FTGateUsersGuide

FTGateUsersGuide

iii

Table Of Contents Introduction.............................................................................................................................................. 1

Introduction .......................................................................................................................................... 1 Welcome to FTGate ......................................................................................................................... 1

Licence Agreement .............................................................................................................................. 1 Copyright ............................................................................................................................................. 4

Copyright © 1996-2009 FTGate Technology Ltd. All rights reserved. ............................................. 5 Trademarks ...................................................................................................................................... 5

Disclaimer ............................................................................................................................................ 5 Main Feature List ................................................................................................................................. 5

Services ........................................................................................................................................... 5 Security ............................................................................................................................................ 6 Domains and Mailboxes................................................................................................................... 6 User Mailboxes ................................................................................................................................ 6 Group Mailboxes .............................................................................................................................. 6 List Mailboxes .................................................................................................................................. 7 Monitoring ........................................................................................................................................ 7 Client Services ................................................................................................................................. 7 Anti-Virus support ............................................................................................................................ 7 Anti-Spam and Message Filtering .................................................................................................... 8 Other Features ................................................................................................................................. 8 WebAdmin ....................................................................................................................................... 8

Groupware Features ............................................................................................................................ 8 Shared Folders ................................................................................................................................ 8 Address Books ................................................................................................................................. 9 Calendars ......................................................................................................................................... 9 Task Lists ......................................................................................................................................... 9

FAQ (Frequently Asked Questions) .................................................................................................... 9 Product support ................................................................................................................................. 10

Product Support ............................................................................................................................. 10 Support FAQ .................................................................................................................................. 10 Upgrade Protection and Support Plan ........................................................................................... 11 Contacting FTGate Technology ..................................................................................................... 12

Installation ............................................................................................................................................. 13 System Requirements ....................................................................................................................... 13

Recommended requirements: ....................................................................................................... 13 Minimum Requirements: ................................................................................................................ 13 Supported Systems ........................................................................................................................ 13 Virtual Machines ............................................................................................................................ 13 Web Browsers ................................................................................................................................ 13 Outlook Connector ......................................................................................................................... 14

Browser Compatibility ........................................................................................................................ 14 Browsers offering full support for all features ................................................................................ 14 Browsers offering limited support .................................................................................................. 14

Allowing users to relay through your server ...................................................................................... 14 Forwarding to remote users in the same domain .............................................................................. 14

Problem .......................................................................................................................................... 15 Solution .......................................................................................................................................... 15

Connecting multiple offices with FTGate ........................................................................................... 15 The network ................................................................................................................................... 16 Central Office configuration (ServerA): .......................................................................................... 16 Regional Office configuration (ServerB): ....................................................................................... 16 Completion ..................................................................................................................................... 17

Registration Overview ....................................................................................................................... 17 Licence Types ................................................................................................................................ 17 Mailbox Count ................................................................................................................................ 17

General .............................................................................................................................................. 17 Registering and Activating Licences .............................................................................................. 17

FTGateUsersGuide

iv

Domains, Mailboxes and delivering mail ....................................................................................... 19 AutoCluster Overview .................................................................................................................... 20 Access from the Internet ................................................................................................................ 22 Firewall ports .................................................................................................................................. 22 Host-name configuration ................................................................................................................ 23 Network Storage and shared drives .............................................................................................. 23 Accessing SolSight Web ................................................................................................................ 24 FTGate behind a NAT router/firewall ............................................................................................. 24

Migration ............................................................................................................................................ 25 Migration ........................................................................................................................................ 25 Migrating Mail from an Existing POP3 server ................................................................................ 25 Moving to a new server .................................................................................................................. 26

Relay .................................................................................................................................................. 27 FTGate as an MX relay .................................................................................................................. 27 FTGate as a DMZ server ............................................................................................................... 27

Upgrade ............................................................................................................................................. 28 Upgrading from a previous version ................................................................................................ 28 Upgrading from FTGateOffice or FTGatePro ................................................................................ 29 Upgrading From FTGate4 .............................................................................................................. 30

Using FTGate ........................................................................................................................................ 31 Common Tasks ................................................................................................................................. 31

General .......................................................................................................................................... 31 Sending/Receiving via the Internet ................................................................................................ 31 Managing Mailboxes and Domains ................................................................................................ 31 Managing Filters ............................................................................................................................ 31 Backup and Restore ...................................................................................................................... 31

Trouble shooting ................................................................................................................................ 31 UbeBlock is not blocking the spam emails .................................................................................... 32 I have just upgraded from FTGateOffice/Pro an my users cannot login ....................................... 32 A service will not start and reports "The specified address is already in use." .............................. 32 SSL certificates .............................................................................................................................. 32 I am unable to send to some domains, the mail sits in the outbox. ............................................... 33 My messages to Hotmail are disappearing ................................................................................... 33 My server is having its EHLO command rejected with a syntax error message ........................... 33 How do I move FTGate to another machine .................................................................................. 33 How do I backup FTGate ............................................................................................................... 33 My users are getting a relaying denied error ................................................................................. 33 I cant remember my WebAdmin user name or password ............................................................. 33 What firewall ports do I need to open? .......................................................................................... 33 How do I share folders and keep the mail on the server. .............................................................. 34 SmartPop delivery issues .............................................................................................................. 34 When I try to send mail to an Outlook list I get a Bulk sends not allowed error ............................ 34 My users are getting the message 'Message size exceeds administrative limit' ........................... 34

General .............................................................................................................................................. 34 Logging Into FTGate ...................................................................................................................... 34 Mail Flow ........................................................................................................................................ 35 Undeliverable Mail ......................................................................................................................... 36 Connection Types .......................................................................................................................... 37 IMAP Considerations ..................................................................................................................... 37 Forwarding Messages.................................................................................................................... 38 Macro Expansion ........................................................................................................................... 39 Anti-Spoofing ................................................................................................................................. 39

Send and Receive ............................................................................................................................. 40 Receiving Mail ................................................................................................................................ 40 Outbound SMTP Auth .................................................................................................................... 40 Sending Mail .................................................................................................................................. 41 SmartPop ....................................................................................................................................... 41 Signatures/Disclaimers .................................................................................................................. 41 Remote Domains ........................................................................................................................... 41 Greylisting Delays .......................................................................................................................... 42

Table Of Contents

v

Accessing FTGate from the Internet .............................................................................................. 43 Management ...................................................................................................................................... 44

Web Administration ........................................................................................................................ 44 Activating a Licence Key ................................................................................................................ 45 Lost administrator passwords ........................................................................................................ 45 Emergency Recovery..................................................................................................................... 46 Safe Mode ...................................................................................................................................... 46 Database support ........................................................................................................................... 47 SQL Based Mailing Lists ................................................................................................................ 47 Permissions/Access rights ............................................................................................................. 47 Customising SolSight Web ............................................................................................................ 48

Security Policies ................................................................................................................................ 48 Security Policies ............................................................................................................................. 48 Relay Control and Authentication .................................................................................................. 50 Access Control Lists ...................................................................................................................... 52 Configuring LAN access ................................................................................................................ 52 SSL ................................................................................................................................................ 52 SSL self signed certificates ............................................................................................................ 53

Filtering, Anti-Spam, Anti-Virus ......................................................................................................... 54 Overview ........................................................................................................................................ 54 Setting up junk filtering................................................................................................................... 55 Minimising Junk/UBE mail ............................................................................................................. 60 Greylisting ...................................................................................................................................... 61 Whitelisting ..................................................................................................................................... 63 Whitehosting .................................................................................................................................. 63 Blacklisting ..................................................................................................................................... 63 Filter Rules ..................................................................................................................................... 64 Safe Words .................................................................................................................................... 65 SPF Validation ............................................................................................................................... 65 Anti-Virus Overview ....................................................................................................................... 65 UBEBlock ....................................................................................................................................... 66

Backup and restore ........................................................................................................................... 68 Disaster Planning ........................................................................................................................... 68 Backup and Restore ...................................................................................................................... 70

Utility Applications ............................................................................................................................. 71 FTGateArchive ............................................................................................................................... 71 FTGateIcon .................................................................................................................................... 72 FTGateUpdate ............................................................................................................................... 73 FTGateMonitor ............................................................................................................................... 73 FTGateLog ..................................................................................................................................... 73

AutoCluster ........................................................................................................................................ 74 Configuring AutoCluster ................................................................................................................. 74

Web Admin Interface ............................................................................................................................. 75 Web Admin Login .............................................................................................................................. 75 User Interface Guide ......................................................................................................................... 75

Saving changes ............................................................................................................................. 75 Adding an item ............................................................................................................................... 75 Deleting an item ............................................................................................................................. 75 Filtering a list .................................................................................................................................. 75 Selection lists ................................................................................................................................. 76 Start/Stop Enable/Disable .............................................................................................................. 76 Paging control ................................................................................................................................ 76

Menu Bar ........................................................................................................................................... 76 Navigation Panel ............................................................................................................................ 77

Access Control .................................................................................................................................. 77 General .............................................................................................................................................. 77

Information ..................................................................................................................................... 77 Log ................................................................................................................................................. 77 Activity ............................................................................................................................................ 77 Queues .......................................................................................................................................... 78

FTGateUsersGuide

vi

Statistics ......................................................................................................................................... 78 Archive ........................................................................................................................................... 78

Domains............................................................................................................................................. 79 Managing Domains ........................................................................................................................ 79 Local Domains ............................................................................................................................... 80 Remote Domains ........................................................................................................................... 91

Outbox ............................................................................................................................................... 94 Outbox ........................................................................................................................................... 94 Managing the Outbox..................................................................................................................... 95

Services ............................................................................................................................................. 95 Managing Services and Security Policies ...................................................................................... 95 Security Policy ............................................................................................................................... 95 Services ......................................................................................................................................... 98

Clients .............................................................................................................................................. 108 Managing Clients ......................................................................................................................... 108 SmartPop ..................................................................................................................................... 108 AutoCluster .................................................................................................................................. 113

Events .............................................................................................................................................. 114 Events .......................................................................................................................................... 114

Filters ............................................................................................................................................... 115 Greylist ......................................................................................................................................... 115 Routing ......................................................................................................................................... 115 Anti-Virus ..................................................................................................................................... 116 Quarantine ................................................................................................................................... 116 Filter Policies ................................................................................................................................ 116 Filter Policies ................................................................................................................................ 117

Configuration ................................................................................................................................... 119 Registration .................................................................................................................................. 119 System ......................................................................................................................................... 120 Administrators .............................................................................................................................. 120 Messages ..................................................................................................................................... 120 Spooler ......................................................................................................................................... 121 Logging ........................................................................................................................................ 121 Archiving ...................................................................................................................................... 122 DNS Servers ................................................................................................................................ 122 RBL Sites ..................................................................................................................................... 123 Network Profiles ........................................................................................................................... 123 Priority .......................................................................................................................................... 124 Auto Update ................................................................................................................................. 124 Proxy ............................................................................................................................................ 124

Utility ................................................................................................................................................ 124 Utilities ......................................................................................................................................... 124 Mailbox Import ............................................................................................................................. 124 List All Mailboxes ......................................................................................................................... 125 Mailbox Export ............................................................................................................................. 125 Mailbox Import1 ........................................................................................................................... 125

Groupware........................................................................................................................................... 127 Shared Folders ................................................................................................................................ 127

Why Use Shared Folders? ........................................................................................................... 127 Shared Folder Access.................................................................................................................. 127 Uses for Shared Folders .............................................................................................................. 127

Address Books ................................................................................................................................ 128 Mailing an address book: ............................................................................................................. 128 LDAP address book searches: .................................................................................................... 128

Calendar Overview .......................................................................................................................... 129 Shared Folder Overview .................................................................................................................. 129

White Papers ....................................................................................................................................... 131 White Papers ................................................................................................................................... 131 SPAM: Change is coming................................................................................................................ 131

Why is change needed? .............................................................................................................. 131

Table Of Contents

vii

A shift in approach ....................................................................................................................... 131 Cleaning up the junk .................................................................................................................... 132 White lists ..................................................................................................................................... 133 UbeBlock spam analysis .............................................................................................................. 133 Moving Forward ........................................................................................................................... 133 SmartPop ..................................................................................................................................... 134 The future ..................................................................................................................................... 134

Error Messages ................................................................................................................................... 135 Service Error Messages .................................................................................................................. 135 WebAdmin Login Messages ............................................................................................................ 137

Update History .................................................................................................................................... 139 FTGate History ................................................................................................................................ 139

Historical time line for FTGate: .................................................................................................... 139 FTGate2009 SR1 ............................................................................................................................ 140

Update 6.0.002 ............................................................................................................................ 140 Credits ................................................................................................................................................. 141 Glossary .............................................................................................................................................. 143 Index .................................................................................................................................................... 145

1

Introduction

Introduction

Welcome to FTGate

FTGate is the result of over ten years experience in the mail server market and represents the pinnacle of mail server performance and features. With extensive security, filtering, user management features, customer resource management and a comprehensive set of groupware features we feel that FTGate offers the best value possible. This manual is written to answer your questions regarding how to complete specific tasks and achieve different goals with FTGate. The main topics are listed below. Installation Using FTGate Filtering and Anti-spam

• System Requirements • Setting up domains and

mailboxes • Registering and Activating

Licences • Accessing SolSight Web • Access from the Internet • Migration • FTGate as an MX relay • FTGate as a DMZ server • Upgrading from a previous

version

• Logging Into FTGate • Forwarding Messages • Receiving Mail • Sending Mail • Greylisting Delays • Web Administration • Lost administrator

passwords • Security Policies • Backup and Restore • Service failed to start

• Overview • Filter Policies • Setting up junk filtering • Minimising Spam • Greylisting • Whitelisting • Whitehosting • Filter Rules • Blacklisting • UbeBlock Training • Quarantine

Web Administration Utilities Further Information • Web Admin Login • User Interface Guide • Menu Bar • Access Control • Managing Domains • Outbox • Managing Services and

Security Policies • Managing Clients

(SmartPop/Auto-Cluster) • Events

• FTGateArchive • FTGateIcon • FTGateUpdate • FTGateMonitor • FTGateLog

• Common Management Tasks

• FTGate Website • FTGate Training Videos

Licence Agreement

http://www.ftgate.com/�

http://www.ftgate.com/main/training/training.asp�

FTGateUsersGuide

2

THIS IS YOUR LICENCE AGREEMENT PLEASE READ IT AS YOU WILL BE BOUND BY ITS TERMS. ACKNOWLEDGMENT: By using FTGate Technology products you acknowledge that you have read this licence agreement, understand it, and agree to be bound by its terms and conditions. You also agree that the licence agreement is the complete and exclusive statement of agreement between the parties and supersedes all proposals or prior agreements, oral or written, and any other communications between the parties relating to the subject matter of the limited warranty. SOFTWARE LICENCE AGREEMENT SUBJECT OF AGREEMENT FTGate Technology hereby grants to the CUSTOMER in consideration of licence fees paid by the CUSTOMER, (and during any trial period in consideration of the CUSTOMER agreeing to try the product) a non-assignable, non-transferable, non-exclusive licence to use FTGate and other FTGate Technology products ("the Product") on a single network server accessed by multiple computers subject to the Terms and Conditions below. FTGate Technology reserve the right to enforce these licence conditions through specific software features. Copyright and other intellectual property rights in the Product shall at all times remain vested in FTGate Technology and the CUSTOMER's rights in the Product shall be limited to those of a user licensed under the terms of this Agreement, such use to be limited to the CUSTOMER's internal business purposes only. The CUSTOMER agrees not to use the Product beyond the trial licence period without paying the relevant fees thereupon arising. The Product contains a timing device which ensures that no such use can be made after such trial/demonstration period without payment. Where the CUSTOMER is supplied the Product via a distributor of FTGate Technology these terms and conditions of licence of the Product shall still apply as between FTGate Technology and the customer and are in addition to any contract terms between the distributor and the CUSTOMER. These terms may be modified by us from time to time and are in addition to any general terms about use of the Product on our web site, including without limitation information about email support and other matters. TERMS AND CONDITIONS (1) LIMITED WARRANTY The Product and accompanying written materials (including instructions for use and manuals and CD Roms, if any) are provided "as is" without warranty of any kind, to the fullest extent permitted by law. All terms implied by law, including without limitation as to satisfactory quality and fitness for purpose, which may by law be excluded or limited and liability in tort including without limitation for negligence and misrepresentation, are hereby excluded. Further, FTGate Technology does not warrant, guarantee, or make any representations regarding the use, or the results of use, of the Product in terms of correctness, accuracy, reliability, currentness, or otherwise. No oral or written information or advice given by FTGate Technology or its employees shall create a warranty or be otherwise actionable and the CUSTOMER may not rely on any such information or advice. If the Product is defective, FTGate Technology will not be responsible for any or all costs of necessary servicing, repair or correction. Neither FTGate Technology nor anyone else who has been involved in the creation, production or delivery of the Product shall be liable for any direct, indirect, consequential or incidental damages (including damages for loss of business profits, business interruption, loss of business information, and the like) arising out of the use or inability to use the Product even if FTGate Technology has been advised of the possibility of such damages. FTGate Technology shall in no circumstances be liable in any way for the content of any message or transmission sent using or made in connection with the Product. In any event FTGate Technology's liability to the CUSTOMER shall be limited to the value of the cost of the Product in relation to which a claim has arisen, or £250 if higher. The parties acknowledge that the Product is a low value product which will be used for crucial business functions and that the limitations and exclusions on liability in this Agreement reflect the

Introduction

3

price. The parties accept such limits are reasonable. The CUSTOMER shall indemnify and hold FTGate Technology harmless against all loss and liability, costs and damages, including legal fees on an indemnity basis, arising from any breach by the CUSTOMER of the terms of this Agreement or the licence of the Products or from any act or default of the CUSTOMER in relation to the Products which leads to loss or liability on the part of FTGate Technology. (2) COPYRIGHT AND TRADE MARKS The CUSTOMER shall not: a) use, copy, modify, merge, or transfer copies of the Product except as provided in this Agreement, b) reverse-assemble or reverse-compile the Product, save to the extent permitted by law, c) sub-license, loan, rent, lease, or assign the Product or any copy thereof, d) use the Product except as provided in this Agreement. The Product is the copyright of FTGate Technology. All intellectual property rights in the Product remain with FTGate Technology. FTGate Technology warrants that it has full rights to grant the licences contained in this Agreement and full authority to license the Product. Nothing in this Agreement shall give the CUSTOMER any intellectual property right in the Product. If any infringement of such copyright or other intellectual property rights in the Product or the Marks defined below, comes to the attention of the CUSTOMER it shall forthwith notify FTGate Technology by email. Should any portion of the Product be de-compiled, reverse-engineered, copied or duplicated, in breach of this clause, the CUSTOMER shall immediately notify FTGate Technology of the circumstances surrounding such event and shall assist FTGate Technology in enforcing its rights against any parties who are in violation of this Agreement. Permitted exceptions to the above are for normal back up or archival purposes. FTGate® is a registered trade mark of FTGate Technology FTGate Technology has also built up substantial goodwill in FTGate®, FTGate Technology™, Floosietek™, FTGateLite™, FTGateOffice™, FTGatePro™, FTGateRelay™, UbeBlock™, SolSight™ and their logos ("the Marks"). The CUSTOMER shall not use the Marks in any other colour or in combination with any material which (a) is not a Product or a description of a Product of FTGate Technology or (b) in any manner which may bring FTGate Technology into disrepute or damage its reputation or cause it to be legally liable in any way. (3) TERMINATION FTGate Technology may terminate this Agreement upon thirty days written notice if the CUSTOMER fails to comply with any of the terms and conditions of this Agreement. In the event of termination, the CUSTOMER shall immediately cease use of the Product and at its own expense, remove from its computers all copies (including on-line, back-up and archival) of the Product and destroy them. (4) NON-TRANSFERABLE LICENCE The CUSTOMER acknowledges that the Products are the sole property of FTGate Technology and agrees not to assign, sub-license or otherwise transfer the Products in any manner without prior written consent of FTGate Technology (5) BINDING AGREEMENT Upon acceptance of this Agreement by both parties, this Agreement shall constitute the entire Agreement between the parties and shall supersede all other oral or written agreements or communications between the parties. FTGate Technology shall not be bound by additional provisions or provisions at variance herewith that may appear in the CUSTOMER's acknowledgement, purchase order, or in any other communication between the CUSTOMER and FTGate Technology. (6) MODIFICATION/WAIVER

FTGateUsersGuide

4

FTGate Technology may modify the terms of this Agreement by email to the CUSTOMER or by posting a notice on its web site www.ftgate.com. No term or provision shall be deemed waived and no breach consented to unless such waiver or consent shall be in writing and signed by the party claimed to have waived or consented. (7) ASSIGNMENT The CUSTOMER shall not assign, sublicense, or otherwise transfer to any other party all or any part of this Agreement, any interest herein or any rights hereunder. (8) NOTICES All notices and other communications provided for or permitted under this Agreement shall be sufficient if contained in writing delivered by hand or registered certified mail or by facsimile addressed to the parties as set forth in this Agreement. Notification of critical errors concerning the Product should be communicated in writing to FTGate Technology by the other party. All such notices or communications shall be deemed received 2 working days after being sent. FTGate Technology reserves the right to communicate amendments to this agreement or all notices and other communications provided for or permitted under this Agreement by email to the other party. (9) SURVIVAL The CUSTOMER's obligations under paragraph (2) shall survive the termination of this Agreement. (10) SEVERABILITY If any provision of this Agreement shall be held void or unenforceable or contrary to English Law, such provision shall be deemed to have been excluded from this Agreement ab initio and shall not affect any other provision of this Agreement, the remainder of which shall be construed as if the excluded provision had never formed part of it. (11) DATA PROTECTION The CUSTOMER consents to its personal data being exported for processing abroad under the control of FTGate Technology and so that marketing emails on subjects of interest to the CUSTOMER being solely software products offered by FTGate Technology can be sent to the CUSTOMER. The CUSTOMER can notify FTGate Technology at any time to ensure such mailings are ceased. (12) THIRD PARTY RIGHTS No enforceable right is given or intended to be given by the parties to any third party, under this Agreement and the Contracts (Rights of Third Parties) Act 1999 shall not apply. (13) GOVERNING LAW This agreement will be governed by and construed in accordance with the laws of England and the parties hereby submit to the exclusive jurisdiction of the English courts. The place of performance is England. ACKNOWLEDGMENT By using the Product you acknowledge that you have read this licence agreement, understand it, and agree to be bound by its' terms and conditions. You also agree that the licence agreement is the complete and exclusive statement of agreement between the parties and supersedes all proposals or prior agreements, oral or written, and any other communications between the parties relating to the subject matter of the limited warranty

Copyright

Introduction

5

Copyright © 1996-2009 FTGate Technology Ltd. All rights reserved.

Information in this document is subject to change without notice. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means electronic or mechanical, including photocopying and recording for any purpose other than the purchaser's personal use, without the written permission of FTGate Technology Ltd.

FTGate Technology Ltd Abbey Lodge Station Road West Dereham Kings Lynn Norfolk PE33 9RR United Kingdom http://www.ftgate.com

Trademarks

FTGate®, FTGateOffice™, FTGatePro™ , FTGateLite™, FTGateRelay™ , UbeBlock™, SolSight™, Floosietek™ and FTGate Technology™ and their logos are trademarks or registered trademarks of FTGate Technology Ltd. in the UK, USA, the EC and other countries. Microsoft and Windows are registered trademarks of Microsoft corporation. Other brands and their products are trademarks of their respective holders and should be noted as such.

Disclaimer

The information in this document is subject to change without notice and is correct to the best of our knowledge at the time of publication. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose other than as part of the FTGate product, without express written consent of FTGate Technology Ltd. You are granted permission to print one copy of this document as part of the FTGate Product licence agreement.

Main Feature List

See Also • Groupware Features

Services

Feature PE ISP Relay SMTP / ESMTP

POP3 / APOP

IMAP4

LDAP

Proxy

Groupware Connector *

WebMail

WebAdmin

Monitor Port

* Replication only

FTGateUsersGuide

6

Security

Security PE ISP Relay Multiple IP based security policies

Share security policies among services

SSL / TLS

SMTP Authentication *

Comprehensive user based access controls

* Global setting only

Domains and Mailboxes

Feature PE ISP Relay Local user domains

Remote Relay Domains

User Mailboxes

Group Mailboxes

List Mailboxes

Domain Aliases

*

Mailbox Aliases

Mailbox Rules

Active Directory Support

User privilege options

User Mailboxes

Feature PE ISP Relay Multiple Folders

WebMail access

3 types of logon authentication

Loop protection

Hidden BCC control

Out of office automated message

User privilege control

Multiple shared folders (via IMAP/Web Mail)

Trashcan (via IMAP/WebMail)

Maximum message age controls

Mailbox quota controls

Message Tracking

Extensive mailbox rule/action controls

Group Mailboxes

Feature PE ISP Relay Round robin delivery option

Automatic message tracking options

Extensive mailbox rule controls

Privilege controls

Introduction

7

List Mailboxes

Feature PE ISP Relay Automated member management

Archiving

Moderation

Distribution list or BCC list

Reply address control

Distribution to external SQL database lists

Configuration notification messages

Configuration message signatures

Extensive mailbox rules

Monitoring

Feature PE ISP Relay 3 Logging levels

Searchable Log

Compressed Archive

Searchable Archive

Remote Monitor (activity + history)

Status Monitor

Queue Status

Server Statistics

Client Services

Feature PE ISP Relay SmartPop

AutoCluster

Outbox / Remote Domain

Feature PE ISP Relay LAN/Broadband and Dialup Support

4 types of delivery scheduling

Outbound connection limit controls

Custom Host name option

ISP or MX delivery options

Access to outbox queue for viewing/deletion

Flagged message delivery hold

Anti-Virus support

Feature PE ISP Relay Support for most 3rd party scanners

Scans inside Zip files

Scan and Quarantine or Scan and Delete

FTGateUsersGuide

8

Custom notification messages (or no notifications)

Purge Scripts from HTML messages

Anti-Spam and Message Filtering

Feature PE ISP Relay Multiple shared domain filter policies

One policy per domain or multiple domains per policy

Whitelist (Specific list and Contact Database)

Whitehost

Blacklist

Safe Word List

Filter content by word

Filter content by phrase

Filter attachments (Purge/Quarantine/Delete)

UBEBlock2 Filter

UBEBlock+ Filter*

Comprehensive Filter Rules and actions

Grey Listing

RBL Scanning

* Requires valid UPSP subscription

Other Features

Feature PE ISP Relay User configurable system messages

Extensive scripting support

Call external applications from within FTGate

Multiple DNS servers

Auto Update

Dynamic address routing

Delivery piping support

WebAdmin

Feature PE ISP Relay Comprehensive server administration

Multiple administrators

SSL support

IP based access controls

Groupware Features

FTGate Groupware edition has comprehensive groupware and customer resource management features. Access to its groupware features is available through WebMail, the Outlook Connector and other utilities.

Shared Folders

Introduction

9

Feature PE ISP Relay Multiple shared folders per user or group

User and group based permissions (read/write/create/delete/manage)

Accessed through WebMail and IMAP

Address Books

Feature PE ISP Relay Multiple Address Books per user or Group

Share options for each address book


Customer Tracking Options (Manual and Automatic)

Contact Notes

Calendars

Feature PE ISP Relay Multiple Calendars per user or group

Share options for each Calendar


Events and Appointments

Recurrent Events and Appointments

Mailed Reminders (self or specific address)

Instant Notifications (via SolSight Chat)

Task Lists

Feature PE ISP Relay Multiple Task Lists per user or group

Share options for each Task List


Recurrent Events and Appointments

Mailed Reminders (self or specific address)

Instant Notifications (via SolSight Chat)

FAQ (Frequently Asked Questions)

The FTGate FAQ is located in the support forums section of the FTGate website. Users are encouraged to view the forum topics and post any questions for which they are unable to find an answer. FTGate Forums and FAQ

http://www.ftgate.com/forums/2009/forum.asp?FORUM_ID=15�

FTGateUsersGuide

10

Product support

Product Support

As a valued customer of FTGate Technology we will endeavour to give you the best possible product support service. FTGate Technology as an outstanding reputation for product support and pride ourselves in the speed and accuracy of our support responses. Included with the purchase of FTGate is 12 months Upgrade Protection and Support Plan (UPSP)to ensure that your system will always have the latest updates available. Members of the UPSP are eligible for unlimited email support.

Supported Versions

Customers who have a valid UPSP and therefore are entitled to high quality support are also able to obtain the latest versions of the software without charge. Therefore FTGate Technology only support the latest version of FTGate available at the time of requesting support.

UPSP support options

FTGate users with a current UPSP can obtain support in the following manner: Email: [email protected] Online: http://www.ftgate.com/support/main.htm Please read the Support FAQ before contacting support

Support FAQ

The following guidelines will help us to give you the best possible service when you request support from the FTGate Technology team, and will result in your problem being resolved in the shortest time. If the problem is reproducible then please describe the method you use to reproduce it and please include a debug log file showing the problem. By following these guidelines you will make it easier for us to give you a fast solution to your issues.

UPSP Status

Before contacting support please check that your Upgrade Protection and Support Plan is up to date and that you have installed any current version updates and patches. Users who require support but do not have a valid UPSP will be required to renew their UPSP before support will be made available.

Support Forums

General issues will be dealt with most quickly by posting to the appropriate section of the support forum. The support forum is tied into our email support system and your postings will receive the same speed of response through the forums as they will through email. Please don't post to the forums and also send the same request by email. You can visit the forums here http://members.ftgate.com/forum/index.php.

Email support

http://members.ftgate.com/forum/index.php�

Introduction

11

When contacting support you will receive an automated response that includes useful information and a tracking code [e.g. [FST0412001]]. Please use the tracking code when replying to messages from support as it will help us to track your issue. Failure to do so will result in a fresh code and will most likely end up with a different support specialist who will ask you for information you may already have supplied. Support requests should be emailed to [email protected]

Debug Logging

Before sending messages to support please make sure you have set your logging level to debug (In Configuration click Logging, then in Details to log select Debug). If we ask for a log file then please locate the folder containing the logs (In Configuration click Logging, then find the path in Log path), then locate the file for the day of the incident [e.g. 20040101.ftlog] and then send the file to us. It is preferable to zip the file as it may contain content that will be rejected by our content filters and may be very large.

Sample Emails

If we ask for examples of an email then ideally we would like the message source file [e.g. f04030115595401C3.txt (zipped)] The reason for this is that forwarding a message with your mail client will often remove items from the header, or even reformat the message completely. This makes it difficult to give advice. When sending log files and messages please make sure that the log file actually contains the time period for which the messages or incident occurred. If the log and messages are mismatched there is no way that we will be able to help.

Screen shots

If you are asked for a screen shot, please follow this procedure. Go to the page that is requested. Press the Print Screen/SysRq key on the keyboard (this is the third from the right on the top row of most keyboards) Open Windows Paint. Click Edit/Paste Save the image to a file. Attach that file to the message that you send us. (You can zip the file if you wish).

