Symantec BRIGHTMAIL - SYM ANTISPAM AND User manual

Symantec Brightmail AntiSpam
™
Version 6.0
Installation Guide

Copyright © 2004-2005 Symantec Corporation and/or its subsidiaries. All rights reserved.
Symantec Brightmail AntiSpam™
Version 6.0.2
Installation Guide
Document Version 1.0
Brightmail, the Brightmail logo, BLOC, BrightSig, Probe Network and The Anti-Spam Leader are trademarks or registered trademarks of Symantec
Corporation.
Symantec and the Symantec logo are U.S. registered trademarks and Symantec Security Response (SSR) is a trademark of Symantec Corporation.
Symantec Brightmail AntiSpam is protected under U.S. Patent No. 6,052,709.
Microsoft, Windows, and/or other Microsoft products referenced herein are either trademarks or registered trademarks of Microsoft.
For third party notices, see Appendix B, “Third Party Licenses,” on page 145.
All other trademarks, service marks, trade names, or company names referenced herein are used for identification only and are the property of their
respective owners.
Symantec Corporation
20330 Stevens Creek Blvd.
Cupertino, CA 95014
U.S.A.
Voice [phone]
http://www.symantec.com

Installation Guide iii
Table of Contents
Symantec Brightmail AntiSpam Overview. . . . . . . . . . . . . . . . . . . . . . . 1
What’s New in Symantec Brightmail AntiSpam . . . . . . . . . . . . . . . . . . . . . . 2
Symantec Brightmail AntiSpam Architecture Overview . . . . . . . . . . . . . . . . 3
Brightmail Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Brightmail Control Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Group Policies, Email Categories, and Filtering Actions. . . . . . . . . . . . . . . . 6
Brightmail Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
AntiSpam Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Content Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Blocked and Allowed Senders Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
AntiVirus Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Brightmail Conduit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Brightmail Quarantine. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Spam Foldering and Submissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Installation Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Installing Brightmail Scanner for Sendmail . . . . . . . . . . . . . . . . . . . . 15
Preparing to Install Brightmail Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Confirm Hardware Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Confirm Software and Location Requirements. . . . . . . . . . . . . . . . . . 16
Enable Sendmail External Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Create Required Accounts and Directories. . . . . . . . . . . . . . . . . . . . . 18
Installing Brightmail Scanner for Sendmail . . . . . . . . . . . . . . . . . . . . . . . . . 19
Find and Run the Install Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Upgrading Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Installing with the Command-Line Installer. . . . . . . . . . . . . . . . . . . . 23
Starting a Brightmail Scanner. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Registering to Receive New AntiSpam Filters . . . . . . . . . . . . . . . . . . 30
What to Do Next. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

iv Symantec Brightmail AntiSpam™
Table of Contents
Uninstalling Brightmail Scanner for Sendmail . . . . . . . . . . . . . . . . . . . . . . . 31
Uninstalling with the Command-Line Installer. . . . . . . . . . . . . . . . . . 31
Configuring Sendmail for the Brightmail Filter . . . . . . . . . . . . . . . . . 33
Understanding the Filter Address and Optional Settings . . . . . . . . . . . . . . . 33
Configuring Sendmail Switch to Work with Brightmail Scanner. . . . . . . . . 35
Configuring Sendmail for Brightmail Scanner with sendmail.cf . . . . . . . . . 40
Configuring Sendmail for Brightmail Scanner with M4. . . . . . . . . . . . . . . . 41
Installing Brightmail Scanner for Windows. . . . . . . . . . . . . . . . . . . . . 43
Hardware Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Software Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Upgrading Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Installing Brightmail Scanner for Windows . . . . . . . . . . . . . . . . . . . . . . . . . 46
Verifying Brightmail Scanner Installation. . . . . . . . . . . . . . . . . . . . . . 53
Modifying, Repairing, and Removing Brightmail Scanner. . . . . . . . . . . . . .54
Installing Brightmail Control Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Hardware Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Software Environment Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Operating System Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
LDAP Compatibility for Brightmail Quarantine. . . . . . . . . . . . . . . . . 59
Web Browser Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Checking for Port Availability Via TCP/IP. . . . . . . . . . . . . . . . . . . . . 60
Upgrading Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Installing Brightmail Control Center on UNIX. . . . . . . . . . . . . . . . . . . . . . . 60
Accessing the UNIX Install Script . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Running the Installer on UNIX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Reinstalling Control Center on UNIX. . . . . . . . . . . . . . . . . . . . . . . . . 67
Installing Brightmail Control Center on Windows . . . . . . . . . . . . . . . . . . . . 67
Automatic Startup Configured by Brightmail Control Center Installer . . . . 73
Uninstalling Brightmail Control Center on UNIX . . . . . . . . . . . . . . . . . . . . 73
Uninstalling Brightmail Control Center on Windows. . . . . . . . . . . . . . . . . . 73
Control Center Testing and Configuration. . . . . . . . . . . . . . . . . . . . . . 75
Testing Installation of the Brightmail Control Center. . . . . . . . . . . . . . . . . . 76
Reviewing the Installation Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Logging in and Logging out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Checking Versions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Adding a Brightmail Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Starting a Brightmail Scanner from the Brightmail Control Center . . 78

