PreciseMail Anti-Spam Gateway Management Guide, UNIX Edition

Contents

Preface
Preface	Preface
Chapter 1
1	Overview of PreciseMail Anti-Spam Gateway Operation
1.1	PreciseMail Anti-Spam Gateway Directory Overview
1.2	PMDF or Sun Messaging Server and PreciseMail Anti-Spam Gateway
1.3	SendMail and PreciseMail Anti-Spam Gateway
1.4	The PMAS Pass-Through SMTP Server
1.4.1	MX records
1.4.2	Identifying internal IP addresses
1.4.3	Enabling SMTP-Over-TLS Support
1.4.4	DNSBL "DNS Blackhole List" Support
1.4.4.1	Configuring PMAS DNSBL support
1.4.4.2	DNSBL commands
1.4.5	RHSBL "Right-Hand-Side Blackhole List" Support
1.4.5.1	Configuring PMAS RHSBL support
1.4.5.2	RHSBL commands
1.4.6	Anti-Relay Support
1.4.6.1	How the PMAS PTSMTP Anti-Relay works
1.4.6.2	Site-specific address verification
1.4.6.3	Configuring the Anti-Relay support
1.4.7	Sender Policy Framework (SPF) Support
1.4.7.1	Using SPF results to detect spam
1.4.7.2	Enabling SPF and writing SPF rules
1.4.7.3	Configuring SPF
1.4.8	Tarpitting Support
1.5	Message Scoring for Spamicity
1.5.1	Matching rules
1.5.2	Allow and Block Lists
1.6	Email Message Disposition
1.6.1	Quarantining Messages
1.6.2	Discarding Messages
1.6.3	Modifying and Forwarding Messages
1.6.4	Rejecting Messages
1.7	Logging
1.8	Statistics
1.9	The Alias File
1.9.1	Regular expressions
1.9.2	Special Mailing List Aliases
1.9.3	Authentication Aliases
1.10	PreciseMail Anti-Spam Gateway Processor
Chapter 2
2	Configuring PreciseMail Anti-Spam Gateway
2.1	Configuration file
2.2	The Configuration Keywords
2.2.1	Choosing Envelope Addresses
2.2.1.1	USE_CURRENT_ENVELOPE_TO keyword
2.2.1.2	LOCAL_DOMAIN_NAME keyword
2.2.2	Modifying Messages
2.2.2.1	ADD_HEADERS keyword
2.2.2.2	ADD_SPAM_YES_HEADER keyword
2.2.2.3	ADD_SPAM_YES_THRESHOLD keyword
2.2.2.4	HEADER_PREFIX keyword
2.2.2.5	MODIFY_SUBJECT keyword
2.2.2.6	MODIFY_SUBJECT_APPEND keyword
2.2.2.7	MODIFY_SUBJECT_THRESHOLD keyword
2.2.2.8	PMAS_SYSTEM_NAME keyword
2.2.2.9	SUBJECT_TAG keyword
2.2.2.10	SPAM_LEVEL_STARS keyword
2.2.2.11	SPAM_LEVEL_CHAR keyword
2.2.3	Quarantining Messages
2.2.3.1	QUARANTINE_MESSAGES keyword
2.2.3.2	QUARANTINE_THRESHOLD keyword
2.2.3.3	QUARANTINE_MSG_LIFETIME keyword
2.2.3.4	QUARANTINE_INDEX_FILE keyword
2.2.3.5	QUARANTINE_RFC822_FROM keyword
2.2.3.6	QUARANTINE_RFC822_TO keyword
2.2.4	Discarding Messages
2.2.4.1	DISCARD_MESSAGES keyword
2.2.4.2	DISCARD_THRESHOLD keyword
2.2.4.3	DISCARD_MSG_LIFETIME keyword
2.2.4.4	STATS_USE_THRESHOLDS keyword
2.2.5	Rejecting Messages
