Symantec BRIGHTMAIL - SYM ANTISPAM AND User manual

Symantec Brightmail AntiSpam
™
Version 6.0
Installation Guide

Copyright © 2004-2005 Symantec Corporation and/or its subsidiaries. All rights reserved.
Symantec Brightmail AntiSpam™
Version 6.0.2
Installation Guide
Document Version 1.0
Brightmail, the Brightmail logo, BLOC, BrightSig, Probe Network and The Anti-Spam Leader are trademarks or registered trademarks of Symantec
Corporation.
Symantec and the Symantec logo are U.S. registered trademarks and Symantec Security Response (SSR) is a trademark of Symantec Corporation.
Symantec Brightmail AntiSpam is protected under U.S. Patent No. 6,052,709.
Microsoft, Windows, and/or other Microsoft products referenced herein are either trademarks or registered trademarks of Microsoft.
For third party notices, see Appendix B, “Third Party Licenses,” on page 145.
All other trademarks, service marks, trade names, or company names referenced herein are used for identification only and are the property of their
respective owners.
Symantec Corporation
20330 Stevens Creek Blvd.
Cupertino, CA 95014
U.S.A.
Voice [phone]
http://www.symantec.com

Installation Guide iii
Table of Contents
Symantec Brightmail AntiSpam Overview. . . . . . . . . . . . . . . . . . . . . . . 1
What’s New in Symantec Brightmail AntiSpam . . . . . . . . . . . . . . . . . . . . . . 2
Symantec Brightmail AntiSpam Architecture Overview . . . . . . . . . . . . . . . . 3
Brightmail Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Brightmail Control Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Group Policies, Email Categories, and Filtering Actions. . . . . . . . . . . . . . . . 6
Brightmail Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
AntiSpam Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Content Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Blocked and Allowed Senders Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
AntiVirus Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Brightmail Conduit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Brightmail Quarantine. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Spam Foldering and Submissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Installation Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Installing Brightmail Scanner for Sendmail . . . . . . . . . . . . . . . . . . . . 15
Preparing to Install Brightmail Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Confirm Hardware Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Confirm Software and Location Requirements. . . . . . . . . . . . . . . . . . 16
Enable Sendmail External Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Create Required Accounts and Directories. . . . . . . . . . . . . . . . . . . . . 18
Installing Brightmail Scanner for Sendmail . . . . . . . . . . . . . . . . . . . . . . . . . 19
Find and Run the Install Script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Upgrading Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Installing with the Command-Line Installer. . . . . . . . . . . . . . . . . . . . 23
Starting a Brightmail Scanner. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Registering to Receive New AntiSpam Filters . . . . . . . . . . . . . . . . . . 30
What to Do Next. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

iv Symantec Brightmail AntiSpam™
Table of Contents
Uninstalling Brightmail Scanner for Sendmail . . . . . . . . . . . . . . . . . . . . . . . 31
Uninstalling with the Command-Line Installer. . . . . . . . . . . . . . . . . . 31
Configuring Sendmail for the Brightmail Filter . . . . . . . . . . . . . . . . . 33
Understanding the Filter Address and Optional Settings . . . . . . . . . . . . . . . 33
Configuring Sendmail Switch to Work with Brightmail Scanner. . . . . . . . . 35
Configuring Sendmail for Brightmail Scanner with sendmail.cf . . . . . . . . . 40
Configuring Sendmail for Brightmail Scanner with M4. . . . . . . . . . . . . . . . 41
Installing Brightmail Scanner for Windows. . . . . . . . . . . . . . . . . . . . . 43
Hardware Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Software Environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Upgrading Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Installing Brightmail Scanner for Windows . . . . . . . . . . . . . . . . . . . . . . . . . 46
Verifying Brightmail Scanner Installation. . . . . . . . . . . . . . . . . . . . . . 53
Modifying, Repairing, and Removing Brightmail Scanner. . . . . . . . . . . . . .54
Installing Brightmail Control Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Hardware Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Software Environment Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Operating System Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
LDAP Compatibility for Brightmail Quarantine. . . . . . . . . . . . . . . . . 59
Web Browser Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Checking for Port Availability Via TCP/IP. . . . . . . . . . . . . . . . . . . . . 60
Upgrading Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Installing Brightmail Control Center on UNIX. . . . . . . . . . . . . . . . . . . . . . . 60
Accessing the UNIX Install Script . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Running the Installer on UNIX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Reinstalling Control Center on UNIX. . . . . . . . . . . . . . . . . . . . . . . . . 67
Installing Brightmail Control Center on Windows . . . . . . . . . . . . . . . . . . . . 67
Automatic Startup Configured by Brightmail Control Center Installer . . . . 73
Uninstalling Brightmail Control Center on UNIX . . . . . . . . . . . . . . . . . . . . 73
Uninstalling Brightmail Control Center on Windows. . . . . . . . . . . . . . . . . . 73
Control Center Testing and Configuration. . . . . . . . . . . . . . . . . . . . . . 75
Testing Installation of the Brightmail Control Center. . . . . . . . . . . . . . . . . . 76
Reviewing the Installation Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Logging in and Logging out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Checking Versions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Adding a Brightmail Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Starting a Brightmail Scanner from the Brightmail Control Center . . 78