Table of Contents
Installation Guide v
Testing Symantec Brightmail AntiSpam Filtering . . . . . . . . . . . . . . . . . . . . 78
Verifying Normal Delivery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Verifying Spam Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Testing AntiVirus Filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Verifying Spam Filtering to Quarantine . . . . . . . . . . . . . . . . . . . . . . . 79
Configuring the Brightmail Control Center to Use WebLogic. . . . . . . . . . . 81
Copying the MySQL Connector/J API. . . . . . . . . . . . . . . . . . . . . . . . 81
Adding MySQL Connector/J to the CLASSPATH Variable . . . . . . . 81
Configuring the Brightmail JDBC Connection Pool . . . . . . . . . . . . . 82
Configuring a Data Source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Deploying the brightmail.war . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Testing the Control Center with the WebLogic Application Server. . 86
Plug-Ins and Foldering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Installing the Symantec Plug-in for Outlook . . . . . . . . . . . . . . . . . . . . . . . . 87
Usage Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
End User Experience. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Software Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Administrator Setup Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Configuring Automatic Spam Foldering. . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Configuring the Spam Folder Agent. . . . . . . . . . . . . . . . . . . . . . . . . . 93
Configuring the Symantec Spam Folder Agent for Domino . . . . . . . 95
Enabling Automatic Spam Foldering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Appendix A: Symantec Brightmail AntiSpam Files. . . . . . . . . . . . 107
Brightmail Scanner on UNIX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Brightmail Scanner, Complete
(Brightmail Server, Brightmail Client). . . . . . . . . . . . . . . . . . . . . . . 108
Brightmail Scanner Installation with Brightmail Server Only . . . . . 113
Brightmail Scanner Installation with Brightmail Client Only . . . . . 118
Brightmail Scanner on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Brightmail Scanner, Complete
(Brightmail Server, Brightmail Client). . . . . . . . . . . . . . . . . . . . . . . 120
Brightmail Scanner Installation with Brightmail Server Only . . . . . 127
Brightmail Scanner Installation with Brightmail Client Only . . . . . 132
Brightmail Control Center on All Platforms. . . . . . . . . . . . . . . . . . . . . . . . 134
Appendix B: Third Party Licenses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