Upgrade Protection and Support Plan

At FTGate Technology, we aim to provide the most secure, most advanced and feature-packed mail server available today. We constantly update FTGate and release new versions with the latest security features every few months. The internet is constantly evolving and consequently the Internet Standards are updated and changing all the time. New email security issues arise all the time, and FTGate evolves to deal with these developments, in order to give you the best protection for your network. The FTGate Upgrade Protection and Support Plan (UPSP) has been developed in response to customer requests for an inexpensive annual payment Plan which will keep their organisation always up to date with the latest version and enable them to continue to receive the highest possible quality of support.. Advantages of the UPSP:

mailto:[email protected]�

FTGateUsersGuide

12

• Continuous product support • Ability to keep pace with changes in internet standards • No unexpected costs when new versions are released • Access to new features without price restrictions • Maintaining the latest anti-virus, anti-spam and other security updates • Access to UBEBlock+ anti-spam Enhancements

If you maintain your FTGate UPSP, you will ensure that your organisation will always have the latest version of FTGate without any additional cost during the term. You will never again have to worry about unexpected costs of keeping your mail server up to date. With the initial purchase of your FTGate starter license, you will receive a full year of upgrade protection and support free of charge.

Lapsed UPSP

The Upgrade Protection Plan runs from 1 year from the date of the initial purchase of FTGate or renewal. If at the end of the UPSP period you decide not to renew the plan then you will no longer be eligible for technical support or any updates or patches. You will also be unable to use the UBEBlock+ anti-spam enhancements. After the renewal period has expired, a normal upgrade charge will apply. UPSP renewals will run from the expiry date of the original UPSP.

Contacting FTGate Technology

You can contact FTGate Technology in the following ways:

• Online Support pages. http://www.ftgate.com/main/support/ • email: [email protected] • Address:

FTGate Technology Limited. Abbey Lodge, Station Road, West Dereham, Kings Lynn, Norfolk. PE33 9RR. United Kingdom

• FAX: +44 01366 500560 • UK Company number: 02919324

http://www.ftgate.com/main/support/�


13

Installation

System Requirements

The exact system requirements for FTGate will depend on your application. A simple server handling low volumes of traffic and only being used as a POP3 server will need a much less demanding PC that one for 10,000 users with IMAP, WebMail and large volumes of mail. Thus, you should test FTGate on any particular system to see if will be capable of handling your specific requirements.

Recommended requirements:

Suitable for running very large number of users with IMAP and WebMail Windows 2000 SP4 Server or Windows 2003 SP2 Server Internet Explorer 6 or better Dual Intel Xeon 2.4 Ghz processors 1GB Ram 32 GB HD (depends on the volume of mail you have )

Minimum Requirements:

Suitable for POP3 access, IMAP, no WebMail, limited numbers of users. Windows 2000 SP4 Internet Explorer 6 or better Single PIII CPU 500Mhz 256MB Ram

Supported Systems

Windows 2000 Workstation Windows 2000 Server (all editions) Windows XP Pro/ (Home not recommended) Windows 2003 Server (All editions)

Virtual Machines

While FTGate has undergone some testing on virtual machine installations we cannot possibly test all versions of Windows with all possible virtual machines. For this reason we do not list any virtual machines as supported for any operating system. However, if you wish to test on a virtual machine we would recommend using the 30day trial version to verify that your particular instance works correctly. If your chosen combination of operating system and virtual machine does not work correctly then we recommend that you run FTGate on real hardware.

Web Browsers

FTGate requires use of a Web Browser that supports JavaScript and CSS2. We recommend: Internet Explorer 7 or later Firefox

FTGateUsersGuide

14

Safari

Outlook Connector

The FTGate Outlook connector will install in all versions of Outlook. However, only Outlook 2007 is recommended by FTGate Technology for use with the Outlook connector. On rare occasions users with Outlook 2003 and older may experience problems with the Outlook connector and we would recommend under those circumstances that you upgrade to Outlook 2007.

Browser Compatibility

FTGate uses Web2.0 technology to give its Web Mail and Web Administration users the best environment possible in which to work. This means that some older browsers are not supported and some a features will not be available on some browsers. Below is a list of browsers that have been tested and what features are available.

Browsers offering full support for all features

Internet Explorer V7.0+ Firefox V2.0+ Netscape V8.1.3 (IE rendering mode) Opera V9.2 Avant V10.0

Browsers offering limited support

Safari V2.0.4 - no Day/Week/Month view in calendaring

Allowing users to relay through your server

In order to relay through FTGate the users must be Authenticated , either using SMTP authentication or by being from an address that has been granted Automatic Authentication (AA flag) in the appropriate Security Policies. Thus you have two options:

1. Enable the users mail client to use SMTP authentication. With this set the default configuration of the Global Security Policy will allow relay.

2. Enter the users IP address or range into the Global Security Policy and set the PA (Permit Access), AA (Automatic Authentication) , AS (Authenticate by SMTP) and AR (Authenticated Relaying) flags.

Forwarding to remote users in the same domain

This topic discusses the solution to the following problem.

Installation

15

Company A has 3 POP3 mailboxes at their ISP. Two of the POP3 mailboxes are for specific users while the third is for all the other addresses in the domain. Thus the 3 mailboxes are called

1. [email protected] 2. [email protected] 3. [email protected]

Company A wants to have all mail for user1 and user2 delivered from their FTGate to the Internet so that their ISP can place the mail is the user1 or user2 mailbox. So they go to the options for domain a.com and set the undeliverable mail option to forward the mail to the internet (Domain List/a.com/undeliverable). They then configure SmartPop to collect mail from the [email protected] mailbox and deliver to the appropriate mailboxes.

Problem

An outside user sends a message to [email protected] and there is no mailbox for that address. SmartPop collect the message and delivers it to the domain, the domain sees it as being to an unknown address and sends it back to the internet which puts it back in the [email protected] mailbox thus causing a loop. This has two consequences, the message will go round in a loop until the ISP stops it, and if the mail were important but mis-addresses it would be lost.

Solution

The cause of the problem is that the domain is passing responsibility for the validity of the addresses to the ISP which does not have any way to know the validity of the addresses. The solution is for the administrator of FTGate to take responsibility and set the domain handling to either reject badly addressed mail or deliver it to a nominated local mailbox (Domain List/a.com/undeliverable).. However, that leaves the problem of local users being able to email [email protected] and [email protected], there is no local mailbox in the domain and their mail must be somehow given to the ISP for delivery. This is solved in the following manner. The administrator creates a new remote domain in FTGate called remote.users He sets the delivery options to be the same as for the Outbox settings. In Filter/Routes he creates the following routes from: * to: [email protected] route to: [email protected]|remote.users from: * to: [email protected] route to: [email protected]|remote.users This tells FTGate to handle mail for those users differently and any mail for them will go into the remote.users remote domain and will be sent to the ISP. Mail for unknown users will go into the local domain and be handled by the domain settings. This method prevents loops and allows the administrator to explicitly define which addresses are to be controlled locally and which remotely. Remote users can be added and removed by modifying the Filter/Route list.

Connecting multiple offices with FTGate

FTGateUsersGuide

16

This article will explain how to connect two (or more) offices together using FTGate products. This example assumes that both sites have broadband access. Joe Dobbit runs an Estate agency (dobbit.com) with offices in two towns. The central office is in London (ServerA) and a regional office is in Norfolk (ServerB). Joe wants to be able to have all his staff members email each other without having to set up sub-domains or remember where each staff member is located. He wants his email scanned for viruses and be able to archive all mail sent in and out of the offices.

The network

Joe has selected FTGate for both sites. The central office has 50 staff members and the regional office has 5, Helen, Steve, Sam, Michael and Graeme.

Central Office configuration (ServerA):

After configuring ServerA with the basic settings needed to send and receive email the following changes were made.

• A new mailbox called Serverb was created with a password of ServerB_pwd • The users at the regional office were added as aliases for Serverb. i.e. Helan, Steve, Sam,

Michael and Graeme • A new POP3 service was created on port 111 called pop_server_b. • The pop_server_b security policy was altered to the Default Global Security Policy • The pop_server_b access control was set to limit access to [email protected] • Domain List/Dobbit.com/Undeliverable was set to Reject • A suitable virus scanner was installed and anti-virus options were enabled. • Firewall access was granted on port 111 with a restriction that only the IP address of ServerB

can connect • Firewall access was granted on port 25 with a restiction that only the IP address of ServerB

can connect (if you already allow port 25 (SMTP) access from the Internet then this step can be omitted).

Regional Office configuration (ServerB):

After configuring the regional server to connect to the internet using a suitable schedule, the following changes were made:

Sending Mail

Outbox/Connection/Network Profile set to LAN Outbox/Connection/Delivery Mode set to Immediate Outbox/Delivery/Host1 set to ServerA;[email protected];ServerB_pwd (where ServerA is the IP address of ServerA) Outbox/Delivery/Delivery Route set to SMTP Hosts Domain List/Dobbit.com/Undeliverable was set to Forward to Internet

Receiving mail

In Server/Clients/Clients a new SmartPop account was created in the name of ServerA In the SmartPop options pages: Connection/Network Profile was set to LAN Connection/Host Name was set to the IP address of ServerA

Installation

17

Connection/Port was set to 111 Connection/Login was set to [email protected] Connection/Password was set to ServerB_pwd Settings/When online check every was set to 5m Delivery/Delivery Control was set to Automatic

Completion

With the above changes made the two offices were able to send email back and forth between them with the only delay being between the 5 minute collection period at the Regional Office. Further offices could be added in the same way as the first Regional Office. Now all the mail sent to and from the company are archived and scanned and Joe is very happy with his efficient mail system.

Registration Overview

In order to use FTGate beyond the 30 day trial period you are required to purchase and register a registration licence key. The licence key defines the number of mailboxes that can be used on the server.

Licence Types

The licence keys come in two types: • Starter Packs

These licence keys enable all the server functionality and set the number of mailboxes initially available on the system

• Additional Mailbox packs These licence keys add additional mailboxes to a server. However, a starter pack must already be installed on the server

Mailbox Count

When deciding on the number of mailboxes you will need you should add up the number of User and List mailboxes and also the number of remote domains. The total will be the licence size you require. e.g.

• 1 domain with 45 user mailboxes and 5 lists ( =50) Total = 50 mailboxes

• 1 domain with 10 mailboxes and 1 list (=11) 1 domain with 35 mailboxes and 3 lists (=38) 3 remote domains (=3) Total = 52 mailboxes

Tip:

To see how many mailboxes you are currently using 1. In Configuration, click Registration 2. In Allocated, read the current number of mailboxes used

See Also

• Registering and Activating Licences

General

Registering and Activating Licences

FTGateUsersGuide

18

Auto-activation

In order to activate your new licence for the first time you should do the following:

1. Login to WebAdmin 2. Click Configuration 3. Click Registration 4. If you have not already done so, enter your registration key into the box provided and click

add 5. Now click the Auto-Activate button 6. You are now presented with the activation page. 7. If this is the first time you have activated an FTGate product then you should enter your email

address and desired password for registration. If you have previously registered or activated an FTGate product you should use the existing details.

8. You should enter a server name and location, for example "mail server" and "main office". These are simply to act as a reference should you ever have more than one licence.

9. Finally click the Activate now over the internet button 10. The process should now be complete.

If you are unable to activate automatically this may be due to a firewall blocking access to our servers. In which case it is necessary to activate FTGate manually.

Manual-Activation

If you have previously registered an FTGate product then in order to activate Manually you must do the following.

1. Log into WebAdmin 2. Click Configuration 3. Click Registration 4. If you have not already done so, enter your registration key into the box provided and click

add 5. Note down the "Server serial number " SSN 6. Log into the members website ( https://members.ftgate.com ) 7. Click the Activate button and enter the SSN into the appropriate field 8. Press the OK button. 9. Copy the activation code from the members website 10. Go back to the WebAdmin/Configuration/Registration page 11. Put the activation code into the box to the right of the registration key 12. Click Add

Manual Registration and activation

If you have never previously registered an FTGate product and your FTGate server is unable to access our website for activation then you should do the following:

1. Log into WebAdmin and go to the Configuration/Registration page 2. If you have not already done so, enter your registration key into the box provided and click

add 3. Note down the "Server serial number" SSN 4. Go to https://members.ftgate.com/newaccount.asp and create a new account 5. After signing into the members website click on Add Licence 6. Enter the registration licence code (2 above) and add a description and location for your ease

of reference 7. Click Register server 8. Click Licences 9. Click Activate button and enter the SSN into the appropriate field and then press the ok button

https://members.ftgate.com/�

https://members.ftgate.com/newaccount.asp�

Installation

19

10. Note down or copy the activation code from the members website 11. Return to the WebAdmin/Configuration/Registration Page and put the activation code into

Activation Key box next to your licence key and click Add 12. Your licence should now be activated correctly.

Further Problems

These steps should allow full activation of our products. However, if you have any problems with activation, please contact FTGate support for further help.

Domains, Mailboxes and delivering mail

FTGate is primarily a mail server. Its task is to deliver mail between mailboxes and to send and receive email over the Internet. See the Mail Flow diagram for a graphical view of mail flow.

Local Mailboxes

eMail is sent between mailboxes using an address which consists of two parts, the local part which describes the users mailbox, and the domain part which describes the collection of mailboxes. Thus an email address of [email protected] has a local part (mailbox name) of bob and a domain part of mydomain.com. FTGate organises its mailboxes in the same way. To store mail for Bob you would create a new Local Domain called mydomain.com (See Creating Domains). This will store all the mailboxes for the domain. Then you would create a User Mailbox called bob into which all Bob's mail would be delivered (See Mailbox Overview, Creating a new User).

Sending Mail

Mail is sent to the internet through the Outbox , just as in a mail client. Normally you configure your mail client (Outlook, Eudora, Firebird etc) to send mail to FTGate. When you compose a message it goes into your mail clients outbox, which sends it to FTGate. FTGate then either delivers it to a local address or places it in its own outbox. Mail from the FTGate outbox is then sent to the internet so that the recipients mail server can deliver it to their own mailbox. The settings for the outbox will vary between ISP's and you should check with your ISP for the appropriate settings. See Sending Mail

Receiving Mail

FTGate can either receive mail using a protocol called SMTP or using a SmartPop client. SMTP is used when sending mail from your mail client to FTGate, and by FTGate when sending to the Internet. It can also be used by other servers to send mail directly to your server. However, this feature is dependent on your ISP and you should check with them to see if this feature is available. If your ISP does not support sending mail to you using SMTP, then you must use SmartPop to collect mail from the ISP's pop3 mailbox. FTGate can then deliver the mail to the local mailboxes. See Receiving Mail

FTGateUsersGuide

20

AutoCluster Overview

AutoCluster is a new feature in FTGate that expands the previously named Replication client. This advanced feature allows for the automatic configuration of a network of servers while allowing a pooled front end server array to manage the marshalling of connections between the servers. FTGate AutoCluster offers a powerful way in which an ISP can optimize their network and protect against the potential disaster of having a single point of failure disable their whole network. In an AutoClustered distributed cluster system no single failure will disable the whole network and you can be confident that you customers will see the best possible service that can be offered. This feature will be primary interest to ISPs or multi-domain corporate networks.

How AutoCluster works

Let us assume that an ISP has 3 servers that they are using to host the accounts for domain1.com, domain2.com and domain3.com. In a non AutoCluster network each member of each domain must configure their mail clients to connect to the specific IP address, as shown below. Diagram 1 - Non-AutoCluster network.

In this scenario all the filtering and processing of mail for a domain is performed by the specific server for that domain. If for some reason the IP of the server needs to change, or the mailboxes need to be moved to a different server with more capacity, then each client connecting to the server must update their mail client settings. If the server suffers a hardware failure then it will not be possible to replace it without network reconfiguration and customer disruption. Also if there is a requirement for backup MX servers then these must be configured for each server and if spam is to be reduced the filtering for each MX server configured individually.

Installation

21

If we replace the network above with an AutoCluster front end, things change considerably as shown in diagram 2. Diagram 2 - AutoCluster network

In an AutoCluster network each of the Relay Edition servers takes a duel role. Its primary role is to act as an MX relay for all the domains on the network and the secondary role is to act as a POP Proxy. This means that all the clients are configured to connect to a fixed IP list regardless of the server on which their mail is hosted. For example: A DNS entry could be made for mx.someisp.com with the IP addresses 195.224.16.148 and 195.224.16.149 Each mail client would then be configured to send and receive via mx.someisp.com, while the actual connections to the back end servers are controlled by the Relay Edition front end servers through the AutoCluster system. AutoCluster is further enhanced by a unique feature by which it can automatically configure itself for all the users in the network pool. Thus adding a new domain or user to any back end server causes all the relays to be updated with the user lists for each machine. This allows the Relay Edition servers to dynamically reject email for addresses that are not valid on the back end servers and thus protect against network overload caused by dictionary attacks and reduce the amount of spam that is accepted by the whole network. An additional advantage of the AutoCluster system is that the main process load of virus scanning can be performed on the front end servers thus adding another layer of protection to the back end servers.

Advantages of AutoCluster

• Distributed Clustering

FTGateUsersGuide

22

• Trivial installation • Dynamic auto configuration • Load sharing • Transparent to customer • Distributed spam reduction • No single point of failure • Low cost - 2 Relay Edition servers free with each ISP edition server

Access from the Internet

SMTP

By default SMTP is configured for non relay access from the Internet. External users can connect to FTGate and send to local users but will be unable to send back to the Internet. Thus by default FTGate cannot be used as an open relay by Spammers.

POP3/IMAP/LDAP

In order to allow Internet access to these services, change the service security policy for the service form the Default LAN Security Policy to the Global Security Policy.

WebMail

In order to allow access to WebMail for Internet users there are 3 choices. 1. You can create a new security policy for WebMail with the WAN address range set with only

the PA flag. This will allows Internet access to WebMail while restricting access to POP3 and IMAP. This is the recommended option.

2. Change the WebMail security policy to "Global Security Policy". This will allow all machines on the Internet to access WebMail. However, if you have the global policy set to verify addresses using RBL then each page access will have an RBL test performed on it. This can slow down access.

3. You can change the LAN security policy and check the PA checkbox for the WAN range. This will make ALL your services using this policy (POP3 and IMAP) available to all Internet users. This is not recommended if you wish to protect your POP3 and IMAP services.

WebAmin.

Change the WebAdmin security policy so that the PA flag is set in the WAN range. Note: For each of the above remember that for access to the Web Services to be available you will need the PA flag set, the BL flag clear and the HTTP service to be enabled in the security policy. In order to access any features of FTGate from the Internet you will require open ports in any firewall protecting your network. See Firewall ports

Firewall ports

To determine the ports you need open in your fire wall, review the service list in FTGate. This list shows the ports of all the service currently configured in FTGate. By default the main services are:

Installation

23

Service Port SMTP 25 POP3 110 SolSight WebMail

80

WebAdmin 8089 LDAP 389 IMAP 143 See Also: Service failed to start

Host-name configuration

The Outbox or Remote domain host-name is set in either the Outbox/Connection or the Remote Domain/Connection page. Your host-name should be the name that will be resolved by a reverse lookup for your ip address, or at the very least a valid name used in a DNS which resolves to your IP. For example : EHLO mx0.ftgate.com lookup mx0.ftgate.com = 195.224.16.225 lookup 195.224.16.225 = 225.128-255.16.224.195.in-addr.arpa = mx0.ftgate.com So it resolves to the same address both ways. This is the correct way to have a host defined when sending out using MX records. If both paths are not there then some servers will reject. To configure this in your DNS server you will have to contact your ISP/DNS hosting company. Some servers will not allow the host-name to be set to the IP address. In this case, if you have no valid reverse lookup host-name, you should use your domain name.

Network Storage and shared drives

In order to access network storage you will need to edit the FTGate service to run under a user account as follows:

1. Create a new network user account in the name of FTGATE_SERVER 2. On the network machine providing the storage create a network share for the files called

FTGATE_SPOOL 3. Go to the Service control panel on the FTGate machine and open the services control 4. Open the FTGate mail server service and change the startup details to specify the account

FTGATE_SERVER as specified in 1 5. The service control panel will then modify the account settings to allow appropriate access 6. Start the FTGate Service and open WebAdmin 7. In Configuration, click System 8. In Safe Mode, click Safe Mode 9. In Configuration, click Spooler 10. In Spool Path, enter \\computername\ftgate_spool 11. To move a domain onto the network drive go to the domains info page and

click the change button. Then specify the new storage path. Be sure to maintain the domain name. e.g.

FTGateUsersGuide

24

change c:\spool\mydomain.com to \\computername\ftgate_spool\mydomain.com

12. restart FTGate

Stopping and starting FTGate through the FTGate icon will not disrupt the use of the network drive. In the event of the network drive going off line FTGate will suspend itself to prevent incorrect operation and will require an administrator to restart it. It is STRONGLY recommended that the spool\folder remain on the same machine as FTGate. The spool\inbox, spool\ outbox and subfolders are heavily used during mail processing as there will be a significant drop in performance associated if these folders are stored remotely. Domain storage can be safely moved to a different drive.

Accessing SolSight Web

In order to access SolSight Web you should first make sure that the SolSight Web Mail service is started in the Services page of FTGate. You should then start your Web browser and enter the IP address of your server into the address box. This will take you to SolSight Web.

Accessing SolSight Web from the Internet.

If your server does not have a real internet address but is actually behind a NAT router then must configure the router to connect incoming connection to the FTGate machine on port 80 and open any Firewall ports that are needed. Please see your router users guide for details on how to do this. You must also alter the security policies to allow access to FTGate from the Internet. You should then enter the IP address of either you FTGate machine, or Router/Firewall into the browser in order to connect to SolSight Web.

FTGate behind a NAT router/firewall

When running FTGate behind a NAT router or firewall and has an IP address that is either 192.168.x.x or 10.x.x.x, then NAT device will appear to FTGate to be part of the local network address space. This will cause it to be granted automatic authentication rights, and hence it will be able to relay through the server. The solution to this problem is to simply go to the Global Security Policy and add the address of the router with only the PA flag set. e.g. If the NAT router has a local address of 192.168.1.15 we would enter:

Address 192.168.1.15 Mask 255.255.255.255 Flags PA

This will prevent relaying though your server. See Also:

Installation

25

• Security Policies • Relay Control and Authentication

Migration

Migration

In order to make it easier for an administrator to integrate FTGate into their network, FTGate offers two options for creating users without administrator interaction.

Active Directory Migration

The first option allows FTGate to create mailboxes automatically if the users login details match an entry in an Active Directory (AD) or NT SAM database. If the users login matches the AD entry then FTGate will create a mailbox and let the user have access to it.

POP3 Migration

This option allows FTGate to create and migrate user mailboxes from an existing POP3 server on your network, while permitting users to continue using mail in their normal way. See also

• Migrating Mail from an Existing POP3 server

Migrating Mail from an Existing POP3 server

FTGate offers a seamless way to transfer mail from your old mail server to your new FTGate mail server.

How it works

When a user connects to either the POP3 or IMAP port of FTGate, FTGate will connect to the old POP3 server and try to log into the server using the supplied username and password. If the login is successful then FTGate will create a new mailbox with that username and set the password and other options appropriately. The mailbox will have a Migration message added to it so that the user will see a friendly message telling them that their mail is being transferred. FTGate will then start a separate process which will download the mail from the users mailbox on their old system to the new mailbox in FTGate.

Mail for non migrated users

Mail arriving at FTGate for mailboxes that have been migrated will be delivered to the local mailbox as normal. However, mail for mailboxes that have not yet been migrated must be sent to the old server. To allow this the administrator must create a remote domain that will send the undeliverable mail to the old server. This domain should be called something like "migrate.domain". The local domain should then be configured such that mail for unknown users is piped to this domain.

During Migration

If the old mail server receives mail for a migrated user the user will not receive their mail. Thus it is recommended that periodically, during the migration period, the "Check Mailboxes" button is clicked. This will pull over any mail that is in the old system.

Finishing Migration

FTGateUsersGuide

26

When all the mailboxes have been migrated from the old system, the remote domain that delivers to the old system can be removed, the undeliverable options in the local domain can be set to reject mail and the Migration option can be disabled.

Migration Example:

A company (big-company.com) has an old POP3 mail server on an old PC that they wish to replace. They have purchased a new server PC and a copy of FTGate and wish to migrate their old mail to the new mail system. The following steps should be followed:

Server Configuration

1. Install FTGate on the new machine 2. Create a local domain big-company.com (Creating Domains) 3. Create a remote domain big-company.old set its delivery mode to deliver immediately and

set the delivery host to be the IP address of the old server. 4. In the big-company.com domain set the mail for unknown users to deliver to the following

email address *@big-company.com|big-company.old

5. In the big-company.com set the migration options to POP3 migration and enter the IP address of the old server and a Migration message.

Client Configuration

1. Change the users inbound and outbound mail settings to be the new server address.

Completing Migration

When all the users mailboxes have been transferred the final stages of Migration can be completed.

1. In the big-company.com domain, undeliverable mail options set the mail for unknown users to reject mail.

2. In the big-company.com domain, click the "Check mailboxes" button. This will pull over any mail that arrived in the old system between the start of migration and completion of migration

3. In the big-company.com domain turn off migration 4. Delete the big-company.old domain

Migration is now complete and the mailbox and mail have been moved to the new FTGate system

Moving to a new server

To migrate, or move, FTGate to another machine without losing any mail or needing to re-configure, follow these steps: Old Machine

1. Go to Configuration/System, note where FTGate stores the backup files. This is where you will find your latest backup file (.fdb)

2. Go to Configuration/Spooler, note where the Spool Path is located. This is where mail messages are stored.

3. Stop FTGate 4. Backup the Spool folder

This information is the Configuration (database) of FTGate as well as the mail, log and archive folders.

Installation

27

New Machine

1. Copy the latest backup database file from the old machine to the new 2. Run the latest installer and select to restore a backup 3. Select the backup from step 1 and finish the wizard 4. After FTGate starts, stop it again 5. Copy the spool folder from the old machine to the new machine

Note that if the drives differ then the spool location will be different. 6. Start FTGate

Log in to Web Admin and check that the settings are OK.

Relay

FTGate as an MX relay

The Internet DNS system allows mail servers to designate which servers will accept mail for a particular domain. Often it is desirable for an administrator to configure additional machines that will accept mail and hold the mail for later delivery to the main server. This permits the administrator to shut down the main server without the loss of incoming mail or in the event of a network problem, store mail until the problem can be resolved. FTGate permits two methods for configuring backup MX relays.

Administrator managed MX relay

In this type of relay the administrator manually configures FTGate with the domain names that will be stored and relayed, and the location to which messages will be delivered.

Configuring a manual MX relay

1. Install FTGate onto the relay server 2. Create a Remote Domain in the name of the Domain to be relayed (Creating Domains) 3. Configure the new domain to deliver mail to the primary server (Remote Domains)

Auto-Cluster Managed MX Relay

This relay configuration allows the relay server to download its settings directly from the primary FTGate server. Thus any changes to the primary server are reflected onto the relay server. This is especially useful for hosting companies or ISP's who have many domains to manage and many relay servers to configure. See Also:

• AutoCluster Overview

FTGate as a DMZ server

Many organizations use a firewall configured with a DMZ to act as a connection point between the LAN and the Internet. The DMZ allows services that must be available for connection to the Internet to be seperated from the LAN portion of the network and thus prevent direct access from the Internet to LAN machines.

FTGateUsersGuide

28

The use of the DMZ does raise the issue of how traffic will pass from the Internet to the LAN.

Using FTGate as a DMZ relay

FTGate can be placed in the DMZ and used to relay incoming mail from the Internet to a mail server (FTGate or otherwise) in the LAN. In this configuration the SMTP filters ( PTR , SPF , RBL , HELO/ELHO ) and Anti-Virus can be used to verify the source of the messages before they are passed to the LAN server. When used in this way there is no requirement for a direct connection between the Internet and the LAN mail server.

To configure FTGate as a DMZ relay

1. Install FTGate on a machine in the DMZ 2. Configure external mail systems to send to the FTGate machine (either from your ISP or via

your MX DNS records) 3. Create a new Remote Domain in the name of your domain (Creating

Domains) 4. Configure the new Domain to send to the LAN based server (Remote Domains) 5. Configure the LAN based server to send its outbound mail to FTGate 6. Configure the IP Security for the SMTP server to automatically authenticate the LAN server

(Relay Control and Authentication)

Diagram

Upgrade

Upgrading from a previous version

Please select the version you wish to upgrade from

• Upgrading from FTGateOffice or FTGatePro • Upgrading From FTGate4

Installation

29

Upgrading from older versions

The differences between the current version of FTGate and versions older than those listed above is not supported. Your options should be set manually.

Upgrading from FTGateOffice or FTGatePro

This guide will take you through the steps required to upgrade your FTGateOffice/FTGatePro system to FTGate2009. We recommend that in order to make your upgrade experience as easy as possible you read this guide carefully and watch the tutorial videos. Watch the upgrade video

Pre-Installation Notes

FTGate has a completely new UBEBlock system. Your old training settings and filters WILL NOT be imported. You should refer to the Filter Policies section for details on setting up and training your new system. FTGate will install a default filter policy. After installation you should check that the policy is suitable and make any required changes. FTGate has a completely new service security system based on security policies. See Security Policies FTGate requires that there be at least one local domain with one mailbox. This is used to control login to the server. You may have multiple administrators over different accounts but you MUST have at least one administrator. The system administrator login is the full email address of a user on the FTGate server. You need to make sure you have a valid username and password AND be a member of the System Administrators group in order to access WebAdmin (see Web Administration). If you delete all local accounts, or all administrator mailboxes, FTGate will enter safe mode and report the error "Any Admin override active". This allows any user to log in to the admin interface and configure a new administrator for the system. Robot mailboxes and Autoresponders have been removed and replaced by user mailboxes with mailbox rules (see Mailbox Rules) User Mailbox features for AutoResponse, Forwarding, Scripts and External Programs have been moved to Mailbox Rules. If you are installing on a Windows2000 server or Windows2003 servers you should stop the FTGate LDAP service as it will conflict with the Windows LDAP service. See LDAP If you are installing in Windows 2000 or Windows 2003 server then you will need to stop the Windows "Simple Mail Transport Protocol" in the Windows Service Manager. Review the client sign in change information: Logging Into FTGate

Upgrade Procedure

To perform the upgrade you should run the FTGate installer and when prompted select and FTGateOffice or FTGatePro backup database and allow the wizard to complete. Watch the upgrade video

http://www.ftgate.com/main/training/training.asp?video=upgrading.mp4�


FTGateUsersGuide

30

Post-Installation

The following items should be checked post installation

1. FTGate will reboot after the install and will begin to function. Should you wish to review all the new settings with FTGate disabled you should go to Configuration/System and click the Safe Mode button. FTGate can be restarted by click the Restart button which will return FTGate to a functioning mode.