2.2.5.1	REJECT_MESSAGES keyword
2.2.5.2	REJECT_THRESHOLD keyword
2.2.5.3	BLOCK_DISPOSITION keyword
2.2.5.4	BLOCK_SCORE keyword
2.2.5.5	MAXIMUM_USER_BLOCK_RULES keyword
2.2.6	Envelope MAIL FROM: Verification keywords
2.2.6.1	VERIFY_MAIL_FROM_ADDRESSES keyword
2.2.6.2	VERIFY_MAIL_FROM_TIMEOUT keyword
2.2.6.3	VMF_ERROR_SCORE keyword
2.2.6.4	VMF_NO_DNS_SCORE keyword
2.2.6.5	VMF_NO_ADDRESS_SCORE keyword
2.2.6.6	VMF_NO_MAILFROM_SCORE keyword
2.2.6.7	VMF_NO_MX_SCORE keyword
2.2.6.8	VMF_NO_SMTP_SCORE keyword
2.2.6.9	VMF_OK_SCORE keyword
2.2.6.10	VMF_CONNECT_TIMEOUT keyword
2.2.6.11	UDNS_NAMESERVER keyword
2.2.7	Dynamic URI filtering keywords
2.2.7.1	DYNAMIC_URI_SCANNING keyword
2.2.7.2	DYN_URI_PHISH_DOMAIN_SCORE keyword
2.2.7.3	DYN_URI_SPAM_DOMAIN_SCORE keyword
2.2.7.4	DYN_URI_SPAMVERTISED_DOMAIN_SCORE keyword
2.2.7.5	DYN_URI_HONEYPOT_DOMAIN_SCORE keyword
2.2.7.6	DYN_URI_INTERNAL_ERROR_SCORE keyword
2.2.7.7	DYN_URI_OK_URL_SCORE keyword
2.2.7.8	DYN_URI_CONNECT_TIMEOUT keyword
2.2.8	URI reputation filtering keywords
2.2.8.1	REPUTATION_URI_ENABLED keyword
2.2.8.2	REP_URI_MULTIPLIER keyword
2.2.8.3	REP_URI_NONSPAM_EFFECTS keyword
2.2.8.4	REP_URI_PHISH_SCORE keyword
2.2.8.5	REP_URI_ADULT_SCORE keyword
2.2.8.6	REP_URI_CONNECT_TIMEOUT keyword
2.2.9	Pass-Through SMTP Server keywords
2.2.9.1	PTSMTP_LISTEN_HOST keyword
2.2.9.2	PTSMTP_LISTEN_PORT keyword
2.2.9.3	PTSMTP_MAILSERVER_HOST keyword
2.2.9.4	PTSMTP_MAILSERVER_PORT keyword
2.2.9.5	PTSMTP_LISTEN_PORT_TLS keyword
2.2.9.6	PTSMTP_MAILSERVER_HOST_TLS keyword
2.2.9.7	PTSMTP_MAILSERVER_PORT_TLS keyword
2.2.9.8	PTSMTP_ENABLE_STARTTLS keyword
2.2.9.9	PTSMTP_TLS_PRIVATE_CERT keyword
2.2.9.10	PTSMTP_TLS_PUBLIC_CERT keyword
2.2.9.11	PTSMTP_WORKER_MIN keyword
2.2.9.12	PTSMTP_WORKER_MAX keyword
2.2.9.13	PTSMTP_IDLE_TIME keyword
2.2.9.14	PTSMTP_QUARANTINE_REPLY keyword
2.2.9.15	PTSMTP_REJECT_REPLY keyword
2.2.9.16	SMTP_MAILSERVER_HOST keyword
2.2.9.17	SMTP_MAILSERVER_PORT keyword
2.2.9.18	PTSMTP_NORELAY_REPLY keyword
2.2.9.19	PTSMTP_NOUSER_REPLY keyword
2.2.10	Anti-Virus Package keywords
2.2.10.1	ANTIVIRUS_ENABLED keyword
2.2.10.2	ANTIVIRUS_PACKAGE keyword
2.2.10.3	ANTIVIRUS_DIR keyword
2.2.10.4	VIRUS_DISPOSITION keyword
2.2.11	User Interface keywords
2.2.11.1	GUI_COOKIE_LIFETIME keyword
2.2.11.2	GUI_URI_HOST keyword
2.2.11.3	GUI_URI_SCRIPT_PATH keyword
2.2.11.4	GUI_URI_PATH keyword
2.2.11.5	GUI_URI_PROTOCOL keyword
2.2.11.6	GUI_ALLOW_QUARANTINE_ALL keyword
2.2.11.7	GUI_ALLOW_QUARALL_DEFAULT keyword
2.2.11.8	GUI_DEFAULT_QUARANTINE_ALL keyword