vi Symantec Brightmail AntiSpam™
Table of Contents

Installation Guide 1
Symantec Brightmail AntiSpam Overview
Welcome to Symantec Brightmail AntiSpam™, Symantec’s industry-leading message
filtering system. Symantec Brightmail AntiSpam offers complete, Internet-wide, server-
side antispam and antivirus protection. It actively seeks out, identifies, analyzes, and
ultimately defuses spam and virus attacks before they inconvenience your users and
overwhelm or damage your networks. Symantec software allows you to remove unwanted
mail before it reaches your users’ inboxes, without violating their privacy.
Symantec Brightmail AntiSpam software filters email in four ways:
•AntiSpam Filters use our state-of-the-art technologies and strategies to filter and
classify email as it enters your site.
•AntiVirus Filters combine Symantec processing technology with Symantec AntiVirus
definitions and engines to clean viruses from your email.
•Content Filters supplement AntiSpam Filters; you can tailor them specifically to the
needs of your organization.
•The Allowed Senders List and the Blocked Senders List filter messages based on the
sender. You can create your own lists and subscribe to third-party lists. Symantec
Brightmail AntiSpam includes the Brightmail Reputation Service, which consists of
our Open Proxy List, Safe List and Suspect List. These features filter messages based
on extensive research to ascertain the reputation of the originating IP address, as a
source of spam or of legitimate email.
This section contains the following topics:
•What’s New in Symantec Brightmail AntiSpam
•Symantec Brightmail AntiSpam Architecture Overview
•Group Policies, Email Categories, and Filtering Actions
•Brightmail Filters
•Brightmail Conduit
•Brightmail Quarantine
•Spam Foldering and Submissions
•Installation Sequence

Symantec Brightmail AntiSpam Overview
2Symantec
Brightmail AntiSpam™
Symantec Brightmail AntiSpam Overview
What’s New in Symantec Brightmail AntiSpam
Symantec Brightmail AntiSpam Version 6.0 provides the following enhancements over
previous releases:
Table 1. Symantec Brightmail AntiSpam Version 6.0 Enhancements
Feature Description
Brightmail
Control Center The Brightmail Control Center (Control Center) is a Web-based cross-platform configuration and administration center built in Java. Each Symantec Brightmail
AntiSpam installation has one Control Center, which also houses Brightmail Quarantine
and supporting software. You can configure and monitor all of your Brightmail Scanners
from the Control Center.
The Control Center replaces the Brightmail configuration file, the Configurator and the
Brightmail Administration Console. These components are no longer included in
Symantec Brightmail AntiSpam.
Brightmail
Scanner Brightmail Scanners perform email filtering. Your Symantec Brightmail AntiSpam installation can have one or many Brightmail Scanners. Each Brightmail Scanner
includes one or both of the following components: Brightmail Server, Brightmail Client.
Multiple-Machine
Management You can now configure and manage multiple Brightmail Scanners from one Brightmail Control Center. Previously each computer filtering email had to be configured
individually.
Group Policies You can now specify an unlimited number of user groups, identified by email addresses
or domain names, and customize mail filtering for each group.
Improved
Filtering Numerous improvements have been made to Symantec Brightmail AntiSpam's filtering technologies, including enhanced effectiveness for URL Filters and Heuristic Filters;
filtering on mailto: links in messages; improved filtering on MIME headers; and the next
generation of Signature Filters, which target comparisons to specific message
components with surgical precision.
Brightmail
Reputation
Service
The Brightmail Reputation Service provides comprehensive reputation tracking that
enhances the power of Symantec Brightmail AntiSpam. Symantec manages three lists
as part of the Brightmail Reputation Service. Each list operates automatically and filters
your messages using the same technology as Symantec’s other filters. The Brightmail
Reputation Service includes the Open Proxy List, the Safe List and the Suspect List.
Improved
Reporting For added convenience and clarity, pre-set reports are now separated into two groups: antispam reports and antivirus reports. You can choose from a selection of reports; each
report can be customized to include specific date ranges, time period groupings, and
various delivery and output options. For some reports, you can filter based on specific
recipients and senders of interest.
Language
Identification Users of the Brightmail Plug-in for Outlook can choose from a list of languages in which they would like to receive messages. Messages identified as written in a language not
on the user’s list will be filtered as spam.
Quarantine
Management
and End User
Improvements
Brightmail Quarantine is now managed via the Brightmail Control Center. You can now
set messages to be deleted based on the total size of the Quarantine database or
based on each user’s storage usage. When users receive digest notifications from
Brightmail Quarantine, they can now click on a View link to view an individual message,
or click on a Release link to release a message back to the inbox.