2. Security Policies: Check that the 3 security policies contain the correct IP address ranges for your network and that the options enabled are correct for your needs.

3. Filter Policies: Check that the settings are acceptable and define UBEBlock training users. Seed the training database with good messages. See UbeBlock Training UbeBlock Training Notes

4. The root.login domain is only used to configure an administrator for log in purposes, it uses one mailbox and can either be deleted or renamed. If it is to be deleted then a new administrator should be added to the Configuration/Administrators section.

5. User Mail clients: In FTGate all Sign In names are the full email address. Thus your users will have to alter their account settings in their mail clients and add the domain name to the end of their login name. This is required to enforce security privileges.

6. All User Accounts except the administrator will all be using the Default User Privileges. You may wish to alter the privilege settings to control various access rights.

7. Check the Outbox configuration. Specifically check: Outbox/Connection/Hostname is set to either your host name or domain name (Hostname configuration) Outbox/Delivery/HOST 1 includes your ISP login if required (Outbound SMTP Authentication)

At this stage you should have a functioning server with all the new features of FTGate.

Upgrading From FTGate4

The upgrade from FTGate4 is very simple: Watch the setup video After installation you should:

1. Add a new filter rule to your filter policy to trigger on UBEBlock+ spam detection 2. Add a new filter rule to your filter policy to trigger on Stock Spam detection


31

Using FTGate

Common Tasks

Also see: Troubleshooting

General

• Understanding Domains, Mailboxes and delivering mail • Mail Flow diagram • Problems logging into FTGate: See Logging Into FTGate (password errors)

Sending/Receiving via the Internet

• Configuring FTGate to allow access from the Internet See Access from the Internet • Configuring FTGate to collect mail from an ISP POP3 mailbox. See SmartPop • Configuring FTGate to send mail to the Internet. See Sending Mail • Configuring FTGate to Authenticate with your ISP. See Outbound SMTP Authentication

Managing Mailboxes and Domains

• Creating new mailboxes. See Mailbox Overview • Adding an alias for a mailbox. See Creating a Mailbox Alias • Creating a new Domain. See Domain Overview

Managing Filters

• Configuring the FTGate spam filters: See UbeBlock Training • Bypassing the filter for good addresses: See White List • Bypassing the filters for known good words: See Safe Words • Banning addresses: See Black List • Banning words/Phrases from messages: See Word Filter, Phrase Filter • Banning attachment types: See Attachment Filter • Handling spam: See Filter Rules, UbeBlock Rating, UbeBlock Training,

UbeBlock Training Notes • Blocking Viruses: See Anti-Virus Overview

Backup and Restore

• Backup and Restore • Moving to a new server

Trouble shooting

This page lists some of the common user problems and their resolution. If the problem is not listed on this page then please check the index for any relevant material. This document also has a search function.

FTGateUsersGuide

32

If you have still been unable to find the answer then please visit the support forums or send an email to FTGate Support.

1. UbeBlock is not blocking spam emails 2. I have upgraded from FTGateOffice/Pro and my users cannot login 3. A service will not start and reports "The specified address is already in use" 4. SSL Certificates 5. Unable to send to some domains 6. Messages to Hotmail and other domains are disappearing 7. Server EHLO message rejected with syntax error 8. How do I move FTGate to another machine 9. How do I backup FTGate 10. My users are getting a relaying denied error 11. I cant remember my WebAdmin user name or password, or I have deleted the admin account 12. What firewall ports do I need to open 13. How do I share folders 14. SmartPop delivery issues 15. "Bulk sends not allowed" error 16. "Message size exceeds administrative limit" error

UbeBlock is not blocking the spam emails

At installation the UBEBlock processor is disabled. This is because the basic training of UBEBlock must be performed before it will work correctly and many users were not training it at all. To enable UBEBlock rating of the messages perform the initial UbeBlock Training and then enable the filtering in the filter policy options page.

I have just upgraded from FTGateOffice/Pro an my users cannot login

See: Logging Into FTGate (password errors)

A service will not start and reports "The specified address is already in use."

This is usually seen in the SMTP , LDAP or WebMail service but can be seen occasionally in the other services. It is caused by another program running and using those ports. To resolve the issue the running program must be located and stopped or the service moved to another port.

• SMTP: The usual cause is the Microsoft Simple Mail Transport Service. To resolve this error open the windows service control panel, stop the service and set its startup mode to disabled.

• WebMail: This is usually cause by IIS. If you are not using the PC as a web server then you should open the windows service control panel and then stop and disable the Web Publishing Service. Additional information is available here.

• LDAP: This is usually a problem on Windows 2003 servers because the Active Directory service uses LDAP. In this case you must change the port used by the FTGate LDAP service and alter the mail clients to use the new port.

SSL certificates

See: SSL self signed certificates

http://members.ftgate.com/f4/default.asp�


http://members.ftgate.com/f4/topic.asp?TOPIC_ID=7010�

Using FTGate

33

I am unable to send to some domains, the mail sits in the outbox.

Many service providers will not accept mail from servers that have an invalid or incorrect hostname configured for the HELO/EHLO SMTP command (Outbox/Connection). Your hostname should be the name that will be resolved by a reverse lookup for your ip address, or at the very least a valid name used in a DNS which resolves to your IP. For example :

EHLO mx0.ftgate.com lookup mx0.ftgate.com = 195.224.16.225 lookup 195.224.16.225 = 225.128-255.16.224.195.in-addr.arpa = mx0.ftgate.com

So it resolves to the same address both ways. This is the correct way to have a host defined when sending out using MX records. If both paths are not there then some servers will reject. To configure this you will have to contact your ISP/DNS hosting company.

My messages to Hotmail are disappearing

This is the same cause as 3 above, however, Hotmail simply delete the messages without notification to the server or recipient.

My server is having its EHLO command rejected with a syntax error message

Users of AVG anti-virus and Cisco PIX firewalls may have problems as these two products can be configured to modify the EHLO/HELO message. They replace the EHLO command with XXXX which causes the error. You must reconfigure these devices to allow the command through correctly.

How do I move FTGate to another machine

See: Moving to a new server

How do I backup FTGate

See: Backup and Restore

My users are getting a relaying denied error

See: Allowing users to relay through your server

I cant remember my WebAdmin user name or password

See: Lost administrator passwords

What firewall ports do I need to open?

See: Firewall ports

FTGateUsersGuide

34

How do I share folders and keep the mail on the server.

In order to share mail folders you must reconfigure your client application to connect to FTGate using the IMAP protocol. The IMAP protocol stores the messages on the server with the client being used to read/create messages but not to remove them from the server. The protocol allows for multiple folders and access to shared folders. This also allows Outlook users to stop using PST files on the local PC and allows an administrator to centralise the backup of mail.

SmartPop delivery issues

If you are having problems with SmartPop deliveries please check the following before requesting support:

1. SmartPop overview: SmartPop 2. Reasons why problems may exist: SmartPop limitations 3. Duplicate delivery of messages: SmartPop Duplicate Delivery 4. General delivery problems: SmartPop delivery problems

When I try to send mail to an Outlook list I get a Bulk sends not allowed error

This is caused by the number of addresses in the messages header exceeding the limit set by the administrator. You can change this in the SMTP tab of the global security policy together with the settings for the maximum number of recipients for a message. The bulk sends rejection relates specifically to the number of addresses appearing the in To, and CC lines of the message header. If you get this message it is because the email address of everyone you are sending to is in the message header. Thus if you send to 35 people, every person who receives the message gets the email address of the other 34. If you are in the UK or Europe we would strongly recommend that you do not change this setting. Unless you have permission from each of them to distribute their details you will be breaking the UK/EU data protection act and could face a heavy fine. We would recommend moving the addresses into an FTGate mailing list, or contact list. These will send the message as a BCC so none of the recipients get the details of any of the others.

My users are getting the message 'Message size exceeds administrative limit'

This limit is set in the security policy being used by the SMTP service in the SMTP tab (Services/SMTP Service/Security, click on the Edit Service Policy Settings link).

General

Logging Into FTGate

In order to protect your valuable data from brute force sign in attacks FTGate requires that all sign in attempts use the full email address of the user. Failure to do this will result in mail clients reporting password errors. Tip:

If you previously signed in using the name "fred" and your domain is "mydomain.com" you will now be required to sign in using "[email protected]"

Tip:

If your email client cannot use the @ character for SMTP and POP3 login then you should

Using FTGate

35

use the # character instead.

POP3 Low security option

You can maintain user login with just the username by enabling the "Low Security" option in the POP3 service settings. This option is available if there is only one local domain configured. Thus users with a "root.login" domain must delete that domain before "low security" login can be performed. With the "low security" option selected users can still use the high security login described in the above paragraph. This allows users to be transferred to the new high security login before the option is disabled. Tip:

If you delete the root.login domain that was created by the installer then you will need to define a new administrator. See Web Administration

Mail Flow

Mail is received by FTGate via either SMTP or SmartPop. It is then processed through the spooler, virus and spam filters before being passed to either a local domain and mailbox (awaiting user collection), the Outbox (to be sent to the internet), or a Remote Domain (to be sent to a different private server). This diagram shows how mail flows through FTGate.

FTGateUsersGuide

36

Undeliverable Mail

It is common for mail to be sent to a domain that is either incorrectly addressed or deliberately sent to a random user name. Local Domains allow the administrator to determine what action should be taken with incorrectly addressed mail.

Available options

1. Reject the message and send a customised response 2. Send the message to the postmaster 3. Send the message to the postmaster as an attachment 4. Forward the message to the internet 5. Forward the message to another address

Note:

Forward the message to the internet (Option 4) will return the message to the internet as if it were being sent from your server. This has the potential to cause a loop as your ISP may deliver the message back to FTGate. This option should be used with caution.

Note:

If the Undeliverable Mail action is set to Reject, and mail is delivered to the server using

Using FTGate

37

SMTP , then the message will be rejected by the SMTP server and the rejection message will not be sent. The message sent to the originator will depend on the settings of the server sending to FTGate over which you have no control.

Connection Types

There are three ways that FTGate can be connected to the Internet:

1. [LAN] Via a permanent LAN based connection (Broadband, Leased Line, Fibre etc)

2. [Proxy/Router] Via an external Router Modem or Proxy device

3. Profile Via a dial up modem installed in the PC

Each of these options is supported through the selection of the appropriate profile in the Configuration/Network page. See also:

• Dialling the Internet • Sending Mail • Receiving Mail

IMAP Considerations

FTGate has been tested with the following IMAP clients:

Client IDLE Handles NIL messages (i)

NOOP Updates

XTRASH (ii)

Outlook Express X Deleted notification

N/A X

Outlook 2002/XP

X Deleted Notification

N/A X

KMail X X X Ximian Evolution Error dialog X Error Dialog

The Bat! X X N/A Eudora X X

Thunderbird X X X Mulberry X X Nil messages

(i) Handling of Nil Messages The IMAP protocol requires that a server does not delete any message from the server until all connected clients have been notified of its removal. This is to permit clients to request the message contents of deleted messages. There is no facility in IMAP to tell a client that a message has been deleted and thus the request cannot be honoured. Thus the following is correct using the IMAP protocol:

1. Client A connects to a folder, there are 200 messages 2. Client B and C connect to the same folder

All clients see 200 messages 3. All clients use FETCH and STORE but never do an operation that allows notification of

expunged messages, or at least not often enough to count. 4. Client A deletes the first 100 messages 5. Client B deletes the second 100 messages 6. Now client B, after expunging, gets told that the first 100 AND the second 100 are deleted

FTGateUsersGuide

38

7. So the three clients now see the following: Client C sees 200 messages and can access them all Client A Sees 100 messages and can access those 100 Client B sees no messages and cannot access any

8. This can persist for an indefinite period of time FTGate Technology believe that this is contrary to the whole concept of shared folders, and that there is little point in sharing a folder if all the clients can potentially have different views of it. Thus FTGate will remove messages from the server at the time that the FIRST client EXPUNGEs the message. This may result in clients that do not synchronize frequently showing either blank content or an error message (see table for handling). Clients that support the IDLE command will not suffer from any of these problems and all views of the folder should remain concurrently correct. (ii) Handling of XTRASH FTGate supports an XTRASH IMAP extension that is an experimental FTGate only extension. Configuration of this option is only available through WebAdmin , WebMail and SolSight. There is no third party support for this extension expected. This extension modified the standard IMAP handling such that rather than "flag as delete and then expunge", FTGate will move messages that are marked as deleted in to a specified trash folder. It will then Expunge the folder, removing the messages. All connected clients will be notified of the changes when possible, see (i) above. Limitations: Mail in shared folder will not be subjected to trash can operation, these messages will default to the IMAP delete/expunge model as there is no shared trash can. (iia) The XTRASH command The XTRASH command will be announced by the text XTRASH on the CAPABILITY line of the IMAP server response. C: CAPABILITY S: OK CAPABILITY .... XTRASH ... Obtaining the current trash folder C: XTRASH S: * XTRASH "current trash folder" S: OK XTRASH COMPLETED Setting/disabling the current trash folder C: XSETTRASH "new trash folder" S: * XTRASH "current trash folder" S: OK XSETTRASH COMPLETED Setting the new trash folder to a blank string will disable trashcan operation.

Forwarding Messages

When messages arrive in a users mailbox it is often required that the message is sent or copied to another address. This is performed with mailbox Inbox Rules. The following steps are used to create a forwarding rule.

Using FTGate

39

1. Open the users mailbox in WebAdmin or WebMail 2. Go to the Inbox Rules page 3. Type the name of the new rule e.g. forwarding to joe 4. Click add 5. Click on the new rule 6. Check the apply to all messages box 7. Change to the Actions tab 8. Check Forward to the following address 9. Enter the required address e.g. [email protected] 10. If you want to have the message deleted after forwarding, check the delete message option 11. Check the Rule Enabled option 12. Click Save

This rule will forward all mail arriving in the mailbox to joes email address.

Macro Expansion

FTGate includes some expandable macros that can be used to make the message body specific to a particular message condition or mailbox as follows: Details from the original message:

$SUBJECT$ $FROMADDRESS$ $TOADDRESS$" $FROMNAME$" $TONAME$" $RCPTADDR$" $SUBJECT$" $HEADER$"

Virus message:

$FILE$ $VIRUS$

Mailbox

$MAILBOX$ $NAME$ $ADDRESS$ $COMMONNAME$

Group mailbox tracking message:

$TRACKING$ List mailbox messages when in distribution list mode

$NAME$ $ADDRESS$

Anti-Spoofing

FTGate implements strong anti-spoofing features. This means that it will not accept mail from any address that it hosts unless the connection is authenticated by SMTP or the Security Policy AA flag.

450 4.7.1 Please authenticate and try again (#3.21)

If a user gets this error then they must enable SMTP authentication in their mail client.

FTGateUsersGuide

40

If an automated machine causes this error then add the address of the sending machine to the Global Security Policy with the following options: Address: whatever Mask: 255.255.255.255 Flags: PA and AA If neither of the above are appropriate then you must enable spoofing in the security policy options. See Also:

• Security Policy Options

Send and Receive

Receiving Mail

Mail is received by FTGate in one of two ways; SMTP or SmartPop .

SMTP

SMTP is used to send mail from your mail client to the mail server and then from the mail server to the ISP or the rest of the internet. It is a protocol designed for sending messages between two servers and as such, if you can have your mail delivered to your server using SMTP, this will offer the best performance and reliability. The SMTP service can also be used to filter mail to prevent UBE mail entering your server. See Also:

• Managing Services and Security Policies • Outbox • Remote Domains • RBL Sites • SPF

SmartPop

SmartPop is a POP3 client that can connect to a remote ISP POP3 mailbox and then download and deliver mail. See Also:

• SmartPop

Outbound SMTP Auth

Outbound SMTP authentication is achieved by extending the ISP SMTP host entry in either the Outbox /Delivery page or a Remote Domain /Delivery page. Outbound authentication is not available when using MX delivery options. The format is:

host address[:host port][; login id;password] e.g. mail.isp.com:25;fred;mypassword

bracketed items are optional.

Using FTGate

41

Sending Mail

FTGate sends outbound mail using SMTP /ESMTP. Mail that is intended to be delivered to general recipients on the internet is sent through the Outbox . Mail for specific domains that are not hosted can be sent through a Remote Domain . See Also:

• Outbox • Remote Domains • Outbound SMTP Authentication

SmartPop

FTGate includes SmartPop which is a technology which allows FTGate to collect mail from an ISP's POP3 mailbox and be able to correctly deliver almost any message without the user needing to make any configuration choices beyond turning SmartPop on. When delivering messages in its automatic mode SmartPop can do the following:

1. Deliver messages for users who have mailboxes directly to them and prevent duplicates from being delivered.

2. Deliver mail for unknown users of a local domain in accordance with the configured domain settings which includes bouncing the email with an undeliverable report.

3. Return incorrectly addressed email as undeliverable or send it to a special recipient. FTGate also includes the option to bounce mail that is too large, thus preventing FTGate from using up too much bandwidth and telling the original sender why their message was not delivered. These changes now give SmartPop the same flexibility of delivery as SMTP . See Also

• Configuring SmartPop • Delivering SmartPop mail to a single user • Delivering SmartPop mail to domain users • SmartPop limitations

Signatures/Disclaimers

A domain wide signature can be added to all outgoing mail. To configure the signature you should go to the Domain/Signature property page, enter a signature and enable the signature. Signatures will be attached to the first text and first HTML section in a message. Signatures will only be applied to messages that go through the outbox . Messages to other local domains or remote domains will not have the signatures applied. See:Domains/General

Remote Domains

A Remote Domain functions as an Outbox but contains mail only for a specific domain. To create a remote domain see Creating Domains.

FTGateUsersGuide

42

To configure a Remote Domain for direct delivery to an IP Address

If a dial up profile is to be used see Dialling the Internet

1. In Domain List, click Domains 2. In Hosted Domains, click on the appropriate Domain Name 3. In Connection Options / Network Profile, select the required profile, [LAN] or

[Proxy/Router] 4. In Delivery Mode, select Immediately 5. In Host name, enter your Domain Name 6. Click Apply 7. Click Delivery 8. In Delivery Route, select SMTP Hosts 9. In SMTP Hosts / Host1, enter the IP address of the remote host 10. Click Apply

Tip:

The host name can consist of several parts, some of which are optional: host address[:port][; login id;password]

This shows that you must specify the host address and that you can optionally supply a port and login information. e.g. If you wished to connect to a server called mail.me.com on port 345 you would specify a host name of

mail.me.com:345

To connect to the same server and login as '[email protected]' with a password of 'eggs' you would specify

mail.me.com:345;[email protected];eggs

To configure Remote Domain for direct delivery via MX Records

MX delivery is not recommended over dial up connections (*). A suitable DNS server will be required for correct delivery of mail (DNS).

1. Select a domain 2. In Connection Options / Network Profile, select [LAN] or [Proxy/Router] 3. In Delivery Mode, select Immediately 4. In Host name, enter your Domain Name (**) 5. Click Apply 6. Click Delivery 7. In Delivery Route, select MX Hosts 8. In If delivery fails, select Hold mail in queue for later delivery 9. Click Apply

NOTES * MANY ISPS WILL NOT PERMIT MX DELIVERY THROUGH THEIR NETWORK DUE TO MISUSE AS A SOURCE OF SPAM. ** MANY SERVERS WILL NOT ACCEPT MAIL FROM SERVERS WITH AN INCORRECT HOST NAME.

Greylisting Delays

If you have reached this page due to an error return on a message that you have sent then you should contact your hosting server, or network advisor and request that they fix their mail system.

Using FTGate

43

Your message has been bounced in error by your outbound mail server which should have, in accordance with RFC2821, queued your message for retry. The response code 450-4.7.1 Server busy please try again later is an instruction to your outbound mail system that there is no error in transmission but the receiving server is currently unable to process the request and it should try again after a short delay, typically around 30 minutes (as recommended by RFC2821). This response in not an error code (which would start with a 5) but a temporary delay caused by Greylisting. THIS IS NOT AN ERROR OF THE RECEIVING SERVER. Additional references: Greylisting in FTGate For the original Greylisting whitepaper please see this whitepaper by Evan Harris: http://projects.puremagic.com/greylisting/whitepaper.html Additional information is available here: http://www.greylisting.org/ Wiki: http://en.wikipedia.org/wiki/Greylisting

Accessing FTGate from the Internet

FTGate is by default configured to allow SMTP access from the internet. There are two ways that FTGate can be connected to the Internet:

FTGate has a fixed valid internet address

In this case you should be able to access FTGate from the internet using either the IP address of FTGate or its name. e.g. 195.124.124.189 or myserver.mydomain.com If external servers are unable to access FTGate on port 25 then you should check the following:

1. Your network firewall is open on port 25 for external connections 2. Your Windows firewall is open on port 25 (it is better to add an exclusion for FTGate on all

ports). Note: Each security policy has a dedicated address range for the internet that is listed as WAN. This contains the settings used when FTGate is accessed by any machine whose IP address is not listed in any other range.

FTGate is behind a NAT router

If your FTGate machine is behind a NAT router, and has an IP address that is either 192.168.x.x or 10.x.x.x, then you then you should check the following:

http://projects.puremagic.com/greylisting/whitepaper.html�

http://www.greylisting.org/�

http://en.wikipedia.org/wiki/Greylisting�

FTGateUsersGuide

44

1. Your NAT router has port forwarding enabled on port 25 from the Internet to the LAN address

of FTGate. 2. Your Network Router/firewall is open on port 25 for external connections 3. Your Windows firewall is open on port 25 (it is better to add an exclusion for FTGate on all

ports). If you are behind a NAT firewall then there are additional steps you should take with FTGate to prevent your server becoming an open relay. You should determine the NAT IP address of your NAT router (which has the port forwarding) and add it to the "Global Security Policy" with only the PA flag set. e.g. 192.168.1.124/255.255.255.255 with PA flag set See Also:

• FTGate behind a NAT router/firewall

Accessing other services from the Internet

If you wish to access POP3/IMAP/WebMail from the internet then you must change the security policy used by the appropriate service to be the "Global security Policy"

Getting the mail to FTGate

After you have configured FTGate and your network to allow connections to FTGate you must then arrange for mail to be delivered to FTGate directly from other servers:

1. You must verify with your ISP that they allow delivery of mail from the Internet to your address, some ISP's do not permit mail to be delivered directly to your server.

2. Your ISP will deliver all the mail that is for your domain to your address or

3. You must update your DNS server to include MX records specifying the IP address of FTGate is to handle mail for your domain. You should contact you DNS hosting company or ISP regarding this.

Note: If your ISP is delivering mail from their machines directly to your machine then you cannot use the options for Greylisting, SPF Validation, or PTR validation.

Management

Web Administration

In order to use Web Administration a user must have an account in FTGate and that account must be a member of the system administrators. The system administrators are defined on the Configuration/Administrators page Tip:

If you enter a group User ID , then all members of that group will also have access to the WebAdmin Interface.

Tip:

If you delete an administrators mailbox they lose all access rights and will no longer be an

Using FTGate

45

administrator. Creating a new mailbox in the name of the old administrator will not restore their rights as the mailbox will have a different security id.

See Also:

• Access Control Lists (ACL)

Activating a Licence Key

NOTE: ACTIVATING A LICENCE KEY ON TWO SERVERS IS A VIOLATION OF THE EULA AND FTGATE TECHNOLOGY RESERVE THE RIGHT TO DISABLE A SERVER SHOULD ITS LICENCE BE ACTIVATED ON A DIFFERENT SERVER. Activation of FTGate is a requirement of using this software. The procedure is simple using a Wizard. If there are any problems during activation, then please contact [email protected] describing your problem and including a copy of your log file and your registration licence key. See Also:


Activation FAQ

• When do I need to activate? You need to activate an FTGate server when you install it for the first time, move FTGate to a different machine or re-install the operating system.

• How do I reactivate after moving the server? To reactivate your server on the new hardware you should follow the original activation procedure.

• Can I reactivate under a different account/email address? No once a licence has been activated it cannot be moved to a different registered user. However, you can alter your registration settings including the email address and password from the members wesbite.

• Do I need to contact FTGate Technology in order to reactivate? There is no limit to the number of auto activations you can make. However, You can only reactivate manually 3 times without having to contact FTGate Technology. This allows a system admin to create a new server in the event of a severe failure. However, after the third activation you will have to contact us to reset the system for you.

• What can I do if I have lost my members account password? If you visit the members website there is a link for lost passwords. Following this link will cause the password to be emailed to your account.

• My server has stopped what can I do? If you stop and restart FTGate it will run for one hour before stopping, this will allow you to continue while you activate the server.

Lost administrator passwords

When the software was installed one of the email accounts created on the server was set to be the administrator. In order to log into the WebAdmin service you need to use the email address and password of the account that was set as the administrator. In the event that the none of the administrators can remember their passwords it is necessary to override the login protection of WebAdmin. In order to prevent this being a trivial action, and thus rendering the use of the user account and password meaningless it is necessary to have the user

http://members.ftgate.com/�

FTGateUsersGuide

46

take an action that only a system administrator can perform, thus ensuring that the person making the changes is actually authorised to do so.

Login Security Override

To override the security in FTGate you should:

1. Click Start 2. Click Run 3. Type RegEdit 4. Click Enter 5. Open the tree HKEY_LOCAL_MACHINE/SOFTWARE/FTGate Technology/FTGate 6. Right click in the right hand pane and create a new DWORD entry called "AnyLogin" with the

value of 1 7. Exit RegEdit 8. Restart FTGate

FTGate will then start up in suspended mode with the Admin login security disabled, you can click sign in and you will be allowed in. We recommend that the first priority is to go to the Configuration/Administration page and enter the email address of a new administrator into the list. The new administrator will then be able to log into WebAdmin using their normal email address and password. The new key will be removed at login, so the next time FTGate is restarted the administration override will be removed. See Also: Web Administration

Emergency Recovery

Suspended mode.

You can force FTGate into a suspended mode with the following script placed in the startup.fts file in the scriptlib folder

<% var s= new server.system s.suspend()

%>

Safe Mode

When in Safe-Mode FTGate will stop all processing all services except for WebAdmin . This can be useful when trying to resolve issues that are preventing FTGate from running correctly. You can also force FTGate into suspended mode using a startup script or the registry (see Emergency Recovery)

Using FTGate

47

Database support

FTGate supports data storage in either its own database or in an ODBC database. [currently tested with MySql and MSSql] To configure FTGate for ODBC database operation you need to do the following:

1. Install the database software on the machine that is to host the database 2. Create a database called FTGate 3. Open the ODBC database configuration tool in the windows control panel 4. Create a new SYSTEM DSN called FTGate and attach it to the database provider and set it

to select the FTGate Database (from step 2 above).. 5. Remove the contents of the FTGate Config folder. 6. Create a text file called ftgatedb.dat 7. Edit the file to contain the following

<dbconfig> <provider> DBTYPE </provider> <dsn> ftgate </dsn> <password> database_password </password> <username> database_access_username </username> </dbconfig>

8. Set DBTYPE to be either MySql or MsSql depending on the database type you are using.

SQL Based Mailing Lists

FTGate allows administrators to create a database from an external database of addresses held in an SQL database. To use an external SQL list you need to configure a DSN connection and an SQL statement that will retrieve the addresses for the message. The DSN MUST be a system DSN. The SQL query results must contain the columns 'Name' and 'Address'. Thus if the database does not contain these columns the SQL statement should create them in the returned data set. See: Members

Permissions/Access rights

Various objects in FTGate can be shared among users. These are: • User Folders • Address Books • Calendars • Tasks

These level of access to these objects can be restricted by giving the users permissions. There are five levels of access: Access Level Description

FTGateUsersGuide

48

Read All: Users can see the contents of the object

Read/Write In addition to the above: Folder: Users can set message flags. Other: modify the details.

Read/Write/Create In addition to the above: Folder: Users can move messages into the folder Other: Users can create contacts/events/tasks in the object

Read/Write/Create/Delete In addition to the above: All: Users can delete the contents of the object

Read/Write/Create/Delete/Manage In addition to the above: All: Users can share the object with others.

There are also some administration level access rights for:

• Quarantine folder • Local domain UbeBlock training folders • Access to Web Admin (System Administrators)

Customising SolSight Web

FTGate2009 allows for a very simple method of customising the initial welcome screens and logos used in the user interface.

Process

1. Locate the folder Webs5/assets 2. Copy the contents to a new folder (this is to prevent your logos being overwritten if we update

our logos) 3. Replace the logo files with your own matching files. Keep the names and dimensions the

same. 4. In the Services/WebMail Interface/virtuals add a new entry

url: /assets path: the path to your files (e.g. c:\program files\ftgate2009\myassets)

5. test your changes

Security Policies

Security Policies

Each service in FTGate is controlled by a security policy. The policy specifies the top level control of the service. In the Policy you can specify, by IP address and range, the authentication and relay options available to users of your server.

Using FTGate

49

By default there are three policies, users can create further policies as required:

• LAN security Policy By default this policy is used by all services that are normally accessed by the LAN users ( POP3 IMAP4 LDAP WebMail Connector ) which can be considered to be trusted connections.

• WebAdmin Policy By default this is used by the WebAdmin . A separate policy is used for WebAdmin to reduce the possibility that a configuration mistake will lock the administrator out of the WebAdmin interface. Extreme caution should be used when changing this policy.

• Global Security Policy By default this policy is used by all SMTP services, it contains settings that are suitable for machines connecting from the internet and are not from trusted sources.

Each service that uses a policy has the same security settings. Thus an address banned in a specific policy is banned in all services that use that policy. Each service may only use one policy but a policy can be shared among more than one service. A policy consists of two parts; An address list, that specifies how different IP addresses should be handled, and a group of settings for each service type. The addresses are selected in order of priority, the priority is simply the number of bits set in the mask field. Thus if an address matches two entries, the one with the most bits set in the mask will be used. The following describes the flags used in the Address fields: Flag Name Function PA Permit Access If this flag is set an IP address has access, otherwise it

is rejected. AA Automatic Authentication If this flag is set the connection is assumed to be

authenticated. For SMTP it is the equivalent of a successful AUTH command sequence having been completed. It will not effect service that require a login . ote that setting this flag on the WAN address range of the Global security policy will make your server an Open Relay

AS Permit SMTP Autentication This flag permits machines in this address range to issue SMTP AUTH commands and authenticate against the server. If the flag is clear NO machines in this range can authenticate.

AM Permit Authentication by mailbox access

This flag checks to see if any valid logins to either POP3/IMAP have occurred in the last 5 minutes, if so the connection is assumed to be authenticated.

AR Allow Relaying This flag enables authenticated users to relay mail through the server. If this flag is clear then machines in this address range will NEVER relay.

RBL Reject connections with RBL entries.