Table of Contents
Installation Guide v
Testing Symantec Brightmail AntiSpam Filtering . . . . . . . . . . . . . . . . . . . . 78
Verifying Normal Delivery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Verifying Spam Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Testing AntiVirus Filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Verifying Spam Filtering to Quarantine . . . . . . . . . . . . . . . . . . . . . . . 79
Configuring the Brightmail Control Center to Use WebLogic. . . . . . . . . . . 81
Copying the MySQL Connector/J API. . . . . . . . . . . . . . . . . . . . . . . . 81
Adding MySQL Connector/J to the CLASSPATH Variable . . . . . . . 81
Configuring the Brightmail JDBC Connection Pool . . . . . . . . . . . . . 82
Configuring a Data Source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Deploying the brightmail.war . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Testing the Control Center with the WebLogic Application Server. . 86
Plug-Ins and Foldering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Installing the Symantec Plug-in for Outlook . . . . . . . . . . . . . . . . . . . . . . . . 87
Usage Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
End User Experience. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Software Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Administrator Setup Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Configuring Automatic Spam Foldering. . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Configuring the Spam Folder Agent. . . . . . . . . . . . . . . . . . . . . . . . . . 93
Configuring the Symantec Spam Folder Agent for Domino . . . . . . . 95
Enabling Automatic Spam Foldering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Appendix A: Symantec Brightmail AntiSpam Files. . . . . . . . . . . . 107
Brightmail Scanner on UNIX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Brightmail Scanner, Complete
(Brightmail Server, Brightmail Client). . . . . . . . . . . . . . . . . . . . . . . 108
Brightmail Scanner Installation with Brightmail Server Only . . . . . 113
Brightmail Scanner Installation with Brightmail Client Only . . . . . 118
Brightmail Scanner on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Brightmail Scanner, Complete
(Brightmail Server, Brightmail Client). . . . . . . . . . . . . . . . . . . . . . . 120
Brightmail Scanner Installation with Brightmail Server Only . . . . . 127
Brightmail Scanner Installation with Brightmail Client Only . . . . . 132
Brightmail Control Center on All Platforms. . . . . . . . . . . . . . . . . . . . . . . . 134
Appendix B: Third Party Licenses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

vi Symantec Brightmail AntiSpam™
Table of Contents

Installation Guide 1
Symantec Brightmail AntiSpam Overview
Welcome to Symantec Brightmail AntiSpam™, Symantec’s industry-leading message
filtering system. Symantec Brightmail AntiSpam offers complete, Internet-wide, server-
side antispam and antivirus protection. It actively seeks out, identifies, analyzes, and
ultimately defuses spam and virus attacks before they inconvenience your users and
overwhelm or damage your networks. Symantec software allows you to remove unwanted
mail before it reaches your users’ inboxes, without violating their privacy.
Symantec Brightmail AntiSpam software filters email in four ways:
•AntiSpam Filters use our state-of-the-art technologies and strategies to filter and
classify email as it enters your site.
•AntiVirus Filters combine Symantec processing technology with Symantec AntiVirus
definitions and engines to clean viruses from your email.
•Content Filters supplement AntiSpam Filters; you can tailor them specifically to the
needs of your organization.
•The Allowed Senders List and the Blocked Senders List filter messages based on the
sender. You can create your own lists and subscribe to third-party lists. Symantec
Brightmail AntiSpam includes the Brightmail Reputation Service, which consists of
our Open Proxy List, Safe List and Suspect List. These features filter messages based
on extensive research to ascertain the reputation of the originating IP address, as a
source of spam or of legitimate email.
This section contains the following topics:
•What’s New in Symantec Brightmail AntiSpam
•Symantec Brightmail AntiSpam Architecture Overview
•Group Policies, Email Categories, and Filtering Actions
•Brightmail Filters
•Brightmail Conduit
•Brightmail Quarantine
•Spam Foldering and Submissions
•Installation Sequence

