User manual NOD32 ESET MAIL SECURITY FOR LINUX/BSD/SOLARIS

[. . . ] ESET Mail Security Installation Manual and User Guide Linux, BSD and Solaris Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. 1 Main functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. 2 Key features of the system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2. Terminology and abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3. Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 4. [. . . ] Note that anti-spam scanning can be used only for email objects. Thus, this functionality is relevant only for the following modules: esets_imap, esets_mda, esets_pipe, esets_pop3, esets_smtp and esets_smfi. 15 Once anti-spam is enabled in any of the configuration sections, the anti-spam scanning engine initializes during the main scanning daemon start-up. During this process, appropriate anti-spam support modules are loaded from the anti-spam cache directory. To define the period (in minutes), after which ESETS will check for available anti-spam module updates, edit the entry shown below in the ESETS configuration file. If you do not set the value for this parameter, ESETS will not regularly update its anti-spam database: as_update_period = 60 Anti-spam functionality can also be configured using the following configuration file: @ETCDIR@/anti-spam/spamcatcher. conf NOTE: Spa mCa tcher is a tool for spam detection. It tracks all email communication on its own server and monitors messages rejected by users. It evaluates this and various other data to determine which email is likely to contain spam and sends users a probability score for every message they receive. It allows you to create your own rules for identifying and blacklisting spam. Hundreds of rules can be used to evaluate spam score and block the incoming spam. The @ETCDIR@/anti-spam/ directory contains a number of different configurations stored in files, that can be used to customize the anti-spam engine. If you wish to start using a particular configuration, replace the default anti-spam configuration stored in ‘spa mca tcher. conf’ with any of the available configuration files and reload the ESETS daemon. spamcatcher. conf Is a default configuration file, that contains optimal configuration recommended for typical server environment. To display differences between any of the files in the anti-spam directory, use the diff command. For example, if you wish to compare the spamcatcher. conf and the spamcatcher. conf. accurate files use the following command: diff spamcatcher. conf spamcatcher. conf. accurate spamcatcher. conf. accurate Bayesian Word Token analysis (i. e. spam filtering using Bayesian Analysis) is enabled. It improves accuracy, but uses more memory and can therefore take slightly more time to finish than other methods. The limit of the number of domains queried against the DNS Block List server (DNSBL) is increased (the ‘dnsbl_ma x_doma ins’ option). DNSBLs are most often used to publish addresses of computers or networks linked to spamming. Sender Policy Fra mework (SDK) with live DNS queries will be performed. The value of the ‘spa m_threshold’ parameter is increased. Messages with spam scores equal to or higher than this value will be rejected. spamcatcher. conf. fast The number of domains queried against the DNS Block List server is reduced. [. . . ] If IP-filtering is being performed by the ipchains administration tool, an appropriate rule would be: ipchains -A INPUT -p tcp -i if0 --dport 25 -j REDIRECT 2525 If IP-filtering is being performed by the iptables administration tool, the rule is: iptables -t nat -A PREROUTING -p tcp -i if0 --dport 25 -j REDIRECT --to-ports 2525 On FreeBSD, the rule is as follows: ipfw add fwd 192. 168. 1. 10, 2525 tcp from any to any 25 via if0 in On NetBSD and Solaris: echo 'rdr if0 0. 0. 0. 0/0 port 25 -> 192. 168. 1. 10 port 2525 tcp' | ipnat -f - W a rning : Your MTA may accept all connections without extensive checking from esets_smtp because those connections are local. By using your own firewall rules, make sure you do not create an open relay, i. e. , allow someone from the outside to connect to esets_smtp and use it as a relay SMTP server. 9. 8 Setting ESETS for scanning of POP3 communication The POP3 communication scanning is performed using esets_pop3 daemon. In the [pop3 ] section of the ESETS configuration file, set these parameters: agent_enabled = yes listen_addr = "192. 168. 1. 10" listen_port = 8110 where ‘listen_a ddr’ is the address of the local network interface named if0. The next step is to redirect all POP3 requests to esets_pop3 . [. . . ]