This flag causes all connections from within the specified address range to be validated against the RBL server list specified elsewhere. If the address is found the connection will be rejected.

BAN Allow Addresses to be blacklisted.

If this flag is set, any connections that attempt a detectable DOS attack will be auto banned

LL Limit login attempts/ SMTP Errors

If this flag is set IP addresses will be prevented from trying multiple login attempts (default 5). This protects against attempts at brute force password breaking. Each bad login is counted from each specific address regardless of the service type. So if I do bad login's for

FTGateUsersGuide

50

2xPOP3, 2xIMAP and 1xSMTP I get banned. This option also triggers protection against SMTP bad addresses. If this option is enabled the sending client/server will be banned after the specified number of bad recipients. The ban period is defined elsewhere in the policy.

BL Blacklisted Address If this flag is set the address is considered aggressively blacklisted. This flag is usually only set by the autoban option (above). Connections from blacklisted addresses are automatically denied.

PTR Reject connection with invalid DNS PTR records

This option will check that the IP address of the connected computer has a valid PTR record.

HE Validate HELO command is valid

This option validates the HELO domain and ensures that it is correctly formatted and it is not an IP address.

GL Use greylist See: Greylisting SPF Validate senders address

against domains SPF data This option will validate the senders email address against the SPF records for the domain of the sender. If the address is not in the valid range then the message will be rejected. If a domain does not publish SPF data then the message will be accepted.

Relay Control and Authentication

In order to prevent unauthorized use of your mail server, FTGate has a series of controls that can be used to limit both the amount of access and the relay abilities of those that access your SMTP Server. Relaying is the condition in which the recipient of the message is not hosted on your server and usually only occurs if either one of your users sends an outbound message (authorised use) or a spammer is trying to use your server to hide the original source of their unwanted messages (unauthorized use).

Security Policy IP Options

To control access to the SMTP server you need to configure the following flags for the address range you wish to control. PA (Permit Access)

Setting this flag will allow an address within the address range to connect to the server

AA (Auto Authenticate)

This setting will consider all connections from within the address range to be authenticated, however access to facilities that require specific mailbox privileges will NOT be granted without further authentication.

AS (Authenticate by SMTP)

This flag will cause the SMTP server to permit access to the SMTP authentication protocol functions. If this flag is cleared then no mailbox authentication will be possible.

AM (Authenticate by Mailbox)

This flag will cause the connection to be considered authenticated if a recent mailbox access was made from the connected IP address. This does not give access to facilities that require specific mailbox privileges.

AR (Authenticated Relaying)

This flag will enable authenticated users to relay though the server.

If the AR flag is cleared , then no relaying is possible. If the AR flag is set but the AA, AS and AM flags are cleared then again no relaying is possible.

Using FTGate

51

NOTE: SETTING THE AR AND AA FLAGS ON AN ADDRESS RANGE WILL GRANT THAT ADDRESS RANGE UNRESTRICTED RELAYING AND SHOULD BE AVOIDED UNLESS THE IP RANGE IS TRUSTED NOT TO ABUSE THE PRIVILEGE.

Authentication Controls

The security policy has a section specifically for the SMTP server. In the SMTP Authentication section the administrator can specify whether the authentication mechanism should check the attempted authentication against a hosted mailbox or against the explicitly specified entries. If the explicit entries method is used then users will have to match the details entered in the policy. However, while the users will be able to relay they will not be able to access any facilities that require specific mailbox authentication.

Service access control

Each service has an access control list available. If this list is enabled then the service can only be used by users who authenticate with a specific mailbox and password, other users will be rejected. Thus if the access control list is enabled, and the AS flag is not set, no users will be able to access the system.

Senders MAIL FROM Address control

In most circumstances administrators will desire that the senders from address of a message matches the authenticated address for the connection. This ensures that an account is not hijacked because of poor password choice. The domain privileges offer control over the permitted from address of a message and can be set such that:

1. The from address must match the authenticated address 2. The from address must be from the same domain as the authenticated address (note that it

does not have to be a valid mailbox name). 3. The from address can be any address and does not have to match any part of the

authenticated address. If the connection is authenticated with either the AM, AS or the explicit authentication options then there are no checks made on the from address. Note that the from address in the message is not checked as there are many legitimate reasons why the message header might have a different from address. However, it is desirable for the SMTP session "MAIL FROM" address to match the authenticated address.

Summary

FTGate offers a wide range of flexible options for authentication and relay control. In its default configuration it is not possible for unauthorized users to relay though the server. It is recommended that administrators carefully consider the possible consequences before changing the authentication and relay options. See:

• Security Policies • Security Policy Management • Policy Access Rights • Configuring LAN access

FTGateUsersGuide

52

Access Control Lists

Access to all the resources in FTGate are controlled by Access Control Lists (ACL). An ACL consists of a set of one or more local account Id's (email addresses) and some access rights associated with them. If an email address is a member of an ACL then it may access the resource which is controlled by the ACL. For example the WebAdmin interface can only be accessed by members of the System Admin ACL, or a shared folder can only be accessed by users who are in the shared folders ACL. Some ACL lists do not have any options to limit their access. For example all members of the System Admin ACL can access WebAdmin with no restrictions, while a folder user may only have read access to a folder, in which case they will be unable to delete or otherwise change the folders contents. If a group address is added to an ACL then all members of that group have access with the rights associated to that group. Thus if the sales group has read access to the sales contact list then all members of the sales group also have read access to the contact list.

ACL conflicts

ACL conflicts occur if a user who is a member has access to a resource via more than one ACL entry, for example if they are in two groups that are both listed in the ACL. In this case the user is assigned the highest access rights for the resource.

Configuring LAN access

By default FTGate creates a LAN security policy which it assigns to all the services that are usually used by LAN users rather than WAN users. Thus this policy is by default selected for POP3 , IMAP4 , LDAP , WebMail , and the Connector . Should a service require WAN access, it is recommended that the policy for that service be changed to the Global policy rather than modifying the LAN policy. This will prevent confusion over which addresses can access which service.

SSL

SSL Description

SSL is a protocol that permits secure communication between two computers. The servers use certificates to identify themselves and verify that they are who they say they are. This protocol is widely used in web pages to allow secure banking and shopping over the Internet. TLS is essentially the same as SSL, the only difference is that it is a mechanism by which a connection can be transferred from being insecure to secure at the request of the connected computer. For example: a mail client can be connected in a none secure mode to port 25 of a server and then start a TLS session which will then encrypt the rest of the data using SSL.

SSL Support in FTGate

FTGate supports SSL and TLS on the following.

Using FTGate

53

Feature SSL TLS SMTP Server X X SMTP Send X X HTML Server X POP3 Server X X SmartPop X X Connector Server X Replication Client X Services that support TLS have the option of requiring that TLS be selected. If the client does not switch to TLS then the connection is rejected.

Installing a self signed certificate

See: SSL self signed certificates

Configuring SSL

After installing a certificate, configuration of the service or client is simple.

1. Go to the Service or client page 2. Select the encryption type and select the certificate 3. Stop and start the service or client.

Internet Explorer and SSL attachment problems

Some users experience problems when attempting to download attachments from FTGate when using SSL. These problems are due to the security options set in Internet Explorer. To resolve the problem open Internet Explorer and in Tools/internet options/advanced, under the security section, clear the check the box Do not save encrypted pages to disk.

SSL self signed certificates

In order to use SSL or TLS for any service you must install a server certificate. This can be done by purchasing a certificate from a trusted certificate vendor or by installing a self signed certificate.

FTGateUsersGuide

54

A self signed certificate allows secure communication without the cost of purchasing a certificate. However, the certificate cannot be verified by a users client or browser and will display a warning. The user must then select to continue with the certificate despite the trust warning.

Creating a self signed certificate

We have often been asked why we do not supply a certificate that can be installed on your PC to run WebMail etc. There are various reasons but the main one is that you should use a real certificate that is unique to your installation. It is simple to do this and to make life easier we have put the required files into a self extracting zip file and included a batch file to run in order to create and install a self signed certificate. You can then use this certificate in FTGate. Please note that using SSL does slow down all services that use it due to the overhead of encryption. So if you only use a service over the LAN there is no point in using SSL. You can download the zip from here: Download the file and run it, store the files in a known location. Then use the DOS command box to run the batch file with a single argument with the server domain name you wish to use. e.g. cert www.myserver.com This will create and install a certificate called www.myserver.com You should make this name the hostname of your computer as typed in your browser.

Filtering, Anti-Spam, Anti-Virus

Overview

FTGate has comprehensive filtering tools to help you combat spam, viruses and other malicious messages. These policies allow each domain to have either its own or a shared policy that will control how mail for the domain is handled. This allows filtering on a variety of options including:

• email address • message content • attachments

Filters may be applied to one or more domains. Each domain that shares a filter will share the settings, filtering options and the result of any UBEBlock training that may occur. A Filter can also be applied to SMTP, in which case the filter options will be used to accept or reject the message:

• Black list • White list • Prohibited Words • Prohibited Phrases

See Also:

• Setting up spam filtering • Minimising Spam

http://members.ftgate.com/download/ftgatecert.zip�

Using FTGate

55

• Whitelisting • Greylisting • Whitehosting • Blacklisting • Filter Rules • Safe Words • SPF Validation • SPF • UBEBlock Rating • UbeBlock Training • UbeBlock Training Notes • Anti-Virus Overview

Setting up junk filtering

[This document is based on V5.1] [Note examples use mycompany.com as the domain, please replace with your own domain name and not just copy the examples!] In order to achieve the best possible filtering of junk, viruses and spam, from mail, FTGate has a layered approach to the problem of identifying junk messages.

Layer 1 - SMTP

SMTP is the way that mail should be moved around the internet (its how you mail client sends mail to FTGate and how FTGate sends mail to the internet). When mail arrives using SMTP there are various pieces of information available to FTGate for it to determine whether the message is from a real sender or is likely to be from a source of junk:

• IP address: Are they a known spammer (RBL list) Do they have a correct retry policy or are they a trojan infected machine (greylisting) Do they have a valid reverse pointer (PTR) all real servers should have this.

• Hostname (HELO): Did they sign on using a valid host name which is correct for their IP address

• Senders address: Is the IP address listed as a valid address for the domain (SPF Lists)

• Header data: Is the header valid

These tests usually give a very definite indicator of junk. While it is simple for a real sender to set these items to be correct, senders of junk mail and trojans find it very hard to get these things correct, and in the case of SPF, if the records are configured correctly it is not possible for a fake the authenticity of messages being sent.

Layer 2 - Text based filtering

The layer one filtering can eliminate 99% of all junk mail. The remaining mail can be filtered fairly simply using the remaining filter options. At this stage the message has been received and it looks like its a valid message in that there is nothing suspect about the sender, so we now have to perform analysis of the text. FTGate performs several levels of text analysis on the messages:

FTGateUsersGuide

56

• UBEBlock+ Message URL's - does the message link to any known junk sites Is the header suspect Does the message have any known pattern that looks like junk

• Stock Filter Does the message match a standard stock option advert

• Content Analysis Does the message violate any rules that may indicate it is junk

Layer 2 based filtering is never as effective as layer one because it is not difficult to create a junk mail message that looks like a real message to a computer program. Valid mailing lists that users often want to read look very like junk. If it were sent to a user other than the intended recipient it would be classed as junk. Thus filtering at this level will always be less effective than filtering at level 1. Note: Layer 2 filtering can remove all the junk. However, the more effective it becomes at removing junk, the higher the chance that a valid message will get blocked.

Mail delivery

Many users when they start using the filtering are surprised when we ask whether they collect their mail using SmartPop or have it delivered using SMTP. You can see from the above two layers that it is an important question. If you have your mail sent directly to your server from the internet, then the chances of correctly identifying and blocking junk are very high. However, if you collect you mail using SmartPop from a POP3 mailbox at your ISP you have effectively given the Layer 1 filtering to your ISP, if they do not perform any filtering then you just have to do the best you can at layer 2.

Setting it up

So you have just set up your server and want to eliminate the junk. What do you have to do? Level 1 If you get your mail delivered using SMTP directly from the Internet then you need to go to the Global Security Policy so you can set the SMTP filtering. Go to Services/Global Security Policy/Addresses and in the WAN range set the HDR, SPF, HE, PTR, GL and RBL flags. Then go to the Configuration/DNS page and make sure you have a valid DNS server (see DNS Servers). Then on the Configuration/RBL page make sure you enter at least one RBL site (see RBL Sites). Your now set for level one filtering. That's 99% of the junk blocked. Level 2 This is where it gets a little more complicated as the content analysis part of the filter needs to know what good and bad messages look like for your domain. To do this we go through a process of training and then we monitor the results making changes as we go. Accessing the training folders To get the best results and make life easier for yourself as an administrator you should at this stage connect your mail client ot FTGate using the IMAP protocol. This is configured in your email client in the same way as POP3 only you select IMAP rather than POP3 as the client. When connected to FTGate using IMAP you will find that the mail client shows you a list of the folders available in your mailbox and possibly some shared mailboxes from other mailboxes. The shared mailboxes are shown under a folder shared. To gain access to the FTGate folders used for setting up the junk filters and performing filtering you should go to the local domain setting for your domain in WebAdmin (Domains/MyCompany.com) and click the Filters tab. You will then see options for selecting a filter policy (more on that later) and the mailboxes that can perform training.

Using FTGate

57

By default the filter policy should be "Default Domain" and the training should list "[email protected]" and "[email protected]". This means that the system mailbox can access the training folders and anyone in the administrators group can access them. If these options are not set, then set them.

Now if you go into your mail client IMAP folder or SolSight Web you will see that the new folders are available.

FTGateUsersGuide

58

It is now possible to access the training folders. First time training To give FTGate an idea of what messages are treated as good in your network it helps to perform an initial training set by taking a selection of 30 typical messages that are not junk and using your mail client to drag and drop them onto the "UbeTrainingNotSpam" folder. The messages will sit in the folder for a while and then will be deleted as FTGate processes them. Setting the filter options In WebAdmin, click on Filters/Default domain. You can now see the options that provide the level 2 filtering. Now we want to filter the mail, but we probably don't want to filter mail from users in our address books. We also want to use UBEBlock+ as it is very good at filtering advertising junk. Click Options and set the Filter Control to Do not filter messages from authenticated and whitelisted addresses, and check the UBEBlock+ option. Then click the UbeBlock tab and set the UbeBlock option to "Generate UbeBlock rating and apply UbeBlock rating adjustments". Now we want to include our address books in the Whitelist. Click Whitelist and check the "Include addressbooks".

Now click the button. Setting the rules In order to actually filter the messages and allow control over what happens to a message the filtering is actually performed by a set of configurable filter rules. Click Filter Rules to see the default. The default rules are set to allow messages through that should be let through, delete those that are from blacklisted senders (senders who we can identify as being bad), and tag the rest. We can ignore those that let the mail though by default as you most likely will never need to change them. What you are most likely to want to change are those being tagged. The process of tagging causes the subject of the mail to be altered with a text tag, so that when the message arrives in the users mailbox they can see that it has been tagged and thus identified as being suspect. As an administrator you may want to change this behaviour so that users don't see suspect messages unless they have been approved. Setting a special recipient

Using FTGate

59

In order to make life easier for the administrator FTGate has the option of delivering all suspect mail to a specified mailbox where it can be reviewed. This mailbox may be the administrators own mailbox, or preferably it can be a different mailbox. Lets set this up. First we need to create the junk handling mailbox. Go to Domains/MyCompany.com/Mailboxes and create a new user mailbox "junk". Now open, in WebAdmin, the junk mailbox and go to the folders page. Click the share button next to Inbox, and set the Read/Write/Create and Delete options for the "Administrators" mailbox. Then click Update, then close the window. Now if you go back to your mail client and check the folders you will see that the new junk mailbox has its inbox shared with your mailbox.

So you can now read anything in the junk mailbox and, if training is required, you can copy the messages from the junk inbox to the training folders. Note: If its in the junk folder and it is junk, dont copy it to the UbeTraining Spam folder. Sending the junk to the junk user So now we want to send the suspect mail to the junk mailbox. Go back to the WebAdmin/Filters/Default domain/Filter rules page. Select the rule that you want to redirect to the junk user and click the rule name to open up the rule properties. Click the action tab and from the action drop down box select SR, then enter the email address of the junk mailbox [email protected] into the Special recipient box.

Save the changes and repeat for any other rules you want to send to the special recipient. We are now all set up for handling the junk. If you wish to add more administrators for junk handling you can simply add them to the administrators group and they will have access to training and the junk folder. False positives The number of false positives you get will be dependent on how harsh and how well trained your system is. See UBEBlock Training and UBEBlock Training Notes. Generally it is better to train false positives than false negatives. When you have a false positive you need to be able to get it to the original recipient as quickly as possible. Unfortunately most mail clients don't have a facility for redirecting mail without altering it as a

FTGateUsersGuide

60

forward. Some allow forwarding as an attachment, which the correct recipient can then open and reply. SolSight Web has the ability to redirect messages without altering the message. This is the best way to redirect incorrectly trapped mail. SolSight Web can also be used to train the system in the same way as IMAP and offers the same views as IMAP. Reducing the number of false positives can be achieved through the correct training of the system (don't let you general users train junk unless they know what they are doing (see UbeBlock Training Notes).

Minimising Junk/UBE mail

FTGate has a powerful set of features that can be used to eliminate most of the UBE mail before it reaches the users mailbox. The most effective way to eliminate UBE is to not let it onto your system. If it does reach your system then you need to use the Filtering facilities to filter out the UBE.

Stopping the UBE before it gets into the system

The best solution to filtering UBE is to reject it before it is received by your server. This is best achieved by filtering the messages as they are sent to FTGate. Recommendations:

1. Have your ISP send your mail to you using an SMTP feed. It is much harder to filter spam once your ISP has accepted it for you. If possible bypass your ISP and have your mail delivered directly to your PC.

2. Turn on PTR record checking This will verify that the PC sending you mail has published its details on the Internet. Most legitimate machines do this, most UBE sources do not.

3. Turn on HELO checking Only mail clients should use a dotted IP address as their HELO, mail server should use their domain name.

4. Turn on SPF This will require that the server sending you mail is authorised to handle mail for the specified domain. UBE rarely comes from the domain it pretends to use, and thus it will usually fail an SPF check. (See SPF)

5. Turn on RBL This will stop all servers that are known to be sources of UBE (See RBL)

6. Turn on GL This will prevent practically all Spam and Virus messages from being accepted and the cost of a small delay in mail delivery to your system for unknown senders. See Greylisting

Using Filtering

Once the mail reaches your system, the only way to block UBE is to filter it. FTGate includes a powerful set of filters that can eliminate practically all of the UBE received. To obtain the best filtering the following should be considered:

Using FTGate

61

Filter Policy/UbeBlock

• Adjustment if recipient's mailbox is in the Subject Many UBE sources place the mailbox name in the subject line. For example if "Great news fred@somedomain" is received the rating could be increased by 25

• Adjustment if there are three or more consecutive spaces in the Subject Adjust the rating for messages that have a sequence of spaces in the subject. For example if "New offer HKQOF" is received the rating could be increased by 25

• Acceptable proportion of unknown words against known words (Unknown ratio). This detects how many garbage words there are. Often SPAM is padded with garbage to try to confuse bayesian filtering and hit any safe word detectors. Detecting that a message is padded in this way can simplify filtering. The ratio is calculated as the number of unknown words/known words. Thus if there are 25 unknown words and 5 known words the ratio is 25/5 = 5

• Adjustment when message exceeds Unknown ratio threshold This adjustment is applied when the above ratio is exceeded. Thus if the ratio were 5 and there were 25 junk words and 5 known words the specified adjustment would be made.

• Weighting for images This weighting is applied for each image in a message. e.g. if the weighting were 5 and 5 images were in the message, the rating would be increased by 25

• Weighting for external images This weighting is applied for each image in a message that is a link to an external image on the Web. This is often used by Spammers to track emails. Your address is verified by them when you view the message and the image is downloaded from their server. e.g. if the weighting were 5 and 5 images were in the message, the rating would be increased by 25

• Weighting for web links This weighting is applied for links to the internet. UBE often has links, while normal mail usually does not. e.g. if the weighting were 5 and 5 links were in the message, the rating would be increased by 25

• Weighting for unknown words This is a simple weighting applied for the number of words in the message that are unrecognised e.g. if the weighting were 2 and 50 unrecognised were in the message, the rating would be increased by 100.

In addition the main UbeBlock filter will obtain a rating which will be modified by the above values. All of these settings result in an overall UBE rating which can then be used with the Filter rules to filter messages. It is recommended that all filtered mail be directed to a mailbox which can be examined by an administrator, this will allow the administrator to verify that the filtering is operating as expected and that any false positive messages can be retrieved and delivered to the correct user.

Greylisting

One of the new features in FTGate is the option of SMTP Greylisting. Greylisting is a way of filtering out the large majority of spam and virus sources on the net. In order to understand how it works we

FTGateUsersGuide

62

need to look at how mail is normally passed around the internet and how we can use this mechanism to help us filter the mail. Mail is passed between machines on the net using SMTP, and the SMTP protocol is designed to be resilient to failures of both the net and of individual servers. A mail server that complies to the SMTP RFC’s will try to send a message to a destination a number of times before giving up and returning a failure. The exception to this is if the destination rejects the message, in which case the sender will bounce it immediately. Part of the protocol allows a destination to tell a sender that it is currently busy and the sender should try again later, when this occurs the sender should hold the message in its queue and try again after a time delay. This allows the destination to delay mail when its load it too high or there is a server problem. How does this help us to filter out the spam and viruses? The main source of spam and viruses are zombie relays that are not true SMTP mail servers, they are designed to try an address and then move onto the next address. If an address fails then they don’t retry. Thus if we reject the connection with a busy signal, they will never retry and we will never get the spam or virus message. So how does it work? When a server tries to send a message to FTGate it makes a note of the senders IP, senders address and the recipient address. If it has never seen these three before, it rejects the connection with a busy message telling the sender to try again later. When the sender retries it will accept the message. There are a few modifications to this simple approach to make sure that the sender is really a true mail relay and not just a slightly smarter zombie. A slightly smarter zombie might retry the same connection immediately after a failure, in which case it would get through, so we add a little dead time to the Greylist entry so that any retry within the dead period is also rejected. This means that if a spam or virus zombie author wants to send the mail to us they have to make their software quite a bit more sophisticated. The other problem that we face is what to do with the thousands of bad connections that we reject. In one 4 day period the FTGate main server rejected 3500 connections with Greylisting. These were connections that never retried. Obviously if we never clean out these connections from the Greylist it will get very large indeed. So FTGate has two timeout periods for Greylist entries. The first is for those connections that never try again, this is a short timeout period that drops the zombies from the list. The second is a longer timeout for connections that did try again and have been passed. This ensures that the list doesn't grow too large and that good connections are saved to prevent delays. Any greylist system will require the ability to add whitelist entries. FTGate allows you to add both whitelist and blacklist entries by IP, sender, recipient and HELO address of the sending server. In addition each filter policy has the option of bypassing the greylist if the sender has been SPF Validated. What are the disadvantages of Greylisting? As with any system that is so good at wiping out spam there is going to be some problems.

1. The sender doesn’t retry! There are some mail servers that are simply badly written. They don’t care about internet RFC’s and assume that any send error is a complete failure and simply bounce the message. These servers are broken must be explicitly whitelisted.

2. The sender retry is longer than the zombie timeout! While not broken, these servers don’t put much value on trying to send the message through. The default for the zombie period is 24hrs and any real server that doesn’t retry a message within 24hrs is very poorly configured. Again, these servers must be explicitly whitelisted.

3. The sender is part of a server farm! Some servers try to send a message and then, when it fails, punt it to another server, which will then retry later. Obviously, if the time taken to go round all the punt servers is longer than the zombie timeout, the message will never be accepted. Thus the timeout must be chosen appropriately or the sender must be whitelisted.

4. I have MX relays! If you have MX relays then they should all implement greylisting. While most zombies will not

Using FTGate

63

retry after a given time a large number are designed to automatically try the MX backup for a domain in the event of a failure. Thus if you do not greylist on the relays the spam will simply flow in through them instead. In addition, you don’t want mail that comes in through a relay to be delayed so you must also whitelist your own relays.

5. My mail will be delayed! The first time someone sends to you there will be a delay, and the period is under control of their mail system administrator. Thus if their administrator sets their mail system to retry every 8 hours there will be an 8 hour delay. Subsequent ends will be instant. This is the price of cutting the spam and viruses, the rate at which you get the first email depends on how important the senders administrator thinks their mail is. However, in real terms it is irrelevant for most of the time. If you have a contact that you know will send you messages, such a supplier, you can whitelist them. If it is another source then immediate response is probably not an issue as many things can occur to delay a message, even with no whitelisting, and most users are aware of this. If you really must accept all mail immediately, then you would just turn off greylisting and except that you will get more spam.

Greylisting is a powerful tool new tool in fighting spam and viruses but it also has some potential issues that should be considered before using it on your system. You should review the above points and decide if their impact is acceptable to your needs before implementing greylisting on your server. For the original Greylisting whitepaper please see this whitepaper by Evan Harris: http://projects.puremagic.com/greylisting/whitepaper.html Additional information is available here: http://www.greylisting.org/

Whitelisting

A whitelist is a list of addresses that are from known contacts. The whitelist is usually used to bypass all content filtering. The addresses to be whitelisted can be entered into the filter policy using Pattern matching characters . To enable more flexible processing of messages it is possible to either include or exclude whitelisted addresses from filtering. See: Filter Whitelist, Filter options

Whitehosting

Whitehosting is a method of whitelisting that uses the sending servers hostname to define the messages as being whitelisted. Any message from a whitehosted server will be treated as if its sender is whitelisted. The hostname applies only to messages received via SMTP and uses the text string sent in the EHLO/HELO command. The string is entered into the filter whitelist using Pattern matching characters . See: Whitelisting, Filter Whitelist

Blacklisting

Blacklisting is the name given to a list of email addresses from which you specifically do not want to receive messages. Each blacklist entry can be either a complete email address or a partial email address with Pattern matching characters .

http://projects.puremagic.com/greylisting/whitepaper.html�

http://www.greylisting.org/�

FTGateUsersGuide

64

The action taken when detecting a blacklisted address depends on whether the filter is being applied at the SMTP or domain level.

• SMTP The senders address and entire message will be rejected. Any bounce operations are handled by the sending server.

• Domain The filter policy specifies the action taken using the filter rules. See: Filter Rules

See: Filter Blacklist,

Filter Rules

Filter rules provide a mechanism for the administrator to define the handling of messages that meet certain criteria. A filter rule can be configured to trigger on a variety of information including:

• Message sender • Message recipient • The message UBE rating • The message contains a safe word • The message is from a white listed address • The message is from a black listed address • The message is from an SPF validated source

Note, this option requires that either FTGate or your ISP added an SPF V1 header to the message

• The message contains a prohibited word • The message contains a prohibited phrase • The message passed through an RBL listed server • The message is from an authenticated sender • The message contains a specific word or words

By default all non-alpha characters are removed from strings that are entered into this list, in order to enter a string with non-alpha characters you must enclose the string in quotes. i.e. "the-string".

The filter can take one of the following actions depending on the above options:

• Deliver normally The message will be delivered normally.

• Deliver normally and send a tagged copy to the Special Recipient The message will be delivered normally but a copy will be sent to the Special Recipient with the subject line appropriately tagged.

• Deliver normally and send the Special Recipient an attached copy. The message will be delivered normally but a copy will also be sent to the Special Recipient as an attachment.

• Deliver normally but tag the subject line . The message will be delivered but the subject line will have the appropriate tag added

• Deliver as an attachment in a tagged message The message will be delivered but as an attachment to a message with a suitably tagged subject line.

• Deliver to the Special Recipient The message will be redirected to the Special Recipient

• Deliver as an attachment to a tagged message to the Special Recipient The message will be sent to the Special Recipient but as an attachment in the message with a suitably tagged subject line.

• Delete the message and send the rejection message The message will be deleted and the rejection message will be send to the original sender

Using FTGate

65

• Delete message The message will be deleted and no further action taken

Safe Words

Safe words are used to detect messages that have content that should be accepted regardless of other considerations. For example you may add your product names to the safe word list, so that any messages that refer to your products by name can be intercepted and handles separately. The safe word list is part of a filter policy and it should be noted that its behaviour is dependent of the filtering level being applied.

• SMTP At the SMTP level the detection of a safe word will prevent other content dependent filters from rejecting the message. For example a message that contains a safe word and also contains a bad phrase or bad word will be accepted.

• Domain At the domain level the detection of a safe word will set the safe word flag for subsequent filter rule processing.

See: Overview, Filter Safe Words

SPF Validation

The SPF (Sender Policy Framework) a DNS based system that allows mail server to check that the IP address of a source of mail is authorised to send mail for a given domain. When a mail message is received, FTGate retrieves the SPF records for the senders email address and verifies that it incudes the IP address of the sending server. SPF checking is enabled in the Security Policy of an SMTP. The result of the SPF check can also be used in the Filter Policy Rules and used to bypass Greylisting SPF checks will not be performed for authenticated users (See Relay Control and Authentication) External References: http://spf.pobox.com/

Anti-Virus Overview

FTGate offers various levels of support for different anti-virus products.

• Full support This level of support is offered where the Anti-Virus vendors have given FTGate Technology access to their anti-virus API. At the time of writing these are AVG, Sophos and Panda.

• Partial support This level of support applies to products whose vendors have not supplied an API with which to access their product. In this mode the level of scanning and error reporting will depend on the basic features of the scanner. Scanners supported in this mode include Norton, McAfee et al

How it works

http://spf.pobox.com/�

FTGateUsersGuide

66

When a message is received it is parsed to determine if their are any attachments in the message. If there are any attachments then FTGate extracts each attachment into a folder on the hard disk. It then attempts to either scan the file (if there is full support) or open the file to read back its contents. If the file was infected the virus scanner will either report an error or prevent access to the file, delete or quarantine the file, in which case the attempt to read the file would fail and FTGate would know the attachment was infected. It would then move the whole message to a quarantine folder and notify the postmaster.