Symantec Brightmail AntiSpam Overview
2Symantec
Brightmail AntiSpam™
Symantec Brightmail AntiSpam Overview
What’s New in Symantec Brightmail AntiSpam
Symantec Brightmail AntiSpam Version 6.0 provides the following enhancements over
previous releases:
Table 1. Symantec Brightmail AntiSpam Version 6.0 Enhancements
Feature Description
Brightmail
Control Center The Brightmail Control Center (Control Center) is a Web-based cross-platform configuration and administration center built in Java. Each Symantec Brightmail
AntiSpam installation has one Control Center, which also houses Brightmail Quarantine
and supporting software. You can configure and monitor all of your Brightmail Scanners
from the Control Center.
The Control Center replaces the Brightmail configuration file, the Configurator and the
Brightmail Administration Console. These components are no longer included in
Symantec Brightmail AntiSpam.
Brightmail
Scanner Brightmail Scanners perform email filtering. Your Symantec Brightmail AntiSpam installation can have one or many Brightmail Scanners. Each Brightmail Scanner
includes one or both of the following components: Brightmail Server, Brightmail Client.
Multiple-Machine
Management You can now configure and manage multiple Brightmail Scanners from one Brightmail Control Center. Previously each computer filtering email had to be configured
individually.
Group Policies You can now specify an unlimited number of user groups, identified by email addresses
or domain names, and customize mail filtering for each group.
Improved
Filtering Numerous improvements have been made to Symantec Brightmail AntiSpam's filtering technologies, including enhanced effectiveness for URL Filters and Heuristic Filters;
filtering on mailto: links in messages; improved filtering on MIME headers; and the next
generation of Signature Filters, which target comparisons to specific message
components with surgical precision.
Brightmail
Reputation
Service
The Brightmail Reputation Service provides comprehensive reputation tracking that
enhances the power of Symantec Brightmail AntiSpam. Symantec manages three lists
as part of the Brightmail Reputation Service. Each list operates automatically and filters
your messages using the same technology as Symantec’s other filters. The Brightmail
Reputation Service includes the Open Proxy List, the Safe List and the Suspect List.
Improved
Reporting For added convenience and clarity, pre-set reports are now separated into two groups: antispam reports and antivirus reports. You can choose from a selection of reports; each
report can be customized to include specific date ranges, time period groupings, and
various delivery and output options. For some reports, you can filter based on specific
recipients and senders of interest.
Language
Identification Users of the Brightmail Plug-in for Outlook can choose from a list of languages in which they would like to receive messages. Messages identified as written in a language not
on the user’s list will be filtered as spam.
Quarantine
Management
and End User
Improvements
Brightmail Quarantine is now managed via the Brightmail Control Center. You can now
set messages to be deleted based on the total size of the Quarantine database or
based on each user’s storage usage. When users receive digest notifications from
Brightmail Quarantine, they can now click on a View link to view an individual message,
or click on a Release link to release a message back to the inbox.

Symantec Brightmail AntiSpam Overview
Installation Guide 3
Symantec Brightmail AntiSpam Architecture Overview
Using Brightmail AntiSpam, you set up a powerful message filtering system that protects
your customers and your network through an approach that is centralized and automated,
but also provides customizable, open features that you can tailor for your system. The net
effect of this highly scalable structure is to unburden your customers of unwanted email.
As spam messages traverse the Internet, they pass through Symantec’s worldwide Probe
NetworkTM, an extensive array of email addresses. The Probe Network includes over two
million probe accounts that attract the latest spam, based upon up-to-date research into
spamming methodologies. The Probe Network sends possible spam emails in real time to
the Brightmail Logistics and Operations Center (BLOCTM) for evaluation. If the message is
verified as spam, the BLOC issues AntiSpam Filters to Brightmail Scanners on your
system that isolate similar messages.
The BLOC consists of several centers working cooperatively on three continents,
comprising a round-the-clock protection network that spans the globe. Sophisticated
automatic tools, assisted and monitored by BLOC Technicians, evaluate mail for new
variations of spam, then issue filters to identify and capture similar messages. The BLOC
continuously provides updated filters to Brightmail Servers on your system. BLOC
Technicians play an important role in confirming the identification of possible spam. This
combination of automation and human intervention allows Symantec Brightmail
AntiSpam to adapt in real time to ever-changing spamming techniques, giving it
unparalleled flexibility and accuracy as a spam filter.
Most of the filters that the BLOC creates are designed to thwart specific spam attacks. A
spam attack can contain thousands of identical or similar messages. By targeting filters
against specific attacks, the BLOC keeps Symantec’s false positive rate extremely low
(less than 1 in 1 million).
Symantec also employs a carefully designed set of heuristic filters, which target patterns
common in spam and add a proactive element to our spam-fighting arsenal. Commonly
available heuristic filters can lead to large increases in false positives because of the
problems inherent in a pattern-matching approach. Symantec Brightmail AntiSpam
heuristic filters are carefully designed and tested to prevent large increases in false
positives.

Symantec Brightmail AntiSpam Overview
4Symantec
Brightmail AntiSpam™
Symantec Brightmail AntiSpam Overview
Figure 1 shows an overview of Symantec Brightmail AntiSpam.
Figure 1. Symantec Brightmail AntiSpam Overview
Brightmail Scanner
Each installation of Symantec Brightmail AntiSpam can have one or more Brightmail
Scanners. Brightmail Scanners perform the actual filtering of email messages.
Each Brightmail Scanner contains:
•A Brightmail Agent
•One or both of the following:
— A Brightmail Server
— A Brightmail Client. If the Brightmail Scanner contains a Brightmail Client, then
a supported mail transfer agent (MTA) must also reside on the same computer.