Symantec Brightmail AntiSpam Overview
Installation Guide 3
Symantec Brightmail AntiSpam Architecture Overview
Using Brightmail AntiSpam, you set up a powerful message filtering system that protects
your customers and your network through an approach that is centralized and automated,
but also provides customizable, open features that you can tailor for your system. The net
effect of this highly scalable structure is to unburden your customers of unwanted email.
As spam messages traverse the Internet, they pass through Symantec’s worldwide Probe
NetworkTM, an extensive array of email addresses. The Probe Network includes over two
million probe accounts that attract the latest spam, based upon up-to-date research into
spamming methodologies. The Probe Network sends possible spam emails in real time to
the Brightmail Logistics and Operations Center (BLOCTM) for evaluation. If the message is
verified as spam, the BLOC issues AntiSpam Filters to Brightmail Scanners on your
system that isolate similar messages.
The BLOC consists of several centers working cooperatively on three continents,
comprising a round-the-clock protection network that spans the globe. Sophisticated
automatic tools, assisted and monitored by BLOC Technicians, evaluate mail for new
variations of spam, then issue filters to identify and capture similar messages. The BLOC
continuously provides updated filters to Brightmail Servers on your system. BLOC
Technicians play an important role in confirming the identification of possible spam. This
combination of automation and human intervention allows Symantec Brightmail
AntiSpam to adapt in real time to ever-changing spamming techniques, giving it
unparalleled flexibility and accuracy as a spam filter.
Most of the filters that the BLOC creates are designed to thwart specific spam attacks. A
spam attack can contain thousands of identical or similar messages. By targeting filters
against specific attacks, the BLOC keeps Symantec’s false positive rate extremely low
(less than 1 in 1 million).
Symantec also employs a carefully designed set of heuristic filters, which target patterns
common in spam and add a proactive element to our spam-fighting arsenal. Commonly
available heuristic filters can lead to large increases in false positives because of the
problems inherent in a pattern-matching approach. Symantec Brightmail AntiSpam
heuristic filters are carefully designed and tested to prevent large increases in false
positives.

Symantec Brightmail AntiSpam Overview
4Symantec
Brightmail AntiSpam™
Symantec Brightmail AntiSpam Overview
Figure 1 shows an overview of Symantec Brightmail AntiSpam.
Figure 1. Symantec Brightmail AntiSpam Overview
Brightmail Scanner
Each installation of Symantec Brightmail AntiSpam can have one or more Brightmail
Scanners. Brightmail Scanners perform the actual filtering of email messages.
Each Brightmail Scanner contains:
•A Brightmail Agent
•One or both of the following:
— A Brightmail Server
— A Brightmail Client. If the Brightmail Scanner contains a Brightmail Client, then
a supported mail transfer agent (MTA) must also reside on the same computer.

Symantec Brightmail AntiSpam Overview
Installation Guide 5
Brightmail Agent
This component communicates with the Brightmail Control Center to support centralized
configuration and administration activities.
Brightmail Client
The Brightmail Client is a communications channel between the MTA and the Brightmail
Server. You can use multiple Brightmail Clients; each one can talk to multiple Brightmail
Servers. The Brightmail Client performs load balancing between Brightmail Servers.
Brightmail Server
The Brightmail Servers at your site process spam based on configuration options you
select. Each Brightmail Server is a multi-threaded process that listens for requests from
Brightmail Clients. Using a variety of state-of-the-art technologies, the Brightmail Server
filters messages for classification. The classification, or verdict, is then returned to the
Brightmail Client for subsequent delivery action.
Brightmail Control Center
Each Symantec Brightmail AntiSpam installation has exactly one Brightmail Control
Center. This is the central nervous system of your Symantec software. The Brightmail
Control Center communicates with the Brightmail Agent on each of your Brightmail
Scanners. For smaller installations, you can install the Brightmail Control Center and the
Brightmail Scanner on the same computer.
From this Web-based graphical user interface, you can:
•Configure, start and stop each of your Brightmail Scanners.
•Specify email filtering options for groups of users or for all of your users at once.
•Monitor consolidated reports and logs for all Brightmail Scanners.
•See summary information.
•Administer Brightmail Quarantine.
•View online help for Brightmail Control Center screens.
The Brightmail Control Center contains the following software:
Brightmail Quarantine
Brightmail Quarantine provides storage of spam messages and Web-based end user access
to spam. You can also configure Brightmail Quarantine for administrator-only access. Use
of Brightmail Quarantine is optional.
Third Party Software: Database, Web Server
A single MySQL database stores all of your Symantec Brightmail AntiSpam configuration
information, as well as Brightmail Quarantine information and emails (if you are using
Brightmail Quarantine). Configuration information is communicated to each Brightmail
Scanner via an XML file. A Java-based Web Server (by default this is the Tomcat Web