Will it work with my Anti-Virus product

There is a simple way to determine if FTGate scanner interface will work with your anti-virus product. The following steps will determine compatibility: NOTE: THIS TEST USES THE STANDARD EICAR ANTI-VIRUS TEST SIGNATURE. IT IS NOT A VIRUS. IT IS USED TO TEST THAT ANTI-VIRUS PACKAGES ARE CORRECTLY INSTALLED AND WORKING. Create a new text file on your desktop called eicar.txt (right click the desktop and select "New | Text Document" Cut the following line from this document and past it into eicar.txt X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* Save the file Rename the file eicar.com Make sure that your anti-virus product is enabled double click on eicar.com to execute the program If your anti-virus package prevented access to the file by either denying access, deleting or quarantining the file, then your scanning package is compatible with FTGate. If it allowed the program to run then your anti-virus package is not compatible and virus scanning is not an option on your system. NOTE: YOU SHOULD NOT SET YOUR ANTI-VIRUS SCANNER TO REPAIR INFECTED FILES. IF YOU DO THIS FTGATE, WILL BE ALLOWED TO ACCESS THE FILE AND IT WILL APPEAR THAT THE FILE IS NOT INFECTED. FTGATE WILL THEN PERMIT THE ORIGINAL MESSAGE CONTAINING THE INFECTED ATTACHMENT TO BE DELIVERED, IT WILL NOT REPLACE THE OLD ATTACHMENT WITH THE DISINFECTED VERSION. NOTE: YOU ARE RESPONSIBLE FOR ENSURING THAT YOUR USE OF AN ANTI-VIRUS PACKAGE WITH THIS MAIL SERVER, AND IN THIS MANNER, DOES NOT VIOLATE ANY LICENCES YOU MAY HAVE WITH YOUR ANTI-VIRUS VENDOR. IF YOU ARE IN ANY WAY UNSURE ABOUT THE LICENSING OF YOUR ANTI-VIRUS PRODUCT AND WHETHER IT MAY BE USED IN THIS MANNER YOU SHOULD CLARIFY THE SITUATION WITH YOUR ANTI-VIRUS VENDOR BEFORE ENABLING ANTI-VIRUS SUPPORT. FTGATE TECHNOLOGY AND ITS AGENTS WILL NOT BE HELD RESPONSIBLE FOR ANY LICENCE VIOLATIONS THAT OCCUR. ALTERNATIVE SCANNER SUPPORT FROM TIME TO TIME FTGATE TECHNOLOGY WILL RELEASE ADDITIONAL MODULES THAT WILL ALLOW FTGATE TO ACCESS DIFFERENT ANTI-VIRUS PACKAGES. CHECK OUR WEB SITE FOR ADDITIONAL MODULES THAT MIGHT BE AVAILABLE.

UBEBlock

UbeBlock Rating

UbeBlock normally calculates a spam rating based upon the content of a message. The rating adjustments page provides a set of modifiers that will adjust the UbeBlock rating for certain message features. This can greatly aid the identification of Spam.

Using FTGate

67

See Also • Minimising Junk/UBE mail

Suggested Settings

The following rating adjustments are used on the FTGate Technology servers. We have found them to be effective. Adjustment if recipient's mailbox is in the Subject: 50 Adjustment if there are three or more consecutive spaces in the Subject:

50

Acceptable proportion of unknown words against known words (Unknown ratio)

20

Adjustment when message exceeds Unknown ratio threshold 40 Weighting for images 30 Weighting for external images 75 Weighting for web links 20 Weighting for unknown words 10

UbeBlock Training

How to configure for first use

By default FTGate creates a Default Domain filter policy. This filter policy has a set of rules pre-configured but its is untrained. We recommend that the following method be used for the initial configuration of the UbeBlock ratings.

1. Connect your mail client to the IMAP port 2. Open the shared folders and find the UbeTrainingNotSpam folder 3. Go into your sent items folder and find 30 messages that cover a broad spectrum of the type

of emails that you send and receive. 4. Copy them into the UbeTrainingNotSpam folder

Now UbeBlock is primed with a base set of the language used in your messages. Messages that do not fall into this category will be marked as spam. Messages that get through can be dropped into the UbeTrainingSpam folder to improve detection rates.

How to train

Two training methods: b) By dropping the message into the appropriate IMAP shared folder . Access to the shared folders can be configured in the Local domain options. This is the recommended training option. b) By sending a message to the system mailbox e.g. [email protected]

1. The message sender must be i) authenticated by IP or AUTH ii) have access rights to the spam training system

2. The message must have a subject of "spam" to train as spam 3. The message must have a subject of "notspam" to train as not spam

FTGateUsersGuide

68

UbeBlock Training Notes

Whitelist Bypass

If you use the option to bypass whitelisted addresses from the filtering option then you bypass all of the analysis and reduce the processing required considerably. Normally whitelisted mail is delivered without filtering so the default is correct. Clearing the option may result in mail from whitelisted addresses being bounced or deleted depending on the rules you define. Thus care should be taken when adjusting the whitelist settings.

Automated Self Training

It is inadvisable to use the spam or RBL messages detected by UBEBlock to train UBEBlock. Automated training in general is not advised for the following reason:

1. RBL lists are not proof of spam. Messages can come though an RBL server that are not spam. If you train just one of these it will ruin your training.

2. Many spam messages are seeded with hundreds of innocent words that would appear as legitimate (they are used to try to fool statistical filtering. Thus you seriously reduce the margin between the good and the bad. In the worst case this make it practically impossible to get good training because the RBL spam is swamping any attempts to train good messages. Eventually all mail looks the same and you will have to delete the training and start again.

3. Training a good message as spam by accident will undermine the whole training process and may result in your having to start again. So please be careful.

Bounce or Delete

In general it is better to bounce mail rather than delete. Nearly all spam comes from invalid addresses, and in such cases a bounce will just get deleted. If any real mail is bounced it will reach a real user and will tell them to try again. Bouncing mail, even for legitimate addresses, does not confirm to spammers that the address is real.

Who should train

All training should be done by a person who understands the nature of spam and has been told the issues below.

1. Always make sure that you train in the right way. Mixing the spam and not spam training will result in very poor performance.

2. Don't train all the messages. Take a look at the message first if it has many real words included in the message, do not train it as spam, you will only make it easier for the next one to come in.

3. Use the unknown word weightings (UBEBlock Rating) to improve spam detection. It is easier to train UBEBlock with real messages and have it reject anything it does not recognise.

Backup and restore

Disaster Planning

Using FTGate

69

No matter how good your server software, sooner or later the worst will happen and a hardware failure will occur. When this happens it is usually considered a major catastrophe as all communication in your organisation will stop. The problem becomes even more pronounced with groupware and IMAP because all of the essential information and company mail is stored on the server, preventing anyone from looking at any mail they have received. This can completely cripple an organisation. Because of this it is worth considering what steps are appropriate to return mail handling to normal in the shortest time possible. There are a number of measures that can be taken to provide various levels of protection and differing costs. This paper will look at some possible configurations that offer different recovery times at different costs. All of these considerations will focus only on the single point of failure problem. This is the scenario in which only one failure occurs, such as the motherboard of the Mail Server fails, rather than the multiple failure scenario, such as a lightning strike that blows up every computer on the network.

Single Point of Failure

The mail server can be considered as three main parts:

1. The mail server software FTGate in our case

2. The Mail server Configuration The options in use and mailboxes configured etc

3. The mail store The computers hard drive

The disaster recovery plan should consider how each part should be recovered or protected.

Basic Protection

In the simplest scenario the administrator will take a backup each day using a tape drive or other system. This protects both the server software, the configuration and the mail store. In the event of a server failure the backup will be restored to either another server or the repaired server. While this approach is low cost it can also result in extensive system down time, which may prove expensive in other ways. It also relies on the backup system not being damaged by the failure and that another PC is available or the original can be repaired quickly. In addition, any mail received since the last backup will be lost. While this is the most common approach it is not considered to be a suitable solution.

Minimal Downtime

Any viable solution for disaster recovery should allow the administrator to recover normal operation in the shortest possible time. Thus it is important that the system in use is protected against the failure of a single server or component of the server. This implies that we should separate those parts onto different machines.

Dual Machines

At this stage it becomes obvious that the minimal downtime can be created by running two servers which are connected. At various times of the day the entire mail store and configuration are copied from the main server to the backup server. This results in a machine being available which can, at short notice, be used to replace the original.

FTGateUsersGuide

70

In the event of a failure, the IP address of the backup PC will be changed to match the original and the mail server software will be started. This is required otherwise the mail client software of the users will not be able to connect to the new server. The physical changes needed will be quite small and can be made in as little as 15 minutes. However, the issues with this type of system are that any mail received or configuration changes made between the copy interval will be lost and the IP addresses of the PC will need to be altered. Also, while the time taken to switch between machines can be low, if the failure occurs during unmanned hours, the actual outage could be very long. Thus in addition to the backup machine an MX relay should also be incorporated to hold inbound mail in the event of a failure.

Segmented Cluster

This solution is the most complex and expensive but offers a system that can result in any single failure affecting only a small number of users. In this system the user accounts are separated over different machines and the failure of any one machine only effects the accounts of those on that machine. This also has the advantage that high bandwidth users can be handled by the faster machines. Full discussion of this will be made in a separate White Paper.

Backup and Restore

All system administrators should take care to perform regular backups of their mail system. The mail system rapidly becomes the heart of any organisation and loss of the system, even for a few hours, can be very costly. See also

• Disaster Planning

Internal Backup

FTGate makes regular backup files of all its system settings and mailbox configurations (including groupware features). This allows an administrator to recover from human errors such as accidental deletion of accounts or domains. These files are stored in the ConfigBackup folder and can be used to restore FTGate to its configuration for the date of the backup.

Internal Restore

This method is used when an administrator has made an undesirable change to FTGate or the database needs to be restored to an earlier snapshot. This will restore the domains mailboxes, groupware items and all other options held in the main database. To perform an Internal restore the administrator should:

1. Stop FTGate using the FTGateIcon utility 2. Rename the FTGate/config folder 3. Restart FTGate 4. When the wizard starts, choose to restore an FTGate backup 5. Browse to the FTGate/ConfigBackup folder and select the appropriate file

Using FTGate

71

6. Complete the restore wizard and allow FTGate to restart

Full Backup

It is recommended that the administrator uses an external backup device to ensure that in the event of a disaster the system can be recovered in the shortest possible time. The following items should be committed to an external backup device:

• The FTGate/ConfigBackup Folder • The FTGate/Config Folder (and subfolders) • The Spool and all subfolders • All domain folders and mailbox folders (that are not part of the spool folder)

Full Restore

To restore FTGate after the loss of a hard drive or other disaster:

1. Install FTGate 2. Stop FTGate 3. Restore the following from the external backup

The FTGate/ConfigBackup Folder The FTGate/Config Folder (and subfolders) The Spool and all subfolders All domain folders and mailbox folders (that are not part of the spool folder)

Tip:

All folder paths should remain the same. Changing the folder paths can result in loss of functionality or data.

Utility Applications

FTGateArchive

The FTGateArchive utility is a Windows application that gives searchable access to all the messages in the archive. In addition the archive tool can be used to search messages that have been moved to offline storage, e.g. a DVD drive.

Starting FTGateArchive

FTGateArchive can either be started by using the Start Menu option in Windows or by locating the FTGateArchive.exe file in the FTGate program folder on the server. The application can also be run on a desktop machine by copying the executable program to the required machine.

Configuring FTGateArchive

The archive utility is configured by selecting Tools/Options from the FTGateArchive menu and selecting the appropriate paths:

• Location of Archive Files This is either the archive folder for FTGate or the backup medium location.

FTGateUsersGuide

72

e.g. c:\spool\archive or d:\

• Location of Spool/Inbox This is the location of the Spool/Inbox folder on the FTGate server. In order to forward messages from the archive you will need to specify this directory and make sure that you have write/create privileges on the server. If using a share to access this folder then ensure that the share has the correct privileges.

Accessing an Archive

After starting an configuring FTGateArchive it is possible to search the archive for specific data or view all the data. Searching: To search for a specific message or group of messages enter the data or part of the data you wish to search for. For example:

• To find all messages to/from [email protected] you would enter [email protected] in both the From and To fields, select Apply Filter, select Match Any, then click Refresh.

• To find all the messages to/from all users at domain.com you would enter domain.com in both the From and To fields, select Apply Filter, select Match Any, then click Refresh.

• To find messages from [email protected] to any user at domain.com you would enter [email protected] in the From field, domain.com in the To field, select Apply Filter, Select Match All, then click Refresh.

Archive Actions

FTGateArchive permits the selection of one or more messages. It is then possible to take the following actions with a right mouse click on the selected items:

• Copy to clipboard • View the source text of message • Forward the message to a specific address bypassing all FTGate filters • Save the message to a .eml file that can be opened by Outlook Express or other applications.

FTGateIcon

The FTGateIcon runs in the tray area of the server PC and supplies the administrator with a rapid method to do the following:

1. See the running state of FTGate - FTGate is running normally - FTGate is suspended and requires attention - FTGate is not running

2. Start and Stop FTGate

Right click on the Icon (shown above) and select Start FTGate or Stop FTGate

Using FTGate

73

3. Open the Status Windows The status window shows and warning or critical events that have occurred since FTGateIcon was started. To show the status windows right click on the Icon and select Show Status

4. Run the Monitor Right click on the Icon and select FTGateMonitor to start the monitor

5. Start WebAdmin Right click on the Icon and select WebAdmin to launch a browser window and access WebAdmin

FTGateUpdate

The FTGateUpdate tool is used by FTGate when in auto and manual update mode.

Applying Manual Updates

If an update (.fau) file is supplied by FTGate Technology, the update can be applied by double clicking the update file, in which case FTGateUpdate will automatically run and apply the update. To perform a manual update please download this the .fau to your server desktop: Make sure that it has not been renamed and still has the .fau extension, then double click on it. FTGate will then apply the update and restart.

FTGateMonitor

The FTGateMonitor allows the administrator to monitor the activity of FTGate from any machine on the network.

Starting FTGateMonitor

To start FTGateMonitor from the server console, right click on the FTGateIcon in the tray area and select FTGateMonitor. To start FTGateMonitor from a remote machine, copy the FTGateMonitor.exe file from the server to the required machine, then double click on the file.

Connecting to the server

To connect the monitor to the server, click Server/Connect, type in the server IP-address or name, an administrator email address and password, then click connect.

FTGateLog

The FTGateLog file is a utility for reading the log (.ftlog) files created by FTGate. It allows searching and flagging of entries in the log, together with the ability to copy selected lines to the clipboard for pasting elsewhere.

FTGateUsersGuide

74

AutoCluster

Configuring AutoCluster

AutoCluster is a very simple system to configure and manage. The basic components are:

• AutoCluster Client • AutoCluster POP3 Proxy

AutoCluster Client

The AutoCluster client is responsible for connecting to the Groupware connector of an ISP Edition or Professional Edition FTGate master server. It will then dynamically configure the server with domain and account information from the master server. See AutoCluster Client A Relay Edition server can support multiple AutoCluster clients for the dynamic configuration of multiple servers. Additional Clients can be configure from the Clients page of the Web Administration interface.

AutoCluster POP3 Proxy

The AutoCluster POP3 Proxy Service is automatically created when the Relay Edition is installed. There is nothing to manually configure as its settings are all set by the AutoCluster Client(s).

75

Web Admin Interface

Web Admin Login

Type topic text here.

User Interface Guide

The FTGate user interface has been designed to provide the simplest possible way to achieve a given task. In addition to changing values and selecting options, users will also have to perform the following common operations. Where possible the user interface has been designed to use the same sequence of operations to achieve common tasks.

Saving changes

Any changes to page content should be saved by clicking the save button before switching to another page. Failure to do so will result in those changes being lost.

Adding an item

Adding a new item to a list of items is simply a matter of selecting any options for a new item, typing its name and/or any other required details and clicking the Add button.

Deleting an item

Deleting an item from a list is simply a matter of selecting the check box next to the item(s) to be deleted and clicking the delete button

Filtering a list

In order to more efficiently display some lists, the filter bar will be displayed. Clicking on a letter in the filter will cause the list to be refreshed showing only the items that match the selected letter. The filter box may be used to filter for precisely when dealing with large lists, for example filtering on bo* would display only items that started with bo and filtering on *bo would only show those items ending in bo.

FTGateUsersGuide

76

Selection lists

If the purpose of a list is to select some elements rather than others, then the desired items should be selected by setting the checkbox to the selected or unselected state and clicking the save button.

Start/Stop Enable/Disable

The start/stop and enable/disable system uses standard stop go buttons. The dark raised button can be pressed to change the items state. Thus, in the above example, the first item is currently started and may be stopped, while the second is stopped and may be started.

Paging control

Some lists may be of sufficient length that they cannot be displayed on a single page without an unacceptable delay. In these circumstances a paging control will be visible. This allows navigation to the first page , last page and any specific page by direct selection in the page list . The previous and next buttons allow for stepping through the pages in sequence.

Menu Bar

The menu bar is located at the top of the page and allows rapid access to the different sections of the FTGate interface. This interface is available from all pages of the interface. The main sections are:

• General Contains functions to access the log files, statistics and archiving information

• Domains Allows access to the domain and mailbox management functions

• Outbox Controls how mail is sent from FTGate to the Internet and allows access to the outbound mail queue

Web Admin Interface

77

• Services Lists and allows configuration of the available services (e.g. SMTP, POP3) and the security policies which control them

• Clients Allows management of the collection of POP3 email from a different server using SmartPop or the configuration of the replication client in FTGate Relay Edition servers

• Events Manages the triggering of timed server events. for example dial up connections and auto-update checking

• Filters Contains the options for Anti-virus, Greylisting, Spam filtering, Routing and access to quarantined messages

• Configuration Allows access to system wide configuration options

• Utility Contains general utilities that do not logically belong anywhere else

Navigation Panel

In addition to the menu bar the individual sections are also presented on the main navigation panel of the home page. In addition to the titles this offers a handy reminder as to the function of each section.

Access Control

In many places it is required to share items between users in a domain or across the system. In these cases, accessed by clicking the Share button, the Access control list will be displayed. Altering the access rights of users in the domain is a matter of changing the selected options and clicking update. To add a non-domain address to the list, it should be typed in the address box and the add button clicked. See User Interface Guide To remove access rights for an address clear all the options and click update.

General

Information

This page identifies which version of FTGate you are running and any services that are not currently enabled.

Log

This page allows you to view and search a given dates log contents.

Activity

This page shows you the current activities being processed by the server.

FTGateUsersGuide

78

In addition to the status of any active connections there are three entries that are always listed:

• Connections This displays the current number of connections for each service type

• DNS resolver This shows the number of queries currently being serviced

• Spooler This shows the number of message currently awaiting filtering and delivery

Queues

This page displays the number of message waiting for delivery in the outbox and any remote domains. There are three headings:

1. New These are messages awaiting delivery

2. Active These are messages that are currently being delivered

3. Queued These are messages that have failed delivery and have been queued for late retires

The "Connect Now" button causes all the messages in the queued column to be moved to the New column for immediate retry. If the connection is over dial up link, it will also cause the connection to be dialled.

Statistics

This page shows statistical information regarding the performance of FTGate.

Archive

This page gives access to the message archive in FTGate and allows messages from the archive to be forwarded to other addresses. This can be used to locate messages between given time periods for specific address or with specific entries in the subject. The page also contains a preview page which will display the first 2KB of the message. There are more features available in the stand alone archive tool FTGate Archive. Messages in the list may be selected and then redirected to a mailbox. This will cause the message to be delivered without any filtering being applied.

Finding archived messages

To locate a message select the start and end dates for the search and then enter text for the from, to and subject, then click find. When searching for a message a partial match system is used. e.g. to find messages from [email protected] you could search with the from line set to: bob [email protected] ftgate.com but NOT *@ftgate.com

Web Admin Interface

79

Selecting Messages

There are a number of options to select messages for forwarding or resending. Clicking on a message will select the specific message and deselect any other selected messages. Clicking on a message, then holding down SHIFT and clicking on another will select both messages and the messages between them. Clicking on a message, then holding down CTRL and clicking another message will add the message to the selection Pressing CTRL-A will select all the messages.

Domains

Managing Domains

All mailboxes in FTGate are arranged into domains. There are two types of domain which provide different domain level functions.

Local Domains

A local domain contains mailboxes and all their associated settings. Each mailbox can be individually accessed by a user. The mailbox count for this type of domain is the total count of user and list mailboxes hosted by that domain. See: Local Domians/Overview

Remote Domains

A remote domain is a mailbox that stores all mail for that domain to delivered to a different server in a single mailbox. This is usually used in a store and forward environment for either a hosting company or in the DMZ section of a firewall. The mail can be collected using POP3 or forwarded via SMTP to another server. The mailbox count for this type of domain is 1 regardless of the number of actual addresses used by this domain. A remote domain may also include a virtual address list to prevents the server from accepting badly addressed messages. When in virtual address mode FTGate will consume 1 mailbox count per address. See:RemoteDomains/General

Alias Domains

Alias domains allow all mail for the named domain to be processed by another domain. e.g. Many companies have multiple domain names in order to protect their corporate identity. If you company had the domains mydomain.com and mydomain.org you would create a Local Domain or Remote Domain called mydomain.com and then create an alias called mydomain.org. All mail for [email protected] will then be delivered to [email protected]. Alias domains do not use any mailboxes.

FTGateUsersGuide

80

Local Domains

Overview

A local domain contains all of the mailboxes for a domain and the options that are global to the domain. See Also:

• Mailboxes • General • Filters • Active Directory • Migration • Privilege Sets

Mailboxes

The local domain Mailbox tab displays a list of the mailboxes hosted by a domain. Clicking on a mailbox name will open a new window allowing access to the mailbox options. Clicking the Alias button allows the creation of a mailbox alias.

Mailbox Types

There are 7 types of mailbox in FTGate and each has a specific function:

• User Mailboxes These mailboxes are accessed using the POP3 , IMAP or SolSight Web . They can also be used, through the use of the mailbox rules to provide file Library functions and Robot functions.

• List Mailboxes These mailboxes are used to manage mailing lists and to distribute messages between a large groups of users on the Internet. They offer various control options and the ability, if required, to take their address list from an external SQL database.

• Group Mailboxes These mailboxes hold a collection of local addresses into a group. Messages to the group will be received by each member of the group. In addition any access rights granted to the group mailbox A list of mailboxes that are part of a domain. Messages to a group mailbox will be delivered to all members of the group. A group can also be used when assigning permissions causing all of the members of a group to inherit those permissions. are inherited by all members of the group.

• Null Mailbox This is a system mailbox that deletes all messages sent to it

• System Mailbox This mailbox handles internal system messages and UBEBlock training requests

• DSN Mailbox This mailbox handles error returns from the internet for all List Mailboxes that are set to auto manage their members

• Alias Mailbox This represent another name for one of the other mailboxes. Mail addressed to an alias mailbox will be delivered to the mailbox that the alias represents.

Only User and List Mailboxes count to the total number of mailboxes used in FTGate.

Default Mailboxes

Web Admin Interface

81

When a domain is created a default set of mailboxes are created as follows:

• Admin (or the name specified when defining the root.login name in the configuration wizard) This is the default administrator for the domain

• Administrators This is a group mailbox containing all the administrators of the domain. Members of this group are only granted access to WebAdmin if the mailbox itself is granted administrator access. See Web Administration

• dsn A special mailbox for handling list mailbox delivery status notifications

• everyone A group mailbox into which FTGate adds all new user mailboxes created. Mailboxes can be removed from the group to hide them from other users.

• null A mailbox that deletes all mail sent to it.

• postmaster An alias for administrators. Internet RFC's require that a postmaster be defined.

• system A mailbox that processes system commands. See Mailbox Overview

General

To local domain General tab allows for the configuration of the general settings:

Path to outbox This specifies the location on the hard disk where the mailbox messages are stored. Each mailbox has a folder in this location named after the mailbox.

Limit number of mailboxes in this domain This allows the administrator to limit the number of mailboxes that can be created in this domain. This is used to limit the number of mailboxes that can be created when a domain has a local administrator.

Mail for Unknown Users This section states the action that FTGate takes when this domain receives messages that do not have a local mailbox.

• Reject message and send a notification • Send to the Postmaster • Send to the Postmaster as an attachment • Forward to the Internet • Forward to an email address

Signature This signature is added to all outbound messages.

• None Do not add the signature to messages

• Start Add the signature to the beginning of the message

FTGateUsersGuide

82

• End Add the signature to the end of the message

Signature Message If you leave the Plain text box empty a text version of the html entry will be added. If you leave the HTML text box empty an HTML version of the Plain text entry will be added

Filters

This page specifies which filter policy is used by this domain and which domain members may train the UBEBlock spam filtering system.

Filter Policy This is the filter policy that FTGate uses to filter messages arriving into this domain

UBEBlock Training Only those addresses listed here (or contained within a group listed here) are allowed to train UBEBlock.

Active Directory

This page lists the active directory accounts that are available on the server. To add mailboxes from active directory simply select the accounts to be added and click the Add button. Automatic active directory account creation is available from the Migration tab.

Migration

The Migration tab provides configuration options that control the automatic creation of mailboxes in the domain. When Migration is enabled and an unknown user attempts to log into POP3, IMAP or SolSight Web, FTGate will use the migration options to verify the users details, and if the verification passes a mailbox will be created for the user.

Migration options

No migration All mailbox management is controlled directly by the administrator

Active Directory Create account using Active Directory details. FTGate will verify the users mailbox name and password against the listed active directory domain. If the account exists then a mailbox will be created and the password authentication options set to verify with the active directory account.

POP3 Create account and get mail from a POP3 server, if a successful login occurs. FTGate will attempt a POP3 login on the specified server. If the login is successful then the account will be created and the password stored. Any mail on the other server will then be downloaded to FTGate and placed in the new mailbox.

Migration message Insert this temporary migration notification into mailbox during migration process.

Web Admin Interface

83

This places the specified message into the users mailbox during a POP3 migration operation so that the user knows that the mail is currently being collected.

Privileges

Privilege sets are associated to mailboxes. They restrict the amount of allocated storage, the availability times, and feature access. Each privilege set support configuration of the following options:

Quota tab

These settings restrict the amount of data in each mailbox.

Enable quota Control how much mail is permitted in a mailbox

Message limit This is the maximum number of messages permitted in the mailbox

Allocated storage This is the amount of storage available to this mailbox. (MB)

Quota Notification Controls if a notification is sent when the quote is exceeded

Max message age Specifies the maximum age of messages permitted in this folder (in days)

Time Tab

These settings restrict the availability times for mailboxes

Enable availability restriction Controls the times and dates for which the mailbox is available

Restrict times Only allow access between the following times

Restrict days Only allow access on the following days of the week

General Tab

Passwords must be at least 8 characters long

Passwords must be a mixture of letters and digits

Allow access to Web Mail

Allow access to the connector

Allow access to POP3

FTGateUsersGuide

84

Allow access to group shared resources

Authentication Tab

After SMTP authentication These are the relaying options that the SMTP accepts after success authentication of this mailbox's address and password.

• The sender's address must be the authenticated address • The sender's address must from the same domain as the authenticated address • The sender's address can be any valid email address

Access Tab

Options that relate to both WebMail and SolSight

Allow modification of personal details

Allow modification of password

Allow user to create and delete address books

Allow access to contact history tracking information

Allow modification of Out of Office method

Allow access to Calendaring

Allow access to message rules • Allow creation of forwarding rules • Allow creation of auto response rules

Allow uploading of attachments for auto responses and calendar messages

Allow access to Local Admin to manage the local domain

Allow local admin to modify the local domain filters

Mailboxes

General

Name Name of the mailbox

Folder Location on the hard disk where messages folder attachment and drafts are stored for this mailbox

Status Enable/disable the mailbox. Disabled mailboxes cannot send or receive messages.

Privilege set : This option select the privilege set that will be used by this mailbox

Web Admin Interface

85

Configure this account as a spam trap This option configures this mailbox as a spam trap. All messages which includes the spam trap mailbox as a recipient are rejected by the SMTP server(s).

User can only send to local addresses This option prevents the user from sending a message to an external (internet) address.

Send Copy This option creates a hidden BCC on all mail sent from [email protected] and causes it to be sent to the specified address. This can be used for monitoring of outgoing mail form this mailbox.

Trashcan This extends the functionality of IMAP and defines the behaviour of message deletion in SolSight Web. When enabled, deleted files are actually copied to the trashcan folder and then deleted and expunged from the original folder.

Information

This page provides information regarding the mailbox.

• Last Accessed The time of the last POP3/IMAP/SolSight Web login

• Messages received Number and total size of messages received

• Messages sent Number and total size of messages sent

• Peak count The maximum number of message in the mailbox

• Peak size The maximum size the mailbox has reached.

Personal Details

This page allows configuration of a mailboxes contact details. These details will be visible to other users in the domain as part of the domain address book.

Password

Controls the method used to validate login requests

Local The password is held (encrypted) in the FTGate database.

Active Directory Enter the domain and user ID used to validate the password, or leave this field blank to use the domain setting and mailbox name. WinNT://domain/mailbox. If the domain is to be managed via active directory, and the domain name matches the active directory domain name, then the ID field can be left blank.

SQL Database Enter the DSN and SQL command used to validate the password If this option is selected then FTGate will authenticate users against an external SQL database

FTGateUsersGuide

86

When using an external ODBC database the SQL statement will be checked to see if any records are returned. If one or more records are returned then the user will be treated as authenticated. There are tokens that can be used in the SQL statement to permit it to be customised to the individual account being tested. $NAME$ = the name of the account (e.g. fred) $ADDRESS$ = the email address of the account e.g. [email protected] $PASSWORD$ = the password being tested by the login Thus an example would be SELECT * FROM users WHERE name='$NAME$' AND Address='$ADDRESS$' AND password='$PASSWORD$'

Signature

Add this signature to all outgoing Web Mail messages

Out of Office

Out of Office Status These are your Out of Office options.

• Show as Here • Show as Out • Show as Out and send the following message

Groups

This page controls the groups to which this mailbox is a member. To join or leave a group change the checkbox states and click the save button.

Folders

This page lists the folders that are available in the mailbox. New folders can be added and the folders can be shared by clicking the Share button. In order to see the folder in SolSight Web and IMAP the folder must be subscribed otherwise the folder will be hidden.

Inbox Rules

This page shows a list of mailbox rules that are available. Each rule can be configured to use a combination of fields from the message header to control whether the rule runs, and each rule has a comprehensive set of actions which range from moving a message to a folder through to sending a reply with an attachment or even running a script or external program. Thus with the FTGate rule system it is possible to create versatile customised message handling systems with practically no effort. The introduction of the rules has rendered the Autoresponder and Robot mailboxes of the previous versions obsolete as it is now trivial to implement a far more powerful set of responses and behaviours directly through the rules than the predefined handling that existed in these old mailbox types.

Web Admin Interface

87

Each rule can have several actions and more than one rule can trigger on a message. However, if a rule is configured to move or delete the current message, or stop processing, no further rules will be run. Actions that can be taken by a mailbox rules are

• Send an Auto-reply • Forward the message to another address • Set a flag for the message (used by IMAP) • Mark the message as seen (used by IMAP) • Run an FTScript • Run an external application (use %FILE% to refer to the email message source) • Copy the message to a folder • Move the message to a folder (prevents message matching any further rules) • Delete the message (prevents message matching any further rules) • Stop processing rules

Forwarding type rules

Mailbox rules allow various message forwarding systems to be implemented that can be dependent on the sender, recipients, subject and other options. See Also:

• Forwarding Messages

Autoresponder type rules

Creating an Autoresponder mailbox is simply a matter of creating a user mailbox A mailbox which holds mail that will normally be retrieved by a person using WebMail, POP3 or IMAP and then creating a rule for each of the files or messages you wish to return. After creating a rule you set the rule to match a subject line that you wish to respond to and complete the auto-reply action details. This also allows you to configure or upload an attachment that will be sent with the reply. You can by further modifying the rules customize the response by setting different actions for different senders of the message. See Also: Macro Expansion

Robot Mailboxes type rules

To recreate the robot mailbox functionality you simply create a rule that is set to run for all messages and specify an appropriate action to be taken. This can be further customised by creating different rules and specifying different trigger conditions for the rule.

