Click Save.
To assign a user interface HTTPS certificate
1In the Control Center, click Settings > Control Center.
2Select a certificate from the User interface HTTPS certificate drop-down
list.
3Click Save.

20 Configuring system settings
Configuring host (Scanner) settings
Configuring host (Scanner) settings
The following sections describe changes that can be made to individual hosts.
Information is available on these topics:
■Working with the Services page
■HTTP proxies
■SMTP Scanner settings
Working with the Services page
You can stop or start the following services on a Scanner.
■Conduit
■LiveUpdate
■Filter Engine
■MTA
Note: If you stop the filter-hub or the MTA service and wish to continue
receiving alerts, specify an operating MTA IP address in the settings for the
Control Center.
In addition, you can configure individual Scanner replication and MTA settings
that can help you take a Scanner offline on this page.
Work with the services page
Use the following procedures from the Services page to manage individual
Scanner services, replication, and stop the flow of messages through a Scanner.
To start and stop services
1In the Control Center, click Settings >Hosts.
2Check the Scanner to edit.
3Click Edit.
4Select the services to be started or stopped.
5Click Stop to stop a running service or Start to start a stopped service.
To enable or disable Scanner replication for a host
1In the Control Center, click Settings >Hosts.
2Check the Scanner to edit.