Symantec Brightmail AntiSpam Overview
6Symantec
Brightmail AntiSpam™
Symantec Brightmail AntiSpam Overview
Server) performs Web hosting functions for the Brightmail Control Center and Brightmail
Quarantine.
Figure 2 shows the major components of Symantec Brightmail AntiSpam installed at your
site.
Figure 2. Symantec Brightmail AntiSpam Components
Group Policies, Email Categories, and Filtering Actions
Symantec Brightmail AntiSpam provides a wide variety of actions for filtering email, and
allows you to either set identical options for all users, or specify different actions for
different groups of users.

Symantec Brightmail AntiSpam Overview
Installation Guide 7
You can specify groups of users based on email addresses or domain names. For each
group, you can specify email filtering actions for seven different categories of email. For
each category you can specify one of up to eight different filtering options.
You can choose different filtering actions for the following categories of email:
•Spam–Email messages identified as spam using Symantec’s AntiSpam Filters.
• Suspected spam – You can use Symantec’s Spam Scoring to identify a range of email
as suspected spam, based on scores assigned by AntiSpam Filters.
• Email from blocked senders – You can specify a list of blocked senders, and you can
use third party blocked senders lists. The lists included in the Brightmail Reputation
Service are used by default.
• Emails infected with viruses – Symantec identifies virus-infected emails using
AntiVirus Filters, based on Symantec virus definitions and engines.
• Mass-mailing worms – Symantec Brightmail AntiSpam identifies mass-mailing
worm emails as distinct from spam or virus emails, because many customers prefer to
delete these emails immediately.
• Unscannable emails – These are emails that could not be scanned due to size
restrictions or other variables. They may or may not contain viruses. You can choose
how to handle these messages.
• Custom filtered emails – You can specify special filters unique to your organization,
to filter for specific content in email messages.
In addition to the seven categories listed above, you can also specify trusted senders by
creating an Allowed Senders List and by subscribing to third party allowed senders lists.
Messages from allowed senders are automatically sent to user inboxes, bypassing all
filtering (except antivirus filtering, if enabled). The Safe List, part of the Brightmail
Reputation Service, is implemented by default.
The filtering actions available vary by email category, and include the following:
•Deliver messages normally.
•Mark messages as spam, either by altering the subject line or by including a
configurable X-Header.
•Delete messages.
•Route messages to an administrator’s mailbox for subsequent examination.
•Save messages in a directory specified for that purpose.
•Send messages to Brightmail Quarantine, where users can access them via the Web.
•Route messages to each user’s spam folder using the Spam Folder Agent, native
foldering in Exchange 2003, or the Symantec Spam Folder Agent for Domino.
•Clean messages of viruses and deliver each cleaned message normally, with a
notification to the recipient.