Forwarding Messages

When messages arrive in a users mailbox it is often required that the message is sent or copied to another address. This is performed with mailbox Inbox Rules. The following steps are used to create a forwarding rule.

1. Open the users mailbox in WebAdmin or WebMail 2. Go to the Inbox Rules page 3. Type the name of the new rule e.g. forwarding to joe

FTGateUsersGuide

88

4. Click add 5. Click on the new rule 6. Check the apply to all messages box 7. Change to the Actions tab 8. Check Forward to the following address 9. Enter the required address e.g. [email protected] 10. If you want to have the message deleted after forwarding, check the delete message option 11. Check the Rule Enabled option 12. Click Save

This rule will forward all mail arriving in the mailbox to joes email address.

Attachments

These files can be used as attachments to mailbox rules and calendar messages.

Contents

This shows the contents of the users inbox.

Address Books

This page displays the address books available to the mailbox. New address books can be added and the existing address books shared with other domain members. If the mailbox is a group mailbox then the address books will be visible to all members of the group.

Calendars

This page displays the calendars available to the mailbox. New address books can be added and the existing calendars shared with other domain members. If the mailbox is a group mailbox then the calendars will be visible to all members of the group.

Notes

This page displays the note books available to the mailbox. New address books can be added and the existing note books shared with other domain members. If the mailbox is a group mailbox then the note books will be visible to all members of the group.

Tasks

This page displays the task lists available to the mailbox. New address books can be added and the existing task lists shared with other domain members. If the mailbox is a group mailbox then the task lists will be visible to all members of the group.

ui_mbx_tracking1


Group Mailboxes

Web Admin Interface

89

Group Members

This page allows for simple selection of the members of the group.

Tracking

When tracking is enabled, messages arriving in this mailbox have a tracking id inserted into the subject line and a message is returned to the sender informing them that their message has arrived and telling them what tracking number has been assigned to them. This option is useful for tracking a message. It is most relevant when it is important to keep track of a sequence of replies, e.g. for a technical support enquiry, or sales enquiry. When the group mailbox receives a message the Tracking ID is inserted into the subject along with the date and a three digit number (which increments each time a message arrives in the group mailbox that does not have a Tracking ID in its subject). It is possible to include special macros into the message. See Macro Expansion

List Mailboxes

List Control

These options control how the list mailbox will handle messages. General Tab

List owner Address of person responsible for list maintenance.

Limit postings size Causes messages over this size to be rejected

Subject identifier Text to be added to the start of the subject line for each messages distributed out by this list. For example using a Subject identifier of [mylist] would cause all message from the list to have [mylist] prepended to the subject line. Options

Allow SUBSCRIBE Enabling this will allow new members to join the list by emailing to the list with "subscribe" (no quotes) in the subject line. Not used in ODBC list sources

Log SUBSCRIBE Records in the log who has subscribed/un-subscribed Not used in ODBC list sources

Confirm SUBSCRIBE Sends a message to the user who is subscribing for them to confirm they wish to be on the list. This helps prevent other people subscribing addresses "for a laugh". If the user does not reply to the confirmation request, the user is not subscribed Not used in ODBC list sources

Send notification to owner for subscribes and unsubscribes

FTGateUsersGuide

90

The mailbox sends a notification to the list owner after a successful subscribe or un-subscribe.

Maintain archive of postings Keeps the messages in the mailbox folder for that mailbox

Moderated The list owner can post to the list when this option is enabled. This forces all messages to the list to be sent to the list owner who can then decide which messages are suitable for publishing. This is useful when the list is a "Customer list" and you only wish the sales manager to be able to send messages to the customers via the list.

Only allow list members to post Users must subscribe before posting to the list, if not the messages will be rejected. Not used in ODBC list sources

Include Sender in postings Sends a copy of the message to the sender.

Function as a distribution list When this option in not checked, one message is generated addressed to all the list members (via BCC), and the To address in the header is shown as the list mailbox name. With the option checked a unique message is created for every list member and the To address is set to the address of the list member

Auto-manage members Removes any address from which messages have bounced, after sending a second message and a confirmation request "do you still wish to be on this list?" This keeps the list current, with only valid email addresses on the list. This will have no effect on an SQL based list. Not used in ODBC list sources Reply

Reply Address Specifies which return address should be used for messages distributed by this list.

• Set the reply address to be this list • Set the reply address to be the sender • Set the reply address to be this address:

List Members

This page configures the data source used to supply the list addresses.

Member Source You can configure this mailbox to use an SQL query to obtain the members list, or to use the explicitly defined members list.

• This mailbox uses the following members list The members are held in the FTGate database and managed through a list display. Members can be imported and exported using the Import export Options on the list page.

• Use the following ODBC search to obtain the list members The members are held in an SQL database

ODBC List FTGate allows administrators to create a database from an external database of addresses held in an SQL database.

Web Admin Interface

91

DSN A system DSN that can be used to open the connection to the database

SQL The SQL statement used to return the address list from the database. The returned data must include fields named 'name' and 'address'. To use an external SQL list you need to configure a DSN connection and an SQL statement that will retrieve the addresses for the message. The DSN must be a System DSN. The SQL query results must contain the columns 'Name' and 'Address'. Thus if the database does not contain these columns the SQL statement should create them in the returned data set. example: In the DSN box dsn=customers;uid=admin;pwd=kx154 in the Sql box SELECT email as address, customername as name FROM customerlist WHERE wantmailing=1

Notifications

These are the messages used by the list mailbox. They include the joining and leaving messages as well as the moderated message and error messages. Messages can be sent for the following reasons:

• Subscribe Successful • Subscribe Unsuccessful -- Closed list • Subscribe Unsuccessful -- Already a member • Confirm Subscribe • Unsubscribe Successful • Reject posting -- Not a member • Reject posting -- Message too big • Moderator message

Signature

List messages can have signature added to all sent messages. The signature is either added to the beginning or end of the message. Available options:

• Do not add the signature to messages • Add the signature to the beginning of the message • Add the signature to the end of the message

Remote Domains

General

Path to outbox Location on the hard drive where messages are stored prior to delivery or collection.

Authentication

FTGateUsersGuide

92

Allow SMTP authentication and POP3 access using the following name and password

Password Hold flagged messages This option causes messages that have been flagged by the filter system to be held. Flagged messages will not be delivered by either SMTP or POP3.

Virtual address mode Only accept mail for address in the domain address book. Each address entry will use one mailbox licence.

Filter Policy This is the filter policy that FTGate uses to filter messages arriving into this domain.

Host name : Name used to identify this machine on the Internet (EHLO/HELO name)

Fast Expire This option prevents outbound messages that are a result of a bounce or a filter from queueing in the outbox. When enabled, delivery of such messages will be tried once, and any failure results in the message being deleted. Thus the domain or outbox will not fill up with undeliverable spam rejections. However, it is possible that a legitimate bounce could be deleted if the target server is down, although this is very unlikely.

Promote 4XX Failures This option causes a 4XX level SMTP send error to be treated as a 5XX error and rejected the message rather than cause it to queue. This option is disabled if MX delivery is enabled and is not compatible when sending to servers that have gray-listing enabled. Its primary use is for ISP's who use remote domains which don't reject bad addresses but issue a 4XX try again later message, causing the domains to fill up with undelivered junk.

Debug Logging Create debug log. Additional information will be written to the log file showing the SMTP session used to send the messages. Note, this option has no effect if the system logging level is not set to debug. See Logging

Disable access to this domain before Access will be prevented before this time

Disable access to this domain after Access will be prevented after this time

Throughput Restrictions This sets the maximum size of the mailbox. When this size is reached mail will be temporarily rejected.

Connection

Network profile : Select the network profile to connect for message delivery. Users of Broadband or other permanent connection should use the LAN network profile

Delivery mode : The delivery mode controls when to open a connection for message delivery.

• Never Connect

Web Admin Interface

93

• Immediately • ETRN • Conditional

Conditional When in conditional mode these settings will cause delivery to start

• Message count • Message age • Priority message

Encryption This setting specifies whether FTGate should send encrypted data

• No encryption • Encrypt all data using SSL • Allow encryption using TLS • Require encryption using TLS

Maximum concurrent sends Specifies the maximum number of concurrent sends permitted

SMTP inactivity timeout The period after the last data transfer when it is assumed the link has been lost and the connection should be closed

Delivery

Specifies how FTGate will send mail to its intended recipients.

SMTP Hosts : Deliver mail to SMTP hosts listed in the order shown

MX Hosts : Deliver messages using DNS/MX records If delivery fails:

• Deliver mail to SMTP hosts • Hold mail in queue for later delivery

Queue Options : Specifies how long FTGate will hold undelivered mail in the delivery queue.

Delivery Optimisation : Disable delivery optimisation and send each message in a separate SMTP session

Addresses

This page allows the configuration of the virtual addresses that will be used to prevent badly addressed mail being delivered to the domain. When in virtual address mode (See General) each entry will use 1 mailbox licence.

Contents

FTGateUsersGuide

94

This page allows access to the remote domains mail queue.

Overview


Outbox

Outbox

The Outbox is the location where outbound mail is stored before it is sent to the Internet. If you send your outbound mail to your ISP for delivery then you will need to configure the Outbox with your ISP's details. If you deliver the mail directly using MX records, then you must also configure a DNS server. See Also:

• DNS

To configure the Outbox for direct delivery to an ISP

In order to configure delivery to the ISP you will need to know your ISP's SMTP server name or IP address and if using a dialup connection, the Profile used to connect to the Internet. If a dial up profile is to be used see Dialling the Internet

1. In Outbox, click Connection 2. In Connection Options / Network Profile, select the required profile, [LAN] or

[Proxy/Router] 3. In Delivery Mode, select Immediately 4. In Host name, enter your Domain Name 5. Click Apply 6. In Outbox, click Delivery 7. In Delivery Route, select SMTP Hosts 8. In SMTP Hosts / Host1, enter the IP address or name of the ISP's SMTP server (see

Remote Domains) 9. (Optional) In SMTP Hosts / Host2, enter the IP address or name of the ISP's backup SMTP

server 10. (Optional) In SMTP Hosts / Host3, enter the IP address or name of the ISP's backup SMTP

server 11. Click Apply

To configure the Outbox for direct delivery via MX Records

MX delivery is not recommended over dial up connections (*). A suitable DNS server will be required for correct delivery of mail (DNS).

1. In Outbox, click Connection 2. In Connection Options / Network Profile, select [LAN] or [Proxy/Router] 3. In Delivery Mode, select Immediately 4. In Host name, enter your Domain Name (**) 5. Click Apply 6. In Outbox, click Delivery 7. In Delivery Route, select MX Hosts 8. In If delivery fails, select Hold mail in queue for later delivery 9. Click Apply

NOTES

Web Admin Interface

95

* MANY ISPS WILL NOT PERMIT MX DELIVERY THROUGH THEIR NETWORK DUE TO MISUSE AS A SOURCE OF SPAM. ** MANY SERVERS WILL NOT ACCEPT MAIL FROM SERVERS WITH AN INCORRECT HOST NAME.

Managing the Outbox

The Outbox controls outbound mail to the Internet. For the various setting options please see the remote domain options. General Connection Delivery Contents

Services

Managing Services and Security Policies

Service and Security Policies are managed through the Services section with a separate tab for Services and Security Policies.

Services Tab

This tab displays the service list. New services can be added and removed. In the event that a service was not able to start it will be highlighted in red. The cause of the problem can be determined by placing the cursor over the ! character, or opening the service. See:

• Service Types

Policies Tab

This tab displays the available security policies. The default policies cannot be deleted. However, any new policies added may be deleted. See:

• Security Policy Management • Policy Access Rights • Configuring LAN access

Security Policy

Overview

In order to control how a service responds to connections from different IP addresses FTGate implements a system of security policies. A security policy specifies what access rights are granted to connections from various IP addresses. A server will typically have multiple security policies that specify different types of access. Each service allows the selection of one security policy, and the options selected in that policy will control the access to that service. See Also:

FTGateUsersGuide

96

• Options • Addresses • SMTP • POP3 • HTTP • LDAP

Options

The security policy tab allows for the configuration of the specific security policy features that will be used all services using the policy.

Enabled If the policy is enabled, all services that use the policy may run depending on their specific options. When the policy is disabled ALL services using the policy will be stopped.

Policy Service Control Services that use this policy will only be available if their service type is enabled Any service that uses this policy must have its service type enabled in the policy. If the service type is disabled in the policy then that service will not run. See also:

• Security Policies • Relay Control and Authentication • Access Control Lists (ACL) • Configuring LAN access • Addresses • SMTP • POP3 • HTTP • LDAP

Login attempts This option defines how many POP3/IMAP login and SMTP authentication attempts that can be made before an IP address gets a temporary or permanent ban. This option is controlled by the LL flags.

Ban Period This option specifies how FTGate should handle automatic bans. The period of a ban maybe 5 minutes or permanent.

Greylist SPF Bypass This option causes an IP address that has been validated by SPF to bypass the greylisting process.

SPF Softfail Promote This option causes any SPF check that results in a softfail, indicating that the domain administrators dont care if its valid or not, should be treated as fails and rejected.

Permit Spoofing This option disables the anti-spoofing measures in FTGate. When this option enabled FTGate will allow any un-authorised connection to send mail using a locally hosted email address. See Also:

Web Admin Interface

97

• Anti-Spoofing

Addresses

This tab defines the security features that will be applied to each address in the policy. See:

• Security Policies

SMTP

The SMTP tab controls options that apply to SMTP servers using this policy.

SMTP Welcome Text The first line that is sent in response to a connection

SMTP host name : The name used by the SMTP service to identify itself to incoming connections in response to HELO/EHLO

Message Limits These options restrict the maximum size of a message, number of recipients for a message and the number of servers a message can pass though. messages that exceed these limits are rejected.

Maximum message size (authenticated) This limits the message size for users which are authenticated by IP address or SMTP authentication KB

Maximum message size (other) This limits the message size for non-authenticated users KB

Maximum recipients (Authenticated) This sets the maximum number of recipients that a message can be sent to by authenticated senders

Maximum recipients (Other) This sets the maximum number of recipients that a message can be sent to by non-authenicated senders

Max Recipients (header) Specifies the maximum number of recipients in header.

Maximum hops Specifies the total number of servers that a message can pass through before it is assumed a loop has occurred and the message is rejected

SMTP authentication This option specifies what FTGate validates against when authenticating.

• Mailboxes • Specific settings

FTGateUsersGuide

98

Inactivity timeout The period of time from the last communication until the connection will be closed.

Sender validation Validate that the sender's domain exists

Hosted senders only Only allow delivery from hosted email addresses

Allow EXPN and VRFY SMTP commands Permit the server to respond to EXPN and VRFY commands. This may result in a drop in server security.

Local header addresses Include local IP address in message headers received lines

POP3

The POP3 tab defines POP3 options that apply to all POP3 services using this policy.


HTTP

The HTTP tab defines HTTP options that apply to all HTTP services using this policy.


Script timeout The period of time after which a running script will be terminated

Session timeout The period since the last web access before the session is discarded

LDAP

The LDAP tab defines options that apply to all LDAP services using this policy.


Services

Service Types

FTGate support the following service types

SMTP

Web Admin Interface

99

The SMTP protocol is the method used when a mail client (such as Thunderbird or Outlook ™ ) or a mail server sends a message to a server. It is the primary method used to transfer mail around the Internet.

POP3

This is the most common method used by mail clients to retrieve mail from a server. It is a very basic protocol and it is not intended for use as a mail store for more than one email address. However, ISP's often see this a cheaper alternative than an SMTP feed and thus often use it in this way. See SmartPop

HTTP

This protocol is used to supply web (HTML) pages to Web browsers. This protocol is used to power both the SolSight Web interface and Web Admin.

LDAP

This protocol is used to provide LDAP directory access to mail clients. It is search based and a common confusion is that, when first connecting to an LDAP service, no results are shown until a search is performed.

Proxy

This protocol allows Web browsers to access pages on the Internet through FTGate without their having a direct connection to the Internet.

IMAP

This protocol is a more advanced protocool that POP3 and allows a mail client to access mail stored in a mail store. The mail remains on the server where it can be backed up. This protocol allows sharing of folders with some restrictions on behaviour depending on the mail client used. See IMAP considerations

Monitor

This protocol is used by the FTGateMonitor utility

Groupware Connector

This protocol is used by the FTGate Outlook Connector and the Replicator client.

Service failed to start

When FTGate is first installed it is possible for their to be port conflicts between FTGate and other software. This can prevent FTGate being able to start all of its services. In the event of this problem it is necessary to determine which application is using which port so that the problem application can be disabled or reconfigured. You can determine which application is using which port by opening a command prompt and typing netstat -o You will then see a series of lines similar to this:

FTGateUsersGuide

100

netstat -o Active Connections Proto Local Address Foreign Address State PID TCP THOR:1110 THOR.ftgate.lan:3407 ESTABLISHED 1688 You can then look for the line for the problem port and look at the PID. So we can see that on the local machine (THOR) port 1110 is being used by the application with PID 1688 You can then open the task manager (right click on the task bar and select task manager) and locate the task with the indicated PID. If the PID column is not being displayed in the task manager, Click View/Select Columns and check the PID box. This will tell you what application is using the port so you can shut it off. See Also: Firewall ports

POP3

General Tab

Name The name of this item

Status Controls if the service will respond to connections

Address The address on which the server will listen for incoming connections.

Port The port on which the service will listen for incoming connections. Only one service can listen on any given address:port combination.

Options Tab

Low security Allow low security login (username without domain) for single domain systems

Log access Create an entry in the log when a user signs in

Create debug log This option causes additional log information for this particular service to be included in the log file

Encryption Tab

Require encrypted authentication

Encryption Specifies the level of encryption required when communicating with this service (requires a valid encryption certificate)

Web Admin Interface

101


Encryption certificate This encryption certificate will be used when encoding data using SSL and TLS

Security Policy Tab

Security Policy Selects the security policy that is to be used by this service. All other options in this section are shared between POP3 services See Security Policy, POP3

Access Tab

Access restriction Controls who can access the service

• Allow access to everyone • Restrict access to the following addresses

Service Access List Lists the users who are permitted access to this service. These addresses must be for mailboxes hosted on this server.

SMTP

General Tab





Options Tab

Filter Policy This is the filter policy that FTGate uses to filter messages arriving into this server.


Encryption Tab

FTGateUsersGuide

102





Security Policy Tab

Security Policy Selects the security policy that is to be used by this service. All other options in this section are shared between POP3 services See Security Policy, SMTP

Access Tab




HTTP (SolSight Web and WebAdmin)

General Tab





Options Tab

Location of Files This is the root path for the files to be served by this server.

Web Admin Interface

103

Default Language This defines the initial language that will be used when displaying the web pages (Web Admin and SolSight Web only)

Encryption Tab





Security Policy Tab

Security Policy Selects the security policy that is to be used by this service. All other options in this section are shared between POP3 services See Security Policy, HTTP

Access Tab

Access restriction Controls who can access the service. This is only appropriate to SolSight Web and WebAdmin



Scripts Tab

Script Folders The server runs these scripts when the associated folder is requested in a URL.

Virtuals Tab

Virtual Folders The server accesses the files in the folders corresponding to the requested URLs.

LDAP

General Tab

Name

FTGateUsersGuide

104

The name of this item


Address The address on which the server will listen for incoming connections. Note: On Windows 2003 servers you MUST select an address for the LDAP service or it will not start.


Options Tab

None.

Encryption Tab

Not applicable

Security Policy Tab

Security Policy Selects the security policy that is to be used by this service. All other options in this section are shared between POP3 services See Security Policy, LDAP

Access Tab




Proxy

General Tab




Web Admin Interface

105


Options Tab

Proxy Type : The proxy can either function as a web browser (i.e. access web pages using the HTTP and HTTPS protocols), or communicate directly to a specific address/port.

• This is a Web proxy • This is a Point to Point proxy.

Encryption Tab

Not applicable

Security Policy Tab

Security Policy Selects the security policy that is to be used by this service. All other options in this section are shared between POP3 services See Security Policy

Access Tab




IMAP

General Tab





Options Tab

Log access

FTGateUsersGuide

106

Create an entry in the log when a user signs in


Encryption Tab





Security Policy Tab


Access Tab




Monitor

General Tab




Port

Web Admin Interface

107

The port on which the service will listen for incoming connections. Only one service can listen on any given address:port combination.

Options Tab

None

Encryption Tab

Not applicable

Security Policy Tab


Access Tab




Groupware Connector

General Tab





Options Tab

None

Encryption Tab


FTGateUsersGuide

108


• No encryption • Encrypt all data using SSL


Security Policy Tab


Access Tab




Clients

Managing Clients

The clients section allows the configuration of either SmartPop accounts (Professional and ISP Editions) or Replicator accounts (Relay Edition). See

• SmartPop • AutoCluster

SmartPop

SmartPop

FTGate includes SmartPop which is a technology which allows FTGate to collect mail from an ISP's POP3 mailbox and be able to correctly deliver almost any message without the user needing to make any configuration choices beyond turning SmartPop on. When delivering messages in its automatic mode SmartPop can do the following:

1. Deliver messages for users who have mailboxes directly to them and prevent duplicates from being delivered.

2. Deliver mail for unknown users of a local domain in accordance with the configured domain settings which includes bouncing the email with an undeliverable report.

3. Return incorrectly addressed email as undeliverable or send it to a special recipient.

Web Admin Interface

109

FTGate also includes the option to bounce mail that is too large, thus preventing FTGate from using up too much bandwidth and telling the original sender why their message was not delivered. These changes now give SmartPop the same flexibility of delivery as SMTP . See Also

• Configuring SmartPop • Delivering SmartPop mail to a single user • Delivering SmartPop mail to domain users • SmartPop limitations

SmartPop limitations

SmartPop mail delivery problems

We are often asked "Why do I get the message ' SmartPop Mail Delivery Failure?". This article will explain why it happens and what can be done about it.

History of SmartPop.

Many ISP's offer multiple mail addresses with their mail accounts, but place all the messages in a single mailbox. So for example you might have the email addresses [email protected], [email protected] and [email protected], and all the mail might be placed in a mailbox [email protected]. This type of mailbox is commonly known as a domain or multi-drop mailbox . The problem with a multi-drop mailbox is that the first person to connect to it gets all the mail regardless of who it was sent to. SmartPop solves this problem by retrieving the mail messages and then delivering to the appropriate local mailbox. To deliver the mail from the example above, the administrator would install FTGate, create three mailboxes (user1, user2 and user3) in the domain "domain.com", then create a SmartPop account for [email protected]. SmartPop would then collect the mail and deliver it to the appropriate user.

What is a message

An Internet mail message consists of two parts, the header and the body. The header contains information such as who the message is from, who it is to, the subject, when it was sent etc. The body is the text of the message.

How is mail transferred around the Internet.

Most mail is transferred from point to point using a protocol called SMTP (Simple Mail Transfer Protocol). This protocol transfers a message by making a connection to a destination computer, sending the Envelope of the message and then sending the message. The Envelope of the message contains the senders email address and one or more recipients addresses. By the time the message reaches your ISP's machine the envelope will usually consist of the sender and one recipient. It is this recipient address that the ISP uses to determine which mailbox should be used for storing the message. In the above example a message to user1, user2 or user3 would be written to a single mailbox ([email protected]). After the mail is placed in a mailbox it can be retrieved using a protocol called POP3 (Post Office Protocol version 3). This protocol transfers the body of the message. The problem with this protocol is that it was only designed to access mailboxes that had mail for a single user.

What can go wrong to cause delivery failures ?

FTGateUsersGuide

110

A message is in the ISP mailbox for an address that doesn't have a local mailbox. If using the above example a message was in the ISP mailbox addressed to [email protected], SmartPop would not be able to deliver it as there is no mailbox or alias for that name. This can be fixed by creating the mailbox or alias. The message was sent to the ISP mailbox by a mailing list that doesn't include the recipients address (BCC). Many mailing lists do what is known as blind mailing. This is where the message header has a TO: line to say [email protected]. Obviously there is no mailbox on the local mail system called that, so this causes an error. The second problem is harder to fix and will require your ISP's help. I will describe the problem using an analogy with the postal mail system. A letter is sent inside an envelope (SMTP is the envelope) addressed to Fred Bloggs. The letter inside starts Dear Sir (the message header). The postman (your ISP server) brings the letter to your office but before delivering it takes the letter out of the envelope and puts only the letter through the postbox at the front door (ISP pop3 mailbox). Now when your secretary (FTGate) collects the mail, there is no indication as to who the "Dear Sir" is, so it cannot be delivered.

The Solution

Many ISP's copy the envelope (SMTP) address into the message header, that way the messages recipient address can always be found. There is no standard for the way that they do this and FTGate has been coded with most of the methods in use. This allows SmartPop to read the message header and deliver to the correct mailbox. If your messages are being delivered as "SmartPop mail delivery failure", you should check the header of the attached message to see if the correct address exists. If it does not, you need to contact your ISP and arrange for them to either add the additional field for the envelope to the message headers or give you an SMTP feed. If they are not prepared to do this then consider changing to another ISP as a multi-drop mailbox will not work correctly without the addition of the extra header information.

Example Headers

An example of a message (sent to [email protected]) that has not had the ISP include the additional envelope data might be: Date: Fri, 26 Jun 1998 08:40:45 -0400 To: [email protected] From: Fred Bloggs <[email protected]> Subject: Version 2.1.0.5 and "Received... for" Reply-To: [email protected] x-listserver: [email protected] and an example that has had the additional information included might be: X-Recipient: [email protected] Date: Fri, 26 Jun 1998 08:40:45 -0400 To: [email protected] From: Fred Bloggs <[email protected]> Subject: Version 2.1.0.5 and "Received... for" Reply-To: [email protected] x-listserver: [email protected] Note the additional highlighted line. Without this line the ISP has made it impossible to deliver the message correctly. They have discarded the delivery information. If your ISP does not include this

Web Admin Interface

111

information you should contact them and ask that they add the information or explain to you how you are supposed to know who the message is for. We hope that this goes some way towards explaining the problem.

SmartPop delivery problems

Users of SmartPop may find that they have delivery issues after first installing the system. This is often to inappropriate handling of the message headers by the ISP. Please read the following article to put the rest of this discussion in context: SmartPop limitations The problems fall into two types.

1. Modified addresses in the header

ISP's that add a delivery line but modify the real address of the message. For example: The message is addressed to [email protected] but the ISP adds a tag line of [email protected] In this case the real address is present and a filter can be used to restore the address. In this example a new filter would be added to filter/routes with the entry from: * to: xxx-*@mydomian.com route to: *@mydomain.com This removes the modification and allows the message to be delivered correctly.

2. ISP using the x-recipient for their own purpose

Some ISP's use the x-recipient (or equivilent) to provide their internal routing and this can result in SmartPop being unable, in automatic mode, to deliver the mail correctly. Typically, the message header will contain something like x-delivered-to: [email protected] where maildrop is the account name you have at your ISP. In this case the ISP has decided to use the special received tag for their own purpose, that means that it does not include the name of the original addressee, just the name of the catch all mailbox. The solution to this is to disable the feature in SmartPop and live with the potential loss of BCC mail. You need to switch SmartPop into Manual mode (SmartPop/Delivery). Disable all options except: Filter Ids Scan Message Header (+options 3 and 4, not 1 or 2) Your mail will now be delivered normally with maybe the exception of BCC mail which may or may not get bounced depending on your domain settings and what the email actually has in its header. Please note that any subsequent failure is not the result of FTGate but the result of ISPs using POP3 for a purpose for which it was not designed.

SmartPop Duplicate Delivery

Under some circumstances it is possible to receive duplicate delivery of messages.

FTGateUsersGuide

112

Multiple ISP accounts

This usually occurs when a message is sent to two people and arrives at two accounts at the ISP. If you have two SmartPop accounts and they are both set to have FTGate find the recipient from the header, then each message will be delivered twice. If you have more than one mailbox at your ISP and those mailboxes will receive mail for users at your domain, then you must configure each SmartPop account to deliver all of its mail to the specific user to whom the ISP account is intended. For example, if the ISP account is for [email protected] then you must go into the SmartPop account for bob and make the following changes on the Delivery tab:

1. Set Mode to Manual 2. In Manual Delivery Settings clear the Scan Message Header and the Enable SDPS

checkbox 3. In Delivery Failure set Default Recipient to [email protected] and for Unknown

Recipient select Default 4. Click Apply

This changes should be made for all SmartPop accounts that are assigned to specific employees and should prevent duplicate delivery.

Delivering SmartPop mail to a single user

To configure a SmartPop account to deliver all mail to a single mailbox

1. Select the client tab 2. Click on the SmartPop name 3. Click on the Delivery tab 4. In Delivery Control, set Mode to manual 5. Click Apply 6. In Associated domain, All Hosted Domains 7. Clear Enable SDPS 8. Clear Enable CAPA 9. Clear Filter ID's 10. Clear Scan Message Header 11. In Delivery Failure, set Default Recipient to the recipients mailbox address

and select the option 12. Click Apply

Delivering SmartPop mail to domain users

SmartPop can collect mail from a single ISP Multi-drop Mailbox and distribute the mail to all addressees of the message. It is recommended that SmartPop is placed in its automatic mode when used with a multi-drop mailbox. In the majority of cases automatic mode will be able to correctly deliver all messages. However, some ISP's do not configure their servers in the most appropriate way for handling multi-drop mail. In this case manual configuration of the options may be required, in which case we would recommend contacting [email protected] for further guidance.

To configure SmartPop for automatic mode

1. Select Clients 2. Click on the SmartPop name 3. Click on the Delivery tab 4. In Delivery Control, set Mode to Automatic

Web Admin Interface

113

5. Click Apply 6. In Associated domain, select the required domain 7. In Unknown recipient, select Reject 8. Click Apply

AutoCluster

The unique FTGate replication service is the ultimate ISP or networked multi server administration tool. It allows a network of FTGate servers to be automatically configured from one or more master servers (either Professional Edition or ISP Edition). Not only will this greatly reduce the time spent configuring servers but it will also lead to greater peace of mind knowing that the management tasks are automated, you only need worry about getting the main server right. This system was developed in close collaboration with a large ISP so that this tool would be perfect for the task. We think that you'll be amazed at how easy you can manage an entire network.