2.2.11.9	GUI_DELETE_UPON_RELEASE keyword
2.2.11.10	GUI_RENAME_UPON_DELETE keyword
2.2.11.11	GUI_ALLOW_DISCARD_VIEW keyword
2.2.11.12	GUI_JAVA_SORT_MAXMSGS keyword
2.2.11.13	GUI_FORCE_JAVA_SORT_OPERA keyword
2.2.11.14	USER_DATABASE keyword
2.2.11.15	ADMIN_EMAIL_ADDRESS keyword
2.2.11.16	OPT_IN_BY_DEFAULT keyword
2.2.11.17	ALLOW_USER_OPTIN keyword
2.2.11.18	ALLOW_USER_DISCARD keyword
2.2.11.19	ALLOW_USER_QUARANTINE keyword
2.2.11.20	ALLOW_USER_TAGGING keyword
2.2.12	User Authentication keywords
2.2.12.1	AUTH_METHODS keyword
2.2.12.2	AUTH_POP3_HOSTS keyword
2.2.12.3	POP3_CONNECT_TIMEOUT keyword
2.2.12.4	AUTH_IMAP4_HOSTS keyword
2.2.12.5	IMAP4_CONNECT_TIMEOUT keyword
2.2.12.6	LDAP_AUTH_SERVER keyword
2.2.12.7	LDAP_BASE_DN keyword
2.2.12.8	LDAP_AUTH_FILTER keyword
2.2.12.9	LDAP_GROUP_FILTER keyword
2.2.12.10	LDAP_GROUPMEMBER_ATTR keyword
2.2.12.11	LDAP_SEARCHACCT_DN keyword
2.2.12.12	LDAP_SEARCHACCT_PASSWORD keyword
2.2.12.13	LDAP_USE_TLS keyword
2.2.13	Bayesian Engine keywords
2.2.13.1	USE_BAYESIAN keyword
2.2.13.2	AUTOTRAIN_BAYESIAN keyword
2.2.13.3	AUTOBAYESIAN_HAM_THRESHOLD keyword
2.2.13.4	AUTOBAYESIAN_SPAM_THRESHOLD keyword
2.2.13.5	BAYESIAN_MULTIPLIER keyword
2.2.14	Debugging
2.2.14.1	DEBUG_LEVEL keyword
2.2.14.2	DEBUG_LOGFILE keyword
2.2.15	Miscellaneous
2.2.15.1	ALIAS_FILE keyword
2.2.15.2	GATHER_STATS keyword
2.2.15.3	MASTER_LOGFILE keyword
2.2.15.4	USERLIST_SUBDIR_LEVEL keyword
2.2.16	Quarantine Notification Batch Job
2.2.16.1	SEND_QUARNOTICES_DEFAULT keyword
2.2.16.2	MIME_QUARANTINE_MESSAGE keyword
2.2.16.3	NOTIFY_MSG_SUBJECT keyword
2.2.16.4	NOTIFY_DEBUG_LEVEL keyword
2.2.17	PreciseMail Anti-Spam Gateway Processor
2.2.17.1	PROCESSOR_USER_NAME keyword
2.2.17.2	PROCESSOR_USER_ADDRESS keyword
2.2.17.3	PMAS_PROCESS_DEBUG_LEVEL keyword
2.2.17.4	PMAS_PROCESS_DEBUG_LOGFILE keyword
2.2.17.5	MIME_HELP_MESSAGE keyword
2.2.18	Automatic updates keywords
2.2.18.1	AUTOUPDATE_RULES keyword
2.2.18.2	AUTOUPDATE_SOPHOS keyword
2.2.18.3	AUTOUPDATE_STATS keyword
2.2.18.4	AUTOUPDATE_ADDRESS keyword
2.2.18.5	UPDATES_CONNECT_TIMEOUT keyword
2.2.19	Data Synchronization Cluster keywords
2.2.19.1	CLU_CLIENTS keyword
2.2.19.2	CLU_SERVER keyword
2.2.19.3	CLU_SERVER_CLIENT keyword
2.2.20	Customizing the Quarantine Notices
Chapter 3
3	The PreciseMail Anti-Spam Gateway Rules
3.1	Rule file format
3.2	Regular Expressions
3.2.1	Regular Expression syntax
3.2.2	Using Regular Expressions in PreciseMail Anti-Spam Gateway Rules
3.2.3	Testing Regular Expressions