Symantec Brightmail AntiSpam Overview
8Symantec
Brightmail AntiSpam™
Symantec Brightmail AntiSpam Overview
Brightmail Filters
Symantec Brightmail AntiSpam employs the following four major types of filters:
• AntiSpam Filters – AntiSpam Filters are created by Symantec using our state-of-the-
art technologies and strategies to filter and classify email as it enters your site.
• Content Filters – Custom content filters are written by you, using the Brightmail
Control Center or the Sieve scripting language, to tailor filtering to the needs of your
organization.
• Blocked and Allowed Senders Lists – You can create lists of blocked senders and
allowed senders and you can use third party lists. The lists included in the Brightmail
Reputation Service are deployed by default.
• AntiVirus Filters – Antivirus definitions and engines provided by Symantec protect
your users from email-borne viruses.
AntiSpam Filters
The nature of spam—and the business implications of false positives—demands a careful
and flexible approach to filter creation. Accordingly, Symantec does not use a one-size-
fits-all approach to creating filters. Instead, it employs a combination of filtering
strategies, based on the specific type of spam. Some technologies perform sophisticated
comparisons with the latest spam received by the Probe Network, resulting in matches of
unparalleled accuracy. Others are more proactive, attacking future spam based on special
characteristics or origination information. Symantec filter types include:
•Heuristic Filters
•URL Filters
•Signature Filters
•Header Filters
Heuristic Filters – Heuristic Filters scan the headers and the body of a message, applying
a variety of tests. These tests search for tell-tale characteristics that are usually inherent in
spam, such as opt-out links, specific phrases, and forged headers. Each characteristic is
assigned a spam probability, and the message is given a cumulative probability score
based on the overall test results. If a certain probability threshold is reached, Symantec
Brightmail AntiSpam determines the message to be spam. Using heuristics, Symantec
Brightmail AntiSpam software can make the determination that a message is spam, even if
it hasn’t passed through the Probe Network. The BLOC transmits updated Heuristic Filters
as it does other AntiSpam Filters.
URL Filters – Symantec’s URL Filters catch messages based on specific URLs found in
spam. URL-based spam is increasingly pervasive because spammers want to direct
readers to a specific Web site for contact information or purchasing instructions. Although
the underlying URLs do not change frequently, spammers attempt to obfuscate and
disguise them. As a result, these URLs appear to be unique across similar spam messages.

Symantec Brightmail AntiSpam Overview
Installation Guide 9
Signature Filters – When messages flow into the BLOC, they are characterized using
proprietary algorithms into a unique signature, which is added to the database of known
spam. Using this signature, Signature Filters group and match seemingly random
messages that originated from a single attack. By distilling a complex and evolving attack
to its DNA, more spam can be deflected with a single filter. Signature Filters include
BrightSig2 Filters, Body Hash Filters and Attachment Filters.
Header Filters – Header Filters are regular expression-based filters that are applied to the
header lines of a message. Header Filters can be used to compare email messages to spam
messages seen by the Probe Network, and to exploit commonalities or trends present in
spam messages (similar to the use of Symantec’s Heuristic Filters).
Content Filters
You can create custom content filters, using either the Custom Filters Editor provided
through the Brightmail Control Center, or using a Sieve filters file. You can specify a wide
variety of filtering criteria. You have three sets of choices for the action to take on these
messages:
•Deliver normally.
•Treat the same as another email category: you can use the same action on custom-
filtered messages that you chose for spam, viruses, or any other category.
•Treat as company-specific content: choose a unique action for custom-filtered
messages.
Blocked and Allowed Senders Lists
You can use lists of blocked and allowed senders (also known as blacklists and whitelists)
in a variety of ways:
•Define a custom Allowed Senders List – Allowed senders are approved or trusted
senders. Unless AntiVirus Filters detect a virus or worm, Symantec Brightmail
AntiSpam treats mail coming from an address or connection in your Allowed Senders
List as legitimate mail. Such mail is delivered immediately to the inbox, bypassing
any other filtering. You therefore cannot choose message handling actions for
messages from allowed senders; by definition these messages will be delivered to the
user inbox.
•Define a custom Blocked Senders List – You can block messages from any senders
you wish. You can define message handling actions that apply to messages from
blocked senders for each group policy.
•Check incoming mail against third party blocked senders lists and third party
allowed senders lists – Third parties compile and manage lists of desirable or
undesirable domains, IP connections, and networks. A DNS blacklist is a common
example of such a list. DNS blacklists allow subscribers to check, using DNS lookups,
whether incoming mail is originating from known spammers. Many of the hosts on the
list typically are running open SMTP relays or open proxy server ports. Such insecure
relays and ports are effective conduits for sending unsolicited bulk email. Subscribers