AutoClusterSetup

The following are the steps needed to configure a network of FTGate servers Choose one server to be the master server

1. Add a groupware connector service to the master server. 2. Enable the service

The master server is now ready. For each of the slave servers Create an AutoCluster Client

1. Set the required address of the master server 2. Set the required username and password.

This must be the username and password of an administrator on the master server. 3. Set the frequency of checking for updates 4. Enable the client

From now on the AutoClusterwill regularly connect to the master, look for any updates and make any configuration changes to itself required to maintain its operating state with respect to the master server. Job Done ! From now on the administrator only needs to manage one server.

AutoClusterModes

The AutoCluster Client have several modes to allow the administrator maximum configuration flexibility

• Remote Mirror Mode This mode is designed to manage inbound relay servers. The master server has multiple remote domains that are configured to deliver mail to a third party server. The slave servers will all replicate the domains and use the same delivery options. Each domain can have different options and does not need to follow DNS Domain Name Server: A server that answers queries regarding the names and addresses on the internet. MX host routes.

• MX Relay Mode The master server is configured to host one or more local domains (a domain with mailboxes). Each slave will configure itself to transfer mail for those domains straight to the master server.

FTGateUsersGuide

114

Please note that the AutoCluster will NOT copy mailboxes from one system to another.

AutoCluster Settings

Name

Host name : Address of the master server

Port : The port on which the client will connect to the master server

Login name : Enter the login name for the master server

Password : Enter a password, and repeat it as a check, to use for the mailbox.

Inactivity timeout : The period of time from the last communication until the connection will be closed.

Update interval : The period between connections to the master server.

Encryption : This setting specifies whether the master server is set to encrypted mode

AutoClusterMode : This mode controls how the AutoCluster will create domains based on the master server.

• Remote mirror mode • MX mode

Events

Events

The Events section controls periodic events that the server will execute.

Event parameters

Trigger Tab

Only trigger this timer once : Controls whether the timer will trigger once or multiple times.

Trigger Times : • Trigger at this time • Trigger between these times at the specified interval • This timer triggers on the following days of the week : • This timer triggers on the following days of the month :

Action Tab

Web Admin Interface

115

Shutdown FTGate and restart after given interval

Execute enabled tasks (in sequence) : • Network profile • Run the following script • Backup configuration • Start AutoUpdate

Filters

Greylist

For full details on Greylisting please see Greylisting

General Tab

Greylist quarantine : The period of time after the first connection during which subsequent connection will be rejected minutes

Greylist timeout : The period after which unused but validated connections will be purged from the greylist database days

Greylist Zombie timeout : The period after which connections that have never been validated will be purged from the database

Greylist Entries Tab

Greylist entries This list shows the connections that are currently in the greylist database

Adding entries

It is possible to use the greylist to always allow or permanently block an IP/Sender/Recipient set by adding them to the list manually.

Routing

Administrators may wish to alter the normal delivery pattern of an email message. The message routing table allows them to do this. Each message will be compared to the route entries and if a message matches a route, the route will be applied and no further tests will be made.

Examples

The following are some examples of routes that can be applied.

From To Route Effect * [email protected] [email protected] This filter delivers ALL messages

addressed TO [email protected] to [email protected]

[email protected] * [email protected] This filter delivers ALL messages

FTGateUsersGuide

116

FROM [email protected] to [email protected]

[email protected] * blank This filter deletes all messages FROM [email protected]

[email protected] [email protected] blank This filter deletes all messages FROM [email protected] TO [email protected]

* *[email protected]

*@domain.com This filter is used to unravel the mailbox mangling used by some ISP's e.g. the ISP may use the address [email protected]. This identifies the mail as being for [email protected] . The route extracts the "fred" part of the string and creates a new route of [email protected]. The exact form of this route will depend on how an ISP mangles their addresses.

* *@domain.com *@domain2.com This filter causes all messages for the domain domain.com be delivered to the same named user at domain2.com. e.e. messages for [email protected] will be delivered to [email protected]

* *@domain.com *@domain.com|domain2.com This filter causes all messages for the domain domain.com be delivered via the remote domain domain2.com. This can be used to route mail for several domains through to another server that is more suited to handling the mail, or settings up specific routers for specific users. After routing the receipient name is unchanged and will still be for the user in domain.com.

Anti-Virus

Scanner Loaded Specifies which anti-virus scanner module is loaded.

Scanning Mode : • Operating mode of the virus scanner Disable Virus Scanning • Scan files and Quarantine infected messages* • Scan files and Delete infected messages*

* Requires external Anti-Virus application See also Anti-Virus Overview

Quarantine

Access Tab These options control who has access to this object

Contents Tab This tab contains the messages that have been quarantined. They may be redirected or deleted.

Filter Policies

Web Admin Interface

117


Filter Policies

Filter options

These flags govern which filter elements are enabled. The indented options will not run if the parent option is disabled.

Filter Control Which messages are to be filtered

• No filtering • Do not filter messages from Whitelisted addresses • Do not filter messages from Authenticated addresses • Do not filter messages from Authenticated or Whitelisted addresses • Filter all messages

When filtering Options that are applied to messages that to be filtered

Filter message content : The action to be when messages have text or HTML components

• Do not filter message content • Apply policy rules

Filter attachments : The action to be taken when attachments are included in a message Do not filter attachments

• Apply attachment filter to messages • Apply attachment filter and purge HTML scripts from messages

Check messages against UBEBlock+ database : This option causes the messages to be checked with UBEBlock+ database. This causes a deeper message scan to occur looking for content that is known to be from spam sources.

Filter Attachments

The attachment filter defines the actions that should be taken when encountering a message with a specific attachment type. The available actions are:

• Allow The message and attachment are unaltered

• Purge The attachment is removed and a plain text notification inserted in its place

• Quarantine The message is moved into the quarantine folder

• Delete The message is deleted.

Filter Blacklist

FTGateUsersGuide

118

The blacklist contains a list of addresses that are not permitted to send to this domain. Any message from a blacklisted sender will be either rejected by the SMTP server or have the blacklist (BL) flag set for later Filter Rule processing.

Filter Whitelist

The whitelist is used to identify known sources of messages that you do not want to filter. If a message has a whitelisted sender then all SMTP filtering will be bypassed for that message and the WL flag will be set for the filter rule processing. Note: If the SMTP service uses a different filter policy to the domain, then the whitelisted address must appear in both lists.

Include address books When this option is selected then all the address books and mailing lists stored in the FTGate database (not ODBC databases) are included in the whitelist.

Filter Words

A list of words that if found in a message are used to identify that message as being bad. The presence of one or more of these words in a message will cause it to be rejected at the SMTP filter level or have the illegal word (IW) flag set for later filter rule processing. Note: An illegal word must occur in the message with no separator characters.

Filter Phrases

A list of phrases that if found in a message are used to identify that message as being bad. The presence of one or more of these phrases in a message will cause it to be rejected at the SMTP filter level or have the illegal word (IP) flag set for later filter rule processing. Note The phrase filter performs a string match. If a single word is entered into the phrase list then it will match and string which contains those letters. For Example using the phrase bad will match against badly

Filter Safe Words

The safe word list is a list of words which, when occurring in a message, identify the message as being unsuitable for filtering. By default all non-alpha characters are removed from strings that are entered into this list, in order to enter a string with non-alpha characters you must enclose the string in quotes. i.e. "the-string".

UbeBlock Rating

Web Admin Interface

119

UbeBlock normally calculates a spam rating based upon the content of a message. The rating adjustments page provides a set of modifiers that will adjust the UbeBlock rating for certain message features. This can greatly aid the identification of Spam. See Also

• Minimising Junk/UBE mail

Suggested Settings

The following rating adjustments are used on the FTGate Technology servers. We have found them to be effective. Adjustment if recipient's mailbox is in the Subject: 50 Adjustment if there are three or more consecutive spaces in the Subject:

50

Acceptable proportion of unknown words against known words (Unknown ratio)

20

Adjustment when message exceeds Unknown ratio threshold 40 Weighting for images 30 Weighting for external images 75 Weighting for web links 20 Weighting for unknown words 10

Filter Rules

Filter Rule Management


Editing Filter Rules


Configuration

Registration

Server serial number The serial number of the PC generated from the PC's system information

Mailbox Limit The maximum number of mailboxes supported by the current licence

Mailboxes Used The number of mailboxes used in this installation

Mailboxes Remaining The number of mailboxes that can be created

Upgrade Protection and Support Plan (UPSP) expiry date The date at which the UPSP will expire

FTGateUsersGuide

120

The UPSP expiry date is automatically updated when FTGate checks for new versions. However, in the event that after UPSP renewal, FTGate is unable to contact our servers you may have to update the expiry date manually. In this case you should temporarily remove the registration key from FTGate and then add it back in. Then perform a manual activation. Please note that you must create a new activation key in order for the UPSP expiry date to be updated.

Registration Keys These are the registration keys installed on this server. All of the keys need to be activated in order to be functional. See also


System

System Folders : Specifies the location of the system folders.

• Configuration folder • Cache folder • Script library folder • Backup folder

Safe Mode : If the system is in safe mode then only Web Admin is available. No servers (SMTP, POP, IMAP, etc.) are running.

System Restart : Clicking this button will restart FTGate. There will be a pause whilst FTGate restarts and you will be required to go through the Web Admin login to continue administering the system.

Administrators

This page contains a list of users who may log into the Web Admin interface. See Also: Lost administrator passwords

Messages

FTGate offers considerable improvement in the facilities offered when sending any pre-configured message such as a system notification, message bounce, mailbox rule message or list server response. The administrator can now specify if a message will be sent, the character set used by the message and the message body. This is further enhanced as the message body can be written in HTML and FTGate will detect the <HTML> tag at the start of the message body and format the email appropriately. Thus a message of

This is a test message

would be sent as plain text

Web Admin Interface

121

while

<HTML><HEAD></HEAD> <BODY><B>This is a test message</B></BODY> </HTML>

would be sent as an HTML message.

Macro Expansion

FTGate includes some expandable macros that can be used to make the message body specific to a particular message condition or mailbox as follows: Message that System Message is in response to:

$SUBJECT$ $FROMADDRESS$ $TOADDRESS$" $FROMNAME$" $TONAME$" $RCPTADDR$" $SUBJECT$" $HEADER$"

Virus message: $FILE$ $VIRUS$

Mailbox that System Message is about: $MAILBOX$ $NAME$ $ADDRESS$ $COMMONNAME$

Group mailbox tracking message: $TRACKING$

List mailbox messages when in distribution list mode $NAME$ $ADDRESS$

See also

• Customising Messages

Spooler

Spool path The spool path defines the location under which all mailbox folders are stored.

Move Domains Clicking this button will cause all of the domains in this server to be moved to the new spool path (above). Note that this action will cause FTGate to be suspended during the move and then restarted.

Script The spooler runs this script for every message passing through the spooler

Logging

FTGateUsersGuide

122

Details to log Specifies the level of details to include in the event log. Debug includes the most detail while Critical will have the least NOTE: IT IS UNADVISABLE TO RUN A BUSY SYSTEM WITH DEBUG LOGGING ENABLED UNLESS YOU ARE TRYING TO DIAGNOSE A PROBLEM. DEBUG LOGGING PRODUCES A LARGE AMOUNT OF LOGGING INFORMATION AND THIS MUST BE WRITTEN TO THE LOG FILE. THIS HAS THE EFFECT OF REDUCING MOST TASKS TO THE EQUIVALENT OF A SINGLE THREAD AS ONLY ONE TASK CAN WRITE TO THE LOG AT ANY GIVEN TIME. THUS BUSY SYSTEMS SHOULD NOT BE RUN IN DEBUG MODE WITHOUT GOOD REASON.

Log path Specifies the path to be used when creating log files

Billing Billing logs create a record in a fixed format of all emails sent and received

• Do not create a billing log • Create new billing log each month • Create new billing log each day

Notification Send the administrator a message for events of the following level.

Billing Log Contents

The billing log is a comma separated value file with the following fields:

• Date • Time • In/Out • MessageId • Sender • Recipient • Size

Archiving

Archive Enable Storage of all messages that have be processed by FTGate. The message are placed in a pair of files and can be access through either the Archive Web Admin page or the FTGateArchive utility

Archive folder : Create archive files in the following folder.

Archive Duration : Period to hold archive for retrieval by Web Admin (days)

Enable compression : This option causes the data in the archive to be compressed reducing the archive file sizes by approximately 95%

DNS Servers

Web Admin Interface

123

A DNS server is used to convert a text server name into its numeric IP address and to return other information required for mail handling. At least one DNS server is required if you intend to use any of the following features:

• RBL lists ( SMTP and Filter policy) • SMTP PTR record checks • SMTP SPF checks • MX delivery of outbound mail

DNS Servers This contains the list of servers that will be checked.

Direct DNS Queries When this option is selected FTGate will not attempt to contact domain name servers directly but will send all traffic to the DNS servers listed

DNS Timeout The DNS Timout will determine how log FTGate will wait fro a reply before deciding that the DNS is not going to respond.

RBL Sites

An RBL list is a list of addresses that an RBL list supplier believes are a source of Spam. They can be used with FTGate to prevent machines that are listed in the RBL from sending mail to your server. They can also be used by the Filter section to allow filtering of messages received by SmartPop which passed through an RBL listed site. Care should be given when selecting which RBL lists should be included because by using a list you are allowing a third party to determine which servers you will allow to send you mail. Many RBL lists contain machines that are called open relays. These relays may or may not be a source of spam but by their inclusion you would block all mail, both legitimate and spam, from that open relay server. FTGate Technology recommend only the use of Spamhaus lists as they, sbl.spamhaus.org and sbl-xpl.spamhaus.org, do not include open relays.

Network Profiles

This list shows the available network profiles that can be used when connecting to the Internet. The list will always contain LAN and Proxy/Router entries.

Network Profile Options

Connection Tab

User name

Password

Connect timeout

Login timeout

Retry connection after

http://www.spamhaus.org/�

FTGateUsersGuide

124

Attempt limit

Start delay

Actions Tab

ETRN When enabled FTGate sends an ETRN command to the designated address.

POP When enabled FTGate connects to the POP3 mailbox at the designated address. This option should be used if your ISP requires you to connect to a mailbox prior to allowing you to relay.

Priority

Priority Strings : FTGate treats messages with headers lines starting with any of these strings as priority messages.

Auto Update

FTGate contains an auto update facility that will automatically download any updates that are released. The updates can either be applied automatically or under administrator supervision.

• Automatic Update FTGate will download the update, shutdown, apply the update and restart

• Manual Update FTGate will download the update and display a message in WebAdmin informing the Administrator that a patch is available. The Administrator may then apply the update.

Proxy

These settings specify whether, and how, FTGate uses a proxy to connect to the Internet when Activating and running AutoUpdate.

Utility

Utilities

• Mailbox Import Import mailboxes from an XML file into FTGate.

Mailbox Import

The mailbox import page allows the administrator to create one or more mailboxes by importing their definition from an XML file. The XML file has the following format: <?xml version="1.0" encoding="ISO-8859-1" ?>

<mailboxes> <mailbox> <name>mailbox_name</name> <type>7</type>

Web Admin Interface

125

<password>password</password> <givenname> firstname</givenname> <sn>lastname</sn> <initials>initials</initials> <cn>nick name</cn> <o>organisation</o> <ou>department</ou> <title>title</title> <postaladdress /> <l>town</l> <st>street</st> <c>country</c> <postalcode>post code</postalcode> <telephonenumber> tel number </telephonenumber> <facsimiletelephonenumber> fax number </facsimiletelephonenumber> <otherpager>mobile number</otherpager> <url> web url</url> <homepostaladdress> home address</homepostaladdress> <homephone>home phone</homephone> <otherfacsimiletelephonenumber> homefax</otherfacsimiletelephonenumber> <mobile> mobile number</mobile> <info> notes</info> </mailbox>

</mailboxes> The <mailbox>...</mailbox> can be repeated multiple times with different mailbox data. Any fields that are not required can be omitted. The minimum file for creating a single minimal mailbox would be: <?xml version="1.0" encoding="ISO-8859-1" ?>

<mailboxes> <mailbox> <name>mailbox_name</name> <type>7</type> <password>password</password> </mailbox>

</mailboxes> If in doubt about the format it is possible to export the existing mailboxes and examine the file created.

List All Mailboxes


Mailbox Export


Mailbox Import1


127

Groupware

Shared Folders

FTGate now offers groupware as standard. An important aspect of groupware is the ability to share folders. Shared folders allow users collective access to mail and an effective way to keep informed and share information. FTGate uses Access Control Lists to restrict access to shared folders, for example you can just allow one or two users to be able to put messages into a folder, but allow a broader range of people the ability to read the what is there.

Why Use Shared Folders?

Put simply, collaboration makes things simpler and more effective. They allow information to be shared in a controlled way. For example, they allow a group of users access to a common mailbox folder so that they can all read and respond to messages within the folder and be able to see what other people have done with messages in that folder, so everyone sees when a message is read, responded to, flagged, etc. Shared folders just make life easier, and the more you use them the more potential you will see.

Shared Folder Access

The mechanism for sharing folders is IMAP (Internet Messaging Access Protocol). To use it you configure mail client accounts to collect mail via IMAP, rather than POP. Alternatively, you can simply use FTGate's Web Mail. In fact, due to the nature of folder sharing, you can use a mail client and Web Mail and see the same message and folder structure. So if you send a message using Web Mail and have it configured to save sent messages into a sent items folder, you will see the sent message in the appropriate folder in the mail client, i.e. the folders are synchronised.

Uses for Shared Folders

Shared folders have many uses beyond simply letting others see what's in your inbox:

• Collaboration • File Distribution • Announcements • Knowledgebase • Address Books • Spam Training • Quarantine Management

Collaboration

Groups of people, e.g. sales or support staff, can share a mailbox to keep all relevant material in one place, rather than each individual having their own sent items folder, for example.

File Distribution

Network Administrators can use them to distribute files to users on the LAN. The administrator posts a message with the relevant files attached, or link to the files, and all of those with access to the folder can make sure that they have the latest drivers, updates, etc. on their machines.

FTGateUsersGuide

128

Announcements

Administrators, managers, etc. can use them to post announcements to one location, rather than sending messages to every relevant individual.

Knowledgebase

A folder can accumulate a wealth of information available to all those with access. Here at FTGate Technology we maintain a copy of every support email that we send in a folder that is available for all of the support team to refer to.

Address Books

FTGate address books can be made available to a mail client so that you can get at contact information easily.

Spam Training

You can use shared folders to effectively train FTGate to identify Unsolicited Bulk Email (UBE) by the message's content.

Quarantine Management

The quarantine folder can be accessed as a shared folder so that those who have access to it can look at and recover messages that have been quarantined.

Address Books

Address books can be shared and accessed either through Web Mail, LDAP and SolSight. You can also send an email to an address book to have it distributed to each of the members of the address book. Each group mailbox also maintains a shared address book that contains and can be accessed by all members of that group. The primary example of this is the everyone group mailbox, that contains all the mailboxes in a domain and has a shared address book called members.

Mailing an address book:

To send an email for distribution through an address book list you will need to configure your mail client to authenticate against the SMTP server. IP based authentication is not sufficient. Send the message to ABName/[email protected] If you have access rights for this address book the message will be distributed.

LDAP address book searches:

You can search all or some of your address books including those shared by other users. You will be required to use LDAP logon in order to use LDAP. In order to search all your address books you should ensure that the search BASE string is blank. In order to search a specific address book you should specify the address book email address as the BASE.

Groupware

129

Calendar Overview

A calendar event can be for a certain time, between specific times, all day events, or span multiple days. You can designate the type of event, and its priority. You can specify whether the event repeats, and how they repeat. And you can configure FTGate to send a custom notification about the event at a certain time, e.g. as a reminder. Users can have more than one calendar to help organise their events.

Shared Folder Overview

Shared folders allows users collective access to messages, e.g. when a folder is shared by three users then all three users can see, and respond to, the messages in that folder. To utilize shared folders the users must have their mail clients configured to collect mail via IMAP, or use Web Mail.

131

White Papers

White Papers

The following white papers are available:

• Configuring SSL • Disaster Planning • FTGate as a DMZ relay • FTGate as an MX relay • Minimising Junk/UBE mail • Forwarding to remote users in the same domain • Customising Web Mail • Shared Folders

SPAM: Change is coming

Why is change needed?

When FTGate Technology started supplying mail servers, over ten years ago, there was no such thing as spam. When you received a message you knew that it was most likely to be a genuine message that you should take time to read. The world was a nice place where everyone was trusted to only send you messages if they thought you wanted to get them. eMail was cheap, quick and efficient. The Internet was designed with this in mind, protocols were open, easy to implement and had no security at all. Then things began to change. The low cost of sending an email, essentially nil, made it very cost effective to send millions of emails with a marketing message. At first no one really took any notice, one odd email of spam was not a problem. But it didn't stop there, it grew. Now the problem has escalated to the point where there is more spam on the Internet than real mail, and the open protocols, that assumed trust, offer no means to protect ourselves from the deluge. The problem is exacerbated by viruses. Many of these viruses are sent from machines whose owners do not know they are infected. They use random from addresses and often random to addresses and can come from anywhere on the Internet. They don't require a mail client or mail server to run. Organised crime has also joined the game. They use virus infected machines called zombies to source spam to millions of addresses from machines whose users are unaware that this is happening. They use the machines to probe for addresses, phish for bank account details and launch denial of service attacks on companies. As the problem has grown FTGate Technology have successfully introduced more and more features with which to fight spam; word filters, phrase filters, UbeBlock, blacklists, RBL lists and so on. These are all very effective methods of blocking spam which work on trying to identify which messages contain material that we would rather not receive or identifying sources of messages which are known to be bad. However, the spammers are an ingenious bunch and at every stage they have found a means to obscure their message (html, word soup,etc), hide their IP addresses (zombies, open relays, etc), and this has produced an arms race in trying to identify the messages as being spam. We improve detection, they hide the message more skillfully, and it goes on, and on.

A shift in approach

FTGateUsersGuide

132

There is a complete shift in approach going on, and FTGate Technology are part of this being the first Mail server company to officially sign the SPF Community Position pledge. The shift is from a world where we try to identify spam to one where we identify legitimate messages, and assume everything else is junk. There are several approaches to this, some of which are already used:

• White lists (current) Used to identify addresses that we know are good and always want to receive.

• Safe words (current) Words that have special meaning, such as product names, that are unlikely to be part of a junk email

• SPF (new in FTGate4 and being deployed throughout the Internet in 2004/2005) SPF This seeks to verify that a machine sending a message is authorised to send mail for that domain.

• Encryption/Signing (being deployed throughout the Internet 2005/2006) This seeks to verify that the sender is who they say they are.

• Inverse Spam detection. Determine that a message is good rather than it is bad.

A combination of these features can result in a world where spam, viruses and other junk are eliminated completely.

Cleaning up the junk

Once we decide to reverse the problem, assume that most of the mail is junk, and try to find the good stuff we can make some big improvements in the way the mail is handled.

SPF

At the top level we can have our mail servers check that there are valid SPF records for the senders of email, this allows us to reject mail which the sending domain owner says should not be sent, and prevent your domain being used to send mail which is not from you. It works like this:

1. A spammer connects to your server from address a.b.c.d and sends a junk email to you pretending to be from [email protected]

2. The server calls the ftgate.com DNS server and asks "Is a.b.c.d a valid sender for domain ftgate.com"

3. The ftgate.com DNS says no 4. The spam message is rejected

or 1. FTGate Technology send a message from 195.224.16.245 to your server and says it is from

[email protected] 2. The server calls the ftgate.com DNS server and asks "Is 195.224.16.245 a valid sender for

ftgate.com" 3. The FTGate server says yes 4. The message is accepted 5. The message bypasses filtering as it is known to be from a good address

or 1. A customer sends a message to your server from address a.b.c.d saying its from [email protected] 2. The server calls the a.com DSN server and says "Is a.b.c.d a valid sender for a.com"

http://www.openspf.org/OpenSPF_community_position_v101.html�

White Papers

133

3. The server says "I dont know" (either they do not support SPF or they do not know if the address is good for them)

4. The message is accepted 5. The message is passed to the remaining filters for analysis

This shows that as SPF is rolled out through the Internet community the level of trust for incoming messages will rise. Zombie machines, and open relays will be blocked immediately, while spammers will be forced to use traceable domains and addresses which can then be blocked using the RBL systems or blacklists currently in place.

White lists

After the message arrives we can decide if we will filter it or not. A white list tells the server that we trust this address. The server can then deliver the message directly to the users. The problem for an administrator is that they must maintain a white list which for large numbers of users can be very time consuming. FTGate4 has addressed this by allowing the administrator to include the entire server contact address book in the white list, thus allowing users to add their own white list entries through either WebMail or via SolSight.

UbeBlock spam analysis

The latest version of UbeBlock adds the ability to add a weight to unknown words. This makes training of the system very simple. Rather than trying to find every possible example of spam and train the system to identify it, we simply train it with a good sample of valid messages, which we all have in abundance. From that point on a message that contains words that are not in our normal emails will have a higher rating applied to it. Couple this with rating for HTML content and its overall rating and you can practically eliminate junk mail from your system.

Moving Forward

These features are effective, however, there is a down-side. If you will only accept messages from addresses that are SPF validated or white listed users, you can expect other administrators to do the same. This means that you will be expected to authenticate your mail clients and vouch that their IP addresses are valid. This is not hard to do.

1. If you have your own domain name, you should publish an SPF record, or have your hosting company do it for you. If you send directly to the Internet you should list your server addresses If you use an ISP or hosting company you should send through their servers and list their server addresses

2. Have all your mail clients authenticate with SMTP and force them to send using the authenticated address. Do not let them authenticate as [email protected] and send as [email protected] unless you are sure that they have the right to do this, in which case, they should really authenticate as [email protected] anyway. (In the security policy set the SA and AR flag, clear the AA flag)

3. Have all your mail clients send ONLY through your server. This will prevent anyone spoofing your domain as SPF will then block all spoofed mail.

4. If you forward mail, you must change the envelope sender address to a local address, otherwise you will fail the SPF checking because your server will not be valid for the original

FTGateUsersGuide

134

domain. FTGate has done this for some time .

5. If you implement MX forwarding (FTGate remote domains) you should ensure that the receiving server WILL NOT perform SPF checking on the MX relay machines, as this would definitely fail SPF checking. (In the appropriate security policy, add the MX machines IP range and clear the SPF flag).

SmartPop

SmartPop is the poor relation when it comes to anti-spam handling. Because all the mail has already been accepted by your ISP and the IP address information is most likely lost or obscured it becomes much harder to validate that the message is good. For this reason SmartPop does not have any SPF facilities. However, if your ISP implements SPF filtering and adds the required SPF header to the message, the main filters can be bypassed as if the message had been received and validated directly by FTGate.

The future

Over the course of the next few years a variety of techniques designed to limit junk and authenticate users will be tested by the Internet community. They vary from Yahoo's DomainKeys, Microsoft's PRA, IIM and others. As the technology stabilises we will continue to integrate their requirements into our systems. You can be sure that, as usual, FTGate mail servers will deliver your mail reliably and limit the junk you see.