3.3	Writing Header Rules
3.4	Writing Body Rules
3.5	Writing URI Rules
3.6	Writing Meta Rules
3.7	Rule Scoring
3.8	Changing Descriptions and Disabling Rules
3.9	Adding Allow, Block, Quarantine, Discard, Score, and Reject Rules
3.9.1	Allow_EnvFrom and Block_EnvFrom rules
3.9.2	Allow_From and Block_From rules
3.9.3	Allow_Regex and Block_Regex rules
3.9.4	Rule rules
3.10	Performing DNSBL lookups on URIs and Received: IP addresses
3.10.1	URI DNSBL lookups
3.10.2	Received: IP address DNSBL lookups
3.11	Reverse DNS lookups for URIs
Chapter 4
4	PreciseMail Anti-Spam Gateway cron Jobs
4.1	PreciseMail Anti-Spam Gateway Notify
4.2	PreciseMail Anti-Spam Gateway Nightly
4.3	PreciseMail Anti-Spam Gateway Statistics Maintenance
Chapter 5
5	Additional PreciseMail Anti-Spam Gateway Programs
5.1	The pmasadmin Program
5.2	The BAYES Program
Chapter 6
6	PreciseMail Anti-Spam Gateway User Interface
6.1	Customizing the HTML template files
6.2	Controlling User Preferences
6.3	The PMAS Administrator Interface
Chapter 7
7	PreciseMail Clustering
7.1	Advanced Infrastructure
7.1.1	Setting Up Advanced Infrastructure
7.1.2	Simple Mode
7.1.3	Advanced Mode
7.1.4	Advanced Infrastructure Roles
7.1.4.1	Configuration Server
7.1.4.2	Configuration Client
7.1.4.3	Statistics Server
7.1.4.4	Statistics Client
7.1.4.5	User Rules Server
7.1.4.6	User Rules Client
7.1.4.7	Groups Server
7.1.4.8	Groups Client
7.1.5	Advanced Infrastructure Processes
7.2	Data Synchronization Clusters
7.2.1	Overview
7.2.2	Configuring a Data Synchronization Cluster
7.2.3	High Availability
Chapter 8
8	Anti-Virus Scanning
8.1	System Considerations for Anti-Virus Scanning
8.1.1	System Memory Demands
8.1.2	Configuring the Sophos Anti-Virus Engine
Chapter 9
9	Debugging PreciseMail Anti-Spam Gateway
Appendix A
Appendix A	Files Created During Installation
Glossary
Glossary	Glossary
Index
Index
Examples
9-1	Example Interactive Run of PMAS
Tables
1-1	DNSBL keywords
1-2	RHSBL keywords
1-3	SPF Configuration File Keywords
2-1	PreciseMail Anti-Spam Gateway Configuration Keywords Listed Alphabetically
2-2	PreciseMail Anti-Spam Gateway Configuration Keywords Grouped Functionally
3-1	PreciseMail Anti-Spam Gateway Rule Files
3-2	Rule File Keywords
3-3	Simple Regular Expression Characters
3-4	URI DNSBL configuration variables
3-5	URI DNSBL keywords
3-6	Received: DNSBL configuration variables
3-7	Received: DNSBL keywords
3-8	URI rDNS lookup configuration variables
A-1	PreciseMail Anti-Spam Gateway files created during installation