Symantec Brightmail AntiSpam Overview
10 Symantec Brightmail AntiSpam™
Symantec Brightmail AntiSpam Overview
to DNS lists can thus block or delete mail from these blacklisted hosts. On the other
hand, administrators who subscribe to DNS whitelists can leverage a list of legitimate
mail servers and senders. You can add a DNS blacklist as a third-party blocked
senders list. You can add a DNS whitelist as a third party allowed senders list.
—Brightmail Reputation Service Lists: By default, Symantec Brightmail
AntiSpam is configured to check mail against three lists, all part of the Brightmail
Reputation Service, managed by Symantec. Unlike other lists, which simply
aggregate information and are frequently outdated, the Brightmail Reputation
Service lists are generated and updated hourly. They are downloaded to your
system and updated just like other filters.
–The Open Proxy List is a dynamic database containing IP addresses of
identity-masking relays, including proxy servers with open or insecure ports.
Because open proxy servers allow spammers to conceal their identities and
off-load the cost of emailing to other parties, spammers will continually
misuse a vulnerable server until it is brought offline or secured. Symantec
recommends that organizations secure their proxy servers to ensure that
spammers cannot connect to open ports and relay SMTP email.
–The Safe List is a list of IP addresses from which virtually no outgoing email
is spam.
–The Suspect List is a list of IP addresses from which virtually all outgoing
email is spam.
AntiVirus Filters
NOTE: The following information and all other references to antivirus functions assume
you have purchased antivirus filtering.
Virus experts at Symantec Security Response (SSR) provide up-to-date virus definitions
and engines to rid email attachments of viruses.
The BLOC—through automated processes monitored by BLOC Technicians—integrates
the virus definitions and engines into AntiVirus Filters, tests them, and distributes them to
your site.
The Brightmail Scanner—using the AntiVirus Cleaner (Cleaner)—filters the attachments
of incoming email in search of viruses. If filtering detects no viruses, the message is
analyzed for spam. If filtering detects one or more viruses, the policies you have set up go
into effect. For example, you can instruct the Brightmail Scanner to delete the message or
to clean and then deliver the message. You can also set policies potential virus messages
that cannot be processed by the Cleaner.
Symantec Brightmail AntiSpam also provides protection against mass-mailing worms,
which can leave hundreds of spam messages in their wake. The Worm Auto-Delete feature
automatically removes not only the worm but also the associated emails. This convenient
feature saves users from having to wade through hundreds of inbox messages that,
although clean from viruses, server no valuable purpose.