135

Error Messages

Service Error Messages

FTGate categorises all its service error messages by using a reference code at the end of the error line. This code can be used to determine the exact cause of the error message. This section describes those error messages. Code Message Notes ID #1.00 Mailbox Disabled (#1.00) mailbox is disabled in

mailbox or privileges ERR_MAILBOX_DISABLED

#1.01 Mailbox Disabled (#1.01) mailbox is a spamtrap ERR_MAILBOX_SPAMTRAP #1.02 Allocated mailbox storage

exceeded (#1.02) quota error ERR_MAILBOX_QUOTA

#1.03 Out of disk space (#1.03) ERR_MAILBOX_FREESPACE #1.04 Too many connections from your

address (#1.04) 451 4.5.1 [%s] Max concurrent sessions (#1.04) -ERR Too many connections from your address (#1.04)

ERR_MAX_CONCURRENT ERR_SMTP_REJECT_CONCURRENT ERR_POP_CONCURRENT

#2.01 (#2.01) address has been temp blacklisted

ERR_SECPOL_NO_ACCESS

#2.02 (#2.02) address has either BL or no PA

ERR_SECPOL_BLACK

#2.03 (#2.03) RBL hit ERR_SECPOL_RBL #3.01 220 %s (#3.01) ERR_SMTP_SYSTEM_HELLO #3.02 250 2.5.0 Sender <%s> Accepted

(#3.02) ERR_SMTP_SENDEROK

#3.03 235 2.3.5 Auth OK (#3.03) ERR_SMTP_AUTHOK #3.04 250 2.5.0 Recipient OK (#3.04) ERR_SMTP_RCPTOK #3.05 250 2.5.0 Ok Message queued

(#3.05) ERR_SMTP_MESSAGEOK

#3.06 220 2.2.0 ready for TLS (#3.06) ERR_SMTP_TLSOK #3.07 250 2.5.0 Ok (#3.07) ERR_SMTP_OK #3.08 221 2.2.1 Service closing

transmission channel (#3.08) ERR_SMTP_CLOSING

#3.09 250 2.5.0 Mail queue started (#3.09)

ERR_SMTP_QUEUESTARTED

#3.10 354 3.5.4 Start mail input; end with <CRLF>.<CRLF> (#3.10)

Authentication continue response

ERR_SMTP_DATASTART

#3.11 334 ERR_SMTP_334 #3.12 451 4.9.9 %s Invalid EHLO (#3.12) ERR_SMTP_TARPIT #3.13 451 4.2.1 %s mailbox disabled

(#3.13) ERR_SMTP_MAILBOX_DISABLED

#3.14 451 4.2.2 %s mailbox full (#3.14) ERR_SMTP_MAILBOX_FULL #3.15 451 4.2.2 %s mailbox access error

(#3.15) ERR_SMTP_MAILBOX_TOAST

#3.16 451 4.3.1 mail system is full (#3.16) ERR_SMTP_SYSTEM_LENGTH #3.17 451 4.3.5 system configuration

error (#3.17) ERR_SMTP_SYSTEM_CONFIGERR

#3.19 450 4.7.1 Server busy please try again later. See http://tinyurl.com/39pwkl (#3.19)

ERR_SMTP_GLFAILDATA

#3.20 450 4.7.1 Server busy please try again later. See http://tinyurl.com/39pwkl (#3.20)

ERR_SMTP_GLFAILRCP

#3.21 450 4.7.1 Please authenticate and try again (#3.21)

See:Managing Services and Security Policies/Options;Anti-Spoofing

ERR_SMTP_SPOOF

#3.22 450 4.3.5 System error, please try again (#3.22)

ERR_SMTP_HARDERROR

FTGateUsersGuide

136

#4.21 500 5.5.1 Syntax Error (#4.21) ERR_SMTP_SYNTAX #4.22 500 5.5.1 Syntax Error (%s) (#4.22) ERR_SMTP_SYNTAX2 #4.23 500 5.5.1 Bad command (#4.23) ERR_SMTP_SYNTAX3 #4.24 500 5.0.0 Domain Not Found

(#4.24) ERR_SMTP_DOMAINNOTFOUND

#4.25 550 5.1.1 %s bad destination mailbox address (#4.25)

ERR_SMTP_ADDRESS_BAD

#4.26 550 5.1.1 %s invalid mailbox address (#4.26)

ERR_SMTP_ADDRESS_INVALID

#4.27 550 5.1.2 %s invalid domain (#4.27)

ERR_SMTP_ADDRESS_DOAMIN

#4.28 550 5.1.1 %s unknown mailbox (#4.28)

ERR_SMTP_ADDRESS_UNKNOWN

#4.29 550 5.1.1 %s unknown mailbox. You are so booted (#4.29)

ERR_SMTP_ADDRESS_UNKNOWN2

#4.30 550 5.1.3 %s bad address syntax (#4.30)

ERR_SMTP_ADDRESS_SYNTAX

#4.31 550 5.1.4 ambiguous address (#4.31)

ERR_SMTP_ADDRESS_AMBIGUOUS

#4.32 500 5.0.0 sequence error (#4.32) ERR_SMTP_ADDRESS_SEQUENCE #4.33 516 2.1.6 %s moved (#4.33) ERR_SMTP_ADDRESS_MOVED #4.34 550 5.1.7 %s bad sender's address

(#4.34) ERR_SMTP_ADDRESS_SENDER

#4.35 550 5.0.0 Sorry too many recipients (#4.35)

ERR_SMTP_ADDRESS_RCPTCOUNT

#4.36 550 5.1.8 %s sender's domain does not exist (#4.36)

ERR_SMTP_ADDRESS_SENDERSPOOF

#4.37 502 5.5.2 Syntax Error (#4.37) ERR_SMTP_ARGUMANT #4.38 553 5.5.3 too many recipients

(#4.38) ERR_SMTP_RCPTCOUNT

#4.39 550 5.2.3 message size exceeds administrative limit (#4.39)

ERR_SMTP_MESSAGE_LENGTH

#4.40 554 5.6.0 Malformed message header, require FROM:, TO:, DATE:, SUBJECT: (#4.40)

ERR_SMTP_MESSAGE_HEADER

#4.41 560 5.6.0 Prohibited Message Content (#4.41)

ERR_SMTP_MESSAGE_CONTENT

#4.42 560 5.6.0 %s (#4.42) ERR_SMTP_MESSAGE_OTHER #4.43 560 5.6.0 Message body not found

(#4.43) ERR_SMTP_MESSAGE_BODY

#4.44 500 5.0.0 [%s] DNS Blackhole Rejection (#4.44)

ERR_SMTP_REJECT_RBL

#4.45 500 5.0.0 [%s] IP rejected (#4.45) ERR_SMTP_REJECT_IP #4.46 500 5.0.0 [%s] PTR record is blank

- reverse DNS lookup failed (#4.46) ERR_SMTP_REJECT_PTR

#4.47 500 5.0.0 Sequence Error - zombie terminated (#4.47)

ERR_SMTP_SYSTEM_ZOMBIE

#4.48 530 5.3.0 Must issue STARTTLS first (#4.48)

ERR_SMTP_TLSREQUIRED

#4.49 550 5.1.8 Sender must be hosted on this server (#4.49):

ERR_SMTP_ONLYHOSTED

#4.50 535 5.3.5 Auth Failed (#4.50) ERR_SMTP_AUTHFAILED #4.51 503 5.0.3 Already Authorised

(#4.51) ERR_SMTP_AUTHFAILED2

#4.52 535 5.3.5 Unrecognised response (#4.52)

ERR_SMTP_AUTHWTF

#4.53 504 5.0.4 Unrecognised Authentication type (#4.53)"

ERR_SMTP_BADAUTH

#4.54 530 5.3.0 Authentication required (#4.54)

ERR_SMTP_AUTHREQUIRED

#4.55 560 5.6.0 Too many addresses in header (#4.55)

ERR_SMTP_BULKFAILED

#4.56 560 5.6.0 Too many hops (#4.56) ERR_SMTP_HOPSFAILED #4.57 500 5.0.0 Channel already secure

(#4.57) ERR_SMTP_SECUREFAILED

#4.58 500 5.0.0 Cannot switch to secure channel (#4.58)

ERR_SMTP_SECUREFAILED2

#4.59 560 5.6.0 %s (#4.59) ERR_SMTP_SPFFAIL #4.60 550 5.5.0 Sender rejected (#4.60) ERR_SMTP_SENDERBLACKLISTED

Error Messages

137

#4.61 550 5.5.0 The address %s does not match your authenticated address (#4.61)

ERR_SMTP_AUTHMISMATCH

#4.62 550 5.5.0 Sender domain could not be confirmed (#4.62)

ERR_SMTP_SENDERDOMAIN

#4.63 550 5.5.0 Relaying Denied <%s> (#4.63)

ERR_SMTP_RELAYFAIL

#4.64 550 5.5.0 Relaying Denied <%s> Again - go away (#4.64)

ERR_SMTP_RELAYFAIL2

#4.65 550 5.5.0 Access Denied <%s> (%s) (#4.65)

ERR_SMTP_ACCESSDENIED

#4.66 550 5.5.0 Access Denied (#4.66) ERR_SMTP_ACCESSDENIED2 #4.67 550 5.5.0 No Route Found (#4.67) ERR_SMTP_GLACCESSDENIED #4.68 550 5.5.0 String does not match

anything (#4.68) ERR_SMTP_NOMATCH

#4.69 550 5.5.0 No Members (#4.69) ERR_SMTP_NOMEMBERS #5.00 -ERR Mailbox Access Error (#5.00) mailbox is broken ERR_POP_ACCESS #5.01 -ERR Access Denied (#5.01) mailbox has no pop3

privileges ERR_POP_ACCESSDENIED

#5.02 -ERR Syntax Error (#5.02) ERR_POP_SYNTAX #5.03 -ERR TLS Required (#5.03) ERR_POP_TLS #5.04 -ERR Plain text login disabled, use

APOP or TLS (#5.04) ERR_POP_SECUREAUTH

#5.05 -ERR <%s> Mailbox Disabled (#5.05)

ERR_POP_DISABLED

#5.06 -ERR Login Error (#5.06) ERR_POP_LOGIN #5.07 -ERR <%s> Mailbox Locked

(#5.07) ERR_POP_LOCKED

#5.08 -ERR Login Error (#5.08) ERR_POP_LOGIN2 #5.09 -ERR Login Error (#5.09) bad password ERR_POP_LOGIN3 #5.10 -ERR invalid message number

(#5.10) ERR_POP_MESSAGENUM

#5.11 -ERR message deleted (#5.11) ERR_POP_DELETED #5.12 -ERR message unavailable (#5.12) ERR_POP_MESSAGEFAILURE #5.13 -ERR no such message , only n

message in mailbox (#5.13) ERR_POP_MESSAGECOUNT

WebAdmin Login Messages

After logging onto WebAdmin the following error messages may be displayed Error Code Meaning #6.01 The FTGate server is currently running in its 30day trial mode. The number of days

of trail remaining are indicated. To remove this licence you should install an existing licence key or purchase a licence key.

#6.02 The FTGate server 30day trial has finished and the server requires that a registration key be installed and activated in order to continue use of the server.

#6.03 The server has been suspended for the indicated reason #6.04 The FTGate server is licensed but not activated. In order to continue using FTGate

it should be restarted and the server activated. #6.05 The server has one or more un-activated licence keys and will stop working one

hour after it was last restarted. #6.06 The servers UPSP is expiring or has expired. You should renew the UPSP as you

no longer have support and upgrade protection. #6.07 UBEBlock+ is disabled due to UPSP expiry. #6.08 There is an update available for installation #6.09 An error occurred while checking for updates #6.10 The FTGate anti-virus start up test failed. Your anti-virus product is either

configured incorrectly or not installed. #6.11 Your anti-virus product is scanning the spool/inbox. This can cause problems if the

FTGateUsersGuide

138

anti-virus product blocks access to the file that FTGate is using. It is recommended that this folder be excluded from the on demand/access scanning in your anti-virus product.

#6.12 The version you have is a beta test version that will cease to operate on the specified day. Beta version are regularly updated so you should either perform an auto-update or check regularly for manual updates in the support forums.

139

Update History

FTGate History

FTGate Technology was established in 1994, you can be confident when purchasing FTGate that the product is built on the extensive experience of one of the longest and most respected suppliers in the industry.

Historical time line for FTGate:

• Jan 2009 FTGate6 released

• July 2007 FTGate5 released

• June 2005 Company renamed to FTGate Technology Ltd

• November 2004 FTGate4 and SolSight released

• March 2003 FTGateRelay V1.0 Released (FTGate3.22 engine)

• Feb 2003 FTGateUbeBlock V1.0 released

• Jan 2003 FTGateOffice/FTGatePro V1.2 Released (FTGate3.2 engine)

• Sept 2002 FTGateOffice/FTGatePro V1.1 Released (FTGate3.1 engine)

• Dec 2000 FTGate3 released as FTGateOffice and FTGatePro V1.0

• Sept 1998 FTGate V2.0 released

• April 1997 First Internet sales of FTGate V1.0

• Jan 1997 RBGate renamed FTGate

• June 1995 First sales of RBGate begin

• Nov 1994 Work started on First Mail server (RBGate)

FTGateUsersGuide

140

FTGate2009 SR1

Updates in this release

• Archive viewing and handling improved Archive

• SmartPop layout improved

• Added support for '&' character in the phrase lists

• Modified SMTP so that SMTP AUTH overrides PTR, RBL, HELO and SPF failures.

• Customising the sign in has been simplified Customising SolSight Web

• New sign in box created

• Made Anti-Virus self test at startup an optional action

• Added fast expire option to the Outbox and Remote domains General

• Added DNS timeout control so users can now set the DNS timeout DNS Servers

• Added a 4XX promotion option General

• Bug fixes

Update 6.0.002

• Improved spam detection • Added spam fingerprinting and auto-update of fingerprint files • Fixed auto-update notification formatting.

141

Credits

FTGate is the vision and work on one man, practically everything you see was written by Richard Bang. The following tools an components were used in some parts of the program. DHTMLGoodies - A library of DHTML and AJAX scripts WYZZ - WYSIWYG editor

http://www.dhtmlgoodies.com/�

http://www.wyzz.info/�

143

Glossary

P Pattern matching characters: The characters * and ? when used in an address or string. e.g.

*@domain.com, bob@domian.*, etc

U UPSP: Upgrade Protection and Support Plan

145

Index

A Access .... 11, 15, 22, 44, 47, 50, 71, 77, 80, 83

Archive ....................................................... 71 Calendaring ............................................... 83 Interface ..................................................... 44 Local Admin ............................................... 83 POP3 ......................................................... 83 SMTP ......................................................... 50 UBEBlock................................................... 11 Web Admin ................................................ 47 Web Mail .................................................... 83 Web Services ............................................ 22 WebMail ..................................................... 22

Access button .............................................. 127 Access Control .............................................. 77 Access Control Lists .............................. 52, 127 Access Level ................................................. 47 Access mail ..................................................... 8

browser based interface with which ............ 8 Access Tab.. 83, 100, 101, 102, 103, 104, 105,

106, 107, 116 Account ......................................................... 34

user against ............................................... 34 Account/email ................................................ 45 ACKNOWLEDGMENT .................................... 1 ACL ............................................................... 52 Action Tab ........................................... 114, 123 Activating .........................................17, 45, 124

Licence Key ............................................... 45 Licences..................................................... 17

Activation FAQ .............................................. 45 Active Directory .......................... 25, 31, 82, 85 Active Directory Migration ............................. 25 Active Directory Support ................................. 5 Activity ........................................................... 77 Additional Clients .......................................... 74 Additional Mailbox ......................................... 17 Address Books ................... 8, 47, 88, 127, 128 Address/port ................................................ 104 Administrators ..................................... 120, 124

informing .................................................. 124 Agreement ....................................................... 1 Alias Domains ............................................... 79 Alias Mailbox ................................................. 80 All Hosted Domains ..................................... 112 Allocated........................................................ 17 Allow Addresses ............................................ 48 Allow EXPN ................................................... 97 Allow Relaying ............................................... 48 Allow SMTP ................................................... 91 Allow SUBSCRIBE ........................................ 89 Alternative Scanner Support ......................... 65 Anti-spam Enhancements ............................. 11 Anti-Virus .............................. 5, 27, 65, 76, 116 Anti-Virus Overview ....................................... 65 AnyLogin ....................................................... 45

APOP .............................................................. 5 Appointments .................................................. 8 Archive .................................................... 71, 78

Accessing .................................................. 71 Archive Actions ............................................. 71 Archive Duration ......................................... 122 Archive Enable ............................................ 122 Archive Files ................................................. 71 Attachments .................................................. 88 AUTH ...................................................... 48, 67 Authenticate .................................... 27, 31, 117

LAN............................................................ 27 Authenticated Relaying ................................. 50 Authentication ......................................... 50, 65 Authorised ....... 27, 48, 50, 60, 64, 65, 122, 131 Auto Authenticate .......................................... 50 Auto Update ............................................ 5, 124 Autoban ......................................................... 48 AutoCluster ................................. 5, 20, 74, 113

AutoCluster Overview................................ 20 AutoCluster POP3 Proxy ........................... 74 AutoCluster POP3 Proxy Service .............. 74 AutoCluster Settings................................ 113 AutoClusterMode ..................................... 113 Configuring ................................................ 74 Create ...................................................... 113

Automated Self Training ............................... 68 Automatic Authentication ........................ 14, 48 Automatic Update ....................................... 124 Auto-reply ...................................................... 86

Send .......................................................... 86 Autoresponder .............................................. 86

Creating ..................................................... 86 AutoUpdate ................................................. 124

running .................................................... 124 B Backup .......................................................... 70 Banning ......................................................... 31

words/Phrases ........................................... 31 Basic Protection ............................................ 68 Billing........................................................... 121

Log Contents ........................................... 121 Blackhole Lists .................... 27, 48, 60, 64, 122 Blacklisted Address ....................................... 48 Block ............................................. 31, 115, 131

IP/Sender/Recipient ................................ 115 spam ........................................................ 131 Viruses ...................................................... 31

Browser Compatibility ................................... 14 Bypassing ............................................... 61, 97

greylist ................................................. 61, 97 C Calendar Overview ..................................... 129 Check Mailboxes ........................................... 25 Cisco PIX firewalls ........................................ 31 Clear Enable CAPA .................................... 112

FTGateUsersGuide

146

Clear Enable SDPS ..................................... 112 Clear Filter ID's ............................................ 112 Clear Scan Message Header ...................... 112 Client Configuration ....................................... 25 Client Services ................................................ 5 Clients ................................................... 74, 108

Managing ................................................. 108 Closed list ...................................................... 91 Common Tasks ............................................. 31 Compressed Archive ....................................... 5 ConfigBackup ................................................ 70 Configuration .............................. 10, 17, 23, 68 Configuring .. 15, 27, 31, 41, 44, 48, 52, 71, 74,

108 AutoCluster ................................................ 74 FTGate .................................... 31, 44, 48, 52 FTGate spam ............................................. 31 FTGateArchive .......................................... 71 LAN ............................................................ 52 Replication ................................................. 27 Replicator................................................... 27 ServerA ...................................................... 15 SmartPop ........................................... 41, 108 SSL ............................................................ 52

Confirm SUBSCRIBE .............................. 89, 91 Connecting ..... 15, 22, 31, 74, 94, 98, 123, 124

FTGate ................................................. 22, 31 Groupware ................................................. 74 internet ................................ 15, 94, 123, 124 LDAP ......................................................... 98 multiple offices ........................................... 15

Connection .............................................. 92, 94 Connection Options ................................. 41, 94 Connection Tab ........................................... 123 Connection Types ......................................... 37 Connection/Host Name ................................. 15 Connection/Login .......................................... 15 Connection/Network Profile........................... 15 Connection/Password ................................... 15 Connection/Port ............................................ 15 Contact Database ........................................... 5 Contact Notes ................................................. 8 Contacts/events/tasks ................................... 47 Contents .................................................. 88, 93 Contents Tab ............................................... 116 Copyright ......................................................... 4 Creating Domains ......................................... 41 Customer Tracking Options ............................ 8 Customising Web Mail ................................ 131 D Database support .......................................... 47 Debug Logging ........................................ 10, 91 Default Global Security Policy ....................... 15

altered ........................................................ 15 Default LAN Security Policy .......................... 22

form ............................................................ 22 Default Language ........................................ 102 Default Mailboxes .......................................... 80 Delivery Control ........................................... 112 Delivery Failure ................................... 111, 112

Delivery Mode ......................................... 41, 94 Delivery Optimisation .................................... 93 Delivery Route ........................................ 41, 94 Delivery/Delivery Control .............................. 15 De-Militarised-Zone ....................................... 27 Details ........................................................... 10 Dialup Support ................................................ 5 Disaster Planning .......................................... 68 Disclaimer ....................................................... 5 Distributed Clustering.................................... 20 DMZ ........................................................ 27, 79 DNS.............20, 23, 31, 41, 48, 60, 65, 94, 122 Domain Aliases ............................................... 5 Domain List ................................................... 41 Domain Name Server ......... 27, 41, 48, 94, 122 Domain type ............................................ 27, 41 Domains .................... 19, 25, 27, 31, 41, 67, 79

Creating ............................................... 25, 27 Managing ................................................... 79 name.......................................................... 27

Domains, Mailboxes ...................................... 19 DSN Mailbox ................................................. 80 E Edit Service Policy Settings .......................... 31 Eicar.com ...................................................... 65 Emergency Recovery.................................... 46 Eml file .......................................................... 71 Enable SDPS .............................................. 111 Encryption Tab ... 100, 101, 102, 103, 104, 105,

106, 107 Envelope ..................................................... 109 Error Dialog ................................................... 37 ESMTP ...................................................... 5, 41 ETRN .................................................... 92, 123 Eudora .......................................................... 37 Example Headers ....................................... 109 Expunge ........................................................ 37 F FAQ ................................................................. 9 FAX ............................................................... 12 Fdb file .......................................................... 26 Filter Attachments ....................................... 117 Filter Blacklist .............................................. 117 Filter Control ............................................... 117 Filter Ids ...................................................... 111 Filter options ............................................... 117 Filter Phrases .............................................. 118 Filter Policy ..................................... 82, 91, 101 Filter Policy Rules ......................................... 65 Filter Policy/UbeBlock ................................... 60 Filter Rule Management.............................. 119 Filter Rules .............................. 63, 64, 117, 119 Filter Safe Words ........................................ 118 Filter Whitelist ............................................. 118 Filter Words ................................................. 118 Filter/Routes .......................................... 14, 111 Filtering ................... 5, 31, 54, 60, 82, 122, 123 Firewall ports ................................................. 22 Folders .................................................. 86, 127 Forward ..................................... 14, 15, 81, 131

Index

147

Frequently Asked Questions ........................... 9 FTGate Technology Limited .......................... 12 FTGate UPSP ............................................... 11 FTGateArchive .............................................. 71 FTGateIcon .......................................70, 72, 73 FTGateLog .................................................... 73 FTGateMonitor ..................................72, 73, 98 Full Backup.................................................... 70 Full Restore ................................................... 70 Fully Qualfied Mailbox Name ........................ 44 G Global Security Policy .......................14, 22, 48 Grey Listing ..................................................... 5 Greylist ............................................61, 97, 115 Greylist Entries Tab ..................................... 115 Greylist SPF .................................................. 97 Greylist Zombie ........................................... 115 Greylisting whitepaper ................................... 61 Group ......... 8, 19, 25, 41, 47, 67, 86, 108, 127 Group Mailboxes ....................................... 5, 80 Group Members ............................................ 89 Groupware..................................................... 74

connecting ................................................. 74 Groupware Connector .......................5, 98, 107 Groupware Features ....................................... 8 H Hosted Domains ............................................ 41 I IMAP .. 8, 13, 19, 22, 25, 31, 37, 67, 68, 80, 82,

84, 86, 98, 105, 120, 127, 129 Install FTGate ............................. 25, 26, 27, 70 Instant Notifications ......................................... 8 Internal Backup ............................................. 70 Internal Restore ............................................. 70 ISP's pop3 ..................................................... 19 L LDAP ............................ 5, 22, 31, 98, 103, 128 Licence Agreement ......................................... 1 Licence Key ............................................. 17, 45

Activating ................................................... 45 Installing..................................................... 17

List Mailboxes ............................................... 80 Local Domains ........................................ 36, 79 Local mailboxes ............. 19, 41, 108, 109, 112 Log Contents ............................................... 121

Billing ....................................................... 121 Login Security Override ................................. 45 Low Security .................................................. 34 M Macro Expansion .................................. 39, 120 Mail . 15, 19, 25, 40, 41, 68, 108, 109, 112, 131

downloads......................... 41, 108, 109, 112 Migrating .................................................... 25 Receiving ............................................. 19, 40 Sending..........................................15, 19, 41

Mail Delivery Failure .................................... 109 Mail Flow ....................................................... 35 Mailbox . 5, 25, 31, 39, 41, 47, 50, 80, 108, 120 Mailbox Alias ............................................. 5, 31 Mailbox Count ............................................... 17

Mailbox Limit ............................................... 119 Mailbox Rules ................................................. 5 Mailbox Types ............................................... 80 Mailboxes Remaining.................................. 119 Mailboxes Used .......................................... 119 Mailed Reminders ........................................... 8 Main Feature List ............................................ 5 Manual Delivery Settings ............................ 111 Max Recipients ............................................. 97 Members ....................................................... 90 Message Limits ............................................. 97 Migration ................................................. 25, 82 Minimising Junk/UBE .................................... 60 Minimum Requirements ................................ 13 Monitor Port .................................................... 5 Move Domains ............................................ 121 Multiple Address Books .................................. 8 Multiple Calendars .......................................... 8 Multiple DNS ................................................... 5 Multiple Folders ............................................... 5 Multiple IP ....................................................... 5 Multiple ISP ................................................. 111 Multiple offices .............................................. 15 Multiple Task Lists .......................................... 8 MX ... 5, 20, 23, 27, 31, 40, 41, 61, 68, 94, 113,

122, 131 MX DNS ........................................................ 27 MX Hosts .......................................... 41, 93, 94 MX Mode ....................................................... 27 MX Records ............................................ 41, 94 MX Relay Mode .......................................... 113 MySql ............................................................ 47 N Navigation Panel ........................................... 76 Network Administrators ............................... 127 Network Profile ................................ 41, 94, 123 Network Storage ........................................... 23 New Machine ................................................ 26 New server .................................................... 26 Notes ............................................................. 88 Notifications .................................................. 91 Notspam ........................................................ 67 Null Mailbox .................................................. 80 O ODBC ........................................ 47, 85, 90, 118 Options Tab100, 101, 102, 103, 104, 105, 106,

107 Outbound SMTP Auth ................................... 40 Outbox 5, 14, 19, 23, 35, 76, 78, 81, 91, 94, 95 Outlook .................................................... 31, 98 Outlook 2002/XP ........................................... 37 Outlook Connector .......................................... 8 Outlook Express ...................................... 37, 71 P PA ............................................... 14, 22, 48, 50 Password ................................................ 34, 85 Permissions/Access rights ............................ 47 Permit SMTP Autentication ........................... 48 Personal Details ............................................ 85 Phish ........................................................... 131

FTGateUsersGuide

148

Phrase Filter .................................................. 31 Policies Tab ................................................... 95 Policy ............................................................. 48 Policy Access Rights .........................50, 95, 97 Policy Service Control ................................... 96 POP ............................................ 120, 123, 127 POP Proxy..................................................... 20 POP3 . 5, 13, 14, 15, 19, 22, 25, 34, 40, 76, 79,

80, 82, 83, 86, 91, 98, 100, 101, 102, 103, 104, 105, 106, 107, 111, 123

POP3 Migration ............................................. 25 Post Office Protocol V3 ...... 13, 25, 48, 52, 109 Postmaster .................................................... 81 Priority Strings ............................................. 124 Privileges ....................................................... 83 Product Support ............................................ 10 Proxy .............................................37, 104, 124 Proxy Type .................................................. 104 Proxy/Router ............................ 37, 41, 94, 123 Purge Scripts ................................................... 5 Purge/Quarantine/Delete ................................ 5 Q Quarantine............................................... 5, 116 Quarantine Management ............................ 127 Queue Options .............................................. 93 Queue Status .................................................. 5 Queues .......................................................... 78 Quota Notification .......................................... 83 R RBL ............................ 22, 40, 48, 68, 123, 131 Real time Blackhole Lists ............................ 123 Recurrent Events ............................................ 8 Registration ........................................... 17, 119 Registration Keys ........................................ 119 Registration Overview ................................... 17 Relay Control ................................................ 50 Relay Edition ...................................20, 74, 108 Remote Domain ............................5, 35, 41, 79 Remote Domain/Connection ......................... 23 Remote Mirror Mode ................................... 113 Remote Monitor ............................................... 5 Remote POP3 mailboxes ..... 41, 108, 109, 112 Remote Relay Domains .................................. 5 Remote users ................................................ 14

Forwarding ................................................. 14 Restart FTGate ............................................. 70 Rights ................................................1, 67, 127 Robot Mailboxes ........................................... 86 Root.login ................................................ 34, 80

defining ...................................................... 80 Router Modem .............................................. 37 Routing .................................................. 76, 115 Rules ............................................................. 86 S Safe Mode .......................................23, 46, 120 Safe Word List ................................................. 5 Safe Words.................................................... 65 Safe-Mode FTGate ....................................... 46 Scan Message Header ................................ 111 Scanning ................................................. 5, 116

Script Folders .............................................. 102 Scripts Tab .................................................. 102 Searchable Archive ......................................... 5 Searchable Log ............................................... 5 Security Policies . 48, 65, 95, 96, 100, 101, 102,

103, 104, 105, 106, 107 Security Policy IP Options ............................ 50 Security Policy Tab .... 100, 101, 102, 103, 104,

105, 106, 107 Segmented Cluster ....................................... 68 Send 15, 19, 27, 31, 36, 41, 48, 64, 81, 86, 109 Send Copy .................................................... 84 Send SMTP mail ........................................... 41 Sender Policy Framework .... 27, 48, 60, 64, 65,

122 Sending/Receiving ........................................ 31 Server Statistics .............................................. 5 Service Access List .... 100, 101, 102, 103, 104,

105, 106, 107 Service Overview .......................................... 40 Service Types ............................................... 98 Services ............................................ 23, 52, 95 Services Tab ................................................. 95 Share button ........................................... 77, 86 Shared ........................................................ 127 Shared Folder Access................................. 127 Shared Folder Overview ............................. 129 Shared Folders ....................................... 8, 127 Shared Folders dialog ................................. 127 Show Status .................................................. 72 Shutdown FTGate ....................................... 114 Sign In ..................... 25, 40, 41, 44, 45, 48, 128 Signature ................................................. 86, 91 Signatures/Disclaimers ................................. 41 Simple Mail Transfer Protocol .... 27, 36, 40, 41,

48, 50, 52, 60, 94, 108, 109, 122, 128 SmartPop ....... 5, 14, 15, 19, 31, 35, 40, 41, 76,

108, 109, 111, 112, 123, 131 SmartPop delivery problems ....................... 111 SmartPop Duplicate Delivery ...................... 111 SmartPop/Delivery ...................................... 111 SMTP .5, 14, 15, 19, 22, 25, 27, 31, 34, 35, 36,

40, 41, 48, 50, 54, 61, 63, 65, 76, 79, 83, 84, 91, 92, 93, 94, 97, 98, 101, 109, 117, 118, 120, 122, 131

SMTP Authentication ................................ 5, 50 SMTP Errors ................................................. 48 SMTP Greylisting .......................................... 61 SMTP Hosts ................................ 15, 41, 93, 94 SMTP Send ................................................... 52 SMTP Welcome Text .................................... 97 SOFTWARE LICENCE AGREEMENT ........... 1 SolSight Chat .................................................. 8 SolSight Web ................ 80, 82, 84, 86, 98, 102 SolSight™ ................................................... 1, 4 SPAM .....20, 27, 31, 35, 41, 48, 54, 60, 61, 64,

66, 67, 68, 76, 84, 94, 117, 118, 122, 123, 131

Spam Training ............................................. 127 Special Recipient .......................................... 64

Index

149

SPF .................................... 48, 60, 65, 97, 131 Spool Path ............................................... 23, 26 SQL .................................. 5, 47, 80, 85, 89, 90 SQL Based Mailing Lists ............................... 47 SQL Database ............................................... 85 SQL list .................................................... 47, 90 SSL ....... 5, 52, 53, 92, 100, 101, 102, 105, 107 SSL self signed certificates ........................... 53 SSL Support .................................................. 52 Starter Packs ................................................. 17 Startup.fts file ................................................ 46 Statistics ........................................................ 78 Status Monitor ................................................. 5 Support FAQ ................................................. 10 Support Forums ............................................ 10 Support Plan ......................................... 11, 119 Supported Systems ....................................... 13 Supported Versions ....................................... 10 System Administrators .................................. 47 System Folders ........................................... 120 System Mailbox .................................19, 67, 80 System Message ......................................... 120 System Requirements ................................... 13 System Restart ............................................ 120 T Task Lists ........................................................ 8 Tasks ............................................................. 88 Time Tab ....................................................... 83 TLS ....... 5, 52, 53, 92, 100, 101, 102, 105, 107 Tools/Options ................................................ 71 TRACKING ............................................ 39, 120

Tracking ID .................................................... 89 Training ................................................... 31, 82 Trashcan ............................................. 5, 37, 84 U UBE ........................................... 40, 60, 64, 127 UbeBlock .. 5, 11, 31, 47, 54, 60, 66, 67, 68, 80,

82, 117, 118, 131 Unsolicited Bulk Email ................................ 127 Upgrade Protection Plan ............................... 11 UPSP .......................................... 5, 10, 11, 119 UPSP Status ................................................. 10 User Folders ................................................. 47 User Interface Guide ..................................... 75 User Mailboxes ......................................... 5, 80 V Virtual Folders ............................................. 102 Virtuals Tab ................................................. 102 Virus .................................... 31, 39, 60, 65, 120 VRFY............................................................. 97 W WAN .................................................. 22, 48, 52 Web Administration ........................... 14, 44, 74 Web Browsers ............................................... 13 Web Mail ................... 14, 83, 86, 127, 128, 129 White Paper .......................................... 68, 131 Whitelisting .............................................. 61, 63 X X-listserver .................................................. 109 X-Recipient ................................................. 109 XTRASH IMAP .............................................. 37

FTGateUsersGuide

Documents

slightly smarter

appointments

web admin

pattern matching

subject fromaddress

mx recordsmx

intellectual

minimising