Symantec Brightmail AntiSpam Overview
Installation Guide 11
The Cleaner creates a configurable advisory text message. This message informs the user
that the infected attachment has been cleaned, deleted, or delivered without cleaning. The
Cleaner inserts the original message, if delivered, as an attachment to the advisory
message. The Cleaner also places a special identifying line in the message header so that
the message is not filtered again for viruses.
Brightmail Conduit
Having up-to-date filters is imperative to ensure the highest success rate of filtering and
blocking unwanted email. Filter updates are accomplished through a dialogue between the
BLOC and the Brightmail Conduit, a component that runs at your site. The Conduit
handles all such communication at your site. The Conduit runs on each Brightmail
Scanner that contains a Brightmail Server.
The Conduit polls a secure Web site every minute to check for the availability of new
filters from the BLOC. If new filters are available, the Conduit retrieves the updated filters
using secure HTTPS file transfer. After authenticating the filters, the Conduit notifies the
Brightmail Server to begin using the updated filters. The Conduit also manages statistics,
both for use by the BLOC and by the Brightmail Control Center, which aggregates the
statistics from Brightmail Scanners to create consolidated reports.
Brightmail Quarantine
Brightmail Quarantine (Quarantine) provides users direct Web-based access to spam
messages that Symantec software has sidelined into the Quarantine database for them.
Users can check for misidentified messages, resend messages to their inbox, and delete or
search messages. An administrator account provides access to all quarantined messages.
Quarantine stores spam messages in the Symantec Brightmail AntiSpam MySQL database
on the Brightmail Control Center computer. A Notifier process periodically sends users a
reminder to check their spam messages in Quarantine. Spam messages older than a
customizable time period are deleted automatically by an Expunger process. A Java-based
Web Server presents the Quarantine interface to users.
Spam Foldering and Submissions
Symantec Brightmail AntiSpam features the Spam Folder Agent and the Symantec Spam
Folder Agent for Domino, designed to work on Microsoft Exchange and Lotus Domino
Servers, respectively. Installed separately from the standard Brightmail installation, these
agents create a subfolder and a server-side filter in each user’s mailbox. This filter gets
applied to messages that the Brightmail Scanner identifies as spam, routing spam into each
user’s spam folder. The spam folder agents relieve end users and administrators of the
burden of using their mail clients to create filters. The Symantec Spam Folder Agent for
Domino also allows users to submit missed spam and false positives to Symantec.

Symantec Brightmail AntiSpam Overview
12 Symantec Brightmail AntiSpam™
Symantec Brightmail AntiSpam Overview
The Symantec Plug-in for Outlook makes it easy for Outlook users to submit missed spam
and false positives to Symantec. Depending on how you configure the plug-in, user
submissions can also be sent automatically to a local system administrator. The Symantec
Plug-in for Outlook also gives users the option to administer their own allowed senders
and blocked senders lists.
Refer to “Plug-Ins and Foldering,” on page 87 for more information about spam foldering
options and submissions.
Installation Sequence
Different environments and circumstances may influence how you approach installation.
This document presents a basic approach that is applicable in a variety of circumstances
and works for many, if not most, enterprise installations. As always, we welcome your
feedback on the procedure.
To install Symantec Brightmail AntiSpam:
1Verify your software, hardware and operating system requirements or prerequisite
actions. Use the following sections for this purpose:
— UNIX: Brightmail Scanner
–“Confirm Hardware Requirements,” on page 15
–“Confirm Software and Location Requirements,” on page 16
–“Create Required Accounts and Directories,” on page 18
— Windows: Brightmail Scanner
–“Hardware Requirements,” on page 43
–“Software Environment,” on page 43
— UNIX and Windows: Brightmail Control Center
–“Hardware Requirements,” on page 57
–“Software Environment Requirements,” on page 58
–“Operating System Compatibility,” on page 58
2Install at least one Brightmail Scanner as described in “Installing Brightmail Scanner
for Sendmail,” on page 19 or “Installing Brightmail Scanner for Windows,” on
page 46.
NOTE: If you are upgrading from a previous release you should upgrade ALL
Brightmail Scanners prior to upgrading the Brightmail Control Center. See
“Upgrading Software,” on page 21 for UNIX Brightmail Scanners, or
“Upgrading Software,” on page 44 for Windows Brightmail Scanners.
3Install Brightmail Control Center as described in “Installing Brightmail Control
Center on UNIX,” on page 60 or “Installing Brightmail Control Center on Windows,”
on page 67.

Symantec Brightmail AntiSpam Overview
Installation Guide 13
4Add a Brightmail Scanner using the Brightmail Control Center as described in
“Adding a Brightmail Scanner,” on page 77.
5Make sure the Brightmail Scanner can be turned on by the Brightmail Control Center
as described in “Starting a Brightmail Scanner from the Brightmail Control Center,”
on page 78.
6Test that filtering is working as described in “Testing Symantec Brightmail AntiSpam
Filtering,” on page 78.

Symantec Brightmail AntiSpam Overview
14 Symantec Brightmail AntiSpam™
Symantec Brightmail AntiSpam Overview