KASPERSKY LAB Kaspersky Anti-Spam 2.0 Enterprise Edition / ISP Edition ADMINISTRATOR'S GUIDE KASPERSKY ANTI-SPAM 2.0 ENTERPRISE EDITION / ISP EDITION Administrator's Guide © Kaspersky Lab http://www.kaspersky.com © Ashmanov & Partners Ltd. http://www.ashmanov.com Revision Date: June 2004 Contents CHAPTER 1. KASPERSKY ANTI-SPAM 2.0 ENTERPRISE EDITION / ISP EDITION ....................................................................................................................... 8 1.1. What's new in Kaspersky Anti-Spam 2.0 ........................................................... 10 1.2. Licensing policy ................................................................................................... 11 1.3. Hardware and software system requirements ................................................... 12 1.4. Distribution Kit...................................................................................................... 12 1.5. Services provided to registered users ................................................................ 13 1.6. Formatting conventions....................................................................................... 14 CHAPTER 2. KASPERSKY ANTI-SPAM STRUCTURE AND ARCHITECTURE..... 16 CHAPTER 3. INSTALLING KASPERSKY ANTI-SPAM.............................................. 20 3.1. Preparing for the installation................................................................................ 20 3.2. Installing applications included in the Kaspersky Anti-Spam software package.............................................................................................................. 21 3.3. Installing the license key...................................................................................... 22 3.4. Integrating Kaspersky Anti-Spam into your mail system ................................... 23 CHAPTER 4. KASPERSKY ANTI-SPAM OPERATION AND FILTERING PHILOSOPHY ............................................................................................................ 24 4.1. Configuring filtering settings ................................................................................ 24 4.2. Data updating procedure..................................................................................... 24 4.3. Filtering philosophy.............................................................................................. 25 4.3.1. Address, headers and message size analysis ............................................ 26 4.3.2. Message content analysis ­ content filtering............................................... 27 4.3.3. Actions to be applied to messages .............................................................. 28 4.3.4. Filtering profiles and filtering rules application order.................................... 31 4.3.4.1. Profiles application order ....................................................................... 31 4.3.4.2. Message modification during processing.............................................. 32 4.3.4.3. Filtering results....................................................................................... 33 4.4. Preinstalled filter profiles...................................................................................... 35 4.4.1. Stages of the preinstalled filter profiles operation........................................ 35 4.4.1.1. Detection of spam attributes: analysis of message headers................ 36 4 Kaspersky Anti-Spam 2.0 Enterprise Edition / ISP Edition 4.4.1.2. Message evaluation............................................................................... 36 4.4.1.3. Reaction to spam................................................................................... 38 4.4.2. Setting up preinstalled filter profiles.............................................................. 39 4.4.2.1. Selecting default reaction to spam ........................................................ 40 4.4.2.2. Choosing reaction to spam for particular users .................................... 42 4.4.2.3. Selecting filtering level severity.............................................................. 43 4.4.3. Specific headers assigned by the filter......................................................... 44 CHAPTER 5. CONFIGURING FILTERING PARAMETERS....................................... 47 5.1. Starting WebConfigurator.................................................................................... 47 5.2. Working with WebConfigurator ........................................................................... 48 5.2.1. Working with common profiles. The common tab ....................................... 48 5.2.1.1. Creating a common profile .................................................................... 49 5.2.1.2. Activating common profiles.................................................................... 50 5.2.1.3. Deleting profiles ..................................................................................... 51 5.2.2. Working with personal profiles. The personal tab........................................ 52 5.2.2.1. Creating personal profiles...................................................................... 52 5.2.2.2. Activating personal profiles.................................................................... 53 5.2.3. Editing filter profiles....................................................................................... 54 5.2.3.1. Creating filtering rules ............................................................................ 55 5.2.3.2. Switching to editing an existing rule ...................................................... 56 5.2.3.3. Deleting existing rules............................................................................ 56 5.2.3.4. Controlling rule application procedures................................................. 56 5.2.3.5. Editing filter profile name, description and field of application.............. 57 5.2.3.6. Saving profiles........................................................................................ 59 5.2.4. Filtering rule editing....................................................................................... 59 5.2.4.1. Filtering rule edit page ........................................................................... 59 5.2.4.2. Setting new conditions........................................................................... 61 5.2.4.2.1. Conditions related to the IP address of the sending mail server............................................................................ 62 5.2.4.2.2. Conditions related to the sender's e-mail .............................. 62 5.2.4.2.3. Conditions related to recipient's e-mail address.................... 63 5.2.4.2.4. Conditions related to message headers ................................ 64 5.2.4.2.5. Condition related to content filtering results .......................... 65 5.2.4.2.6. Condition related to message size ........................................ 66 5.2.4.3. Editing conditions................................................................................... 67 5.2.4.4. Deleting conditions................................................................................. 68 Contents 5 5.2.4.5. Creating new actions ............................................................................. 68 5.2.4.5.1. Options and settings of the change recipient action.............. 68 5.2.4.5.2. Options and settings of the change header action ................ 69 5.2.4.6. Editing actions........................................................................................ 71 5.2.4.7. Deleting actions...................................................................................... 72 5.2.4.8. Saving rules............................................................................................ 72 5.2.5. Working with lists. The e-mails, ip addresses, dns blacklists tabs............. 73 5.2.5.1. Viewing lists............................................................................................ 74 5.2.5.2. Creating new lists................................................................................... 76 5.2.5.3. Editing lists ............................................................................................. 77 5.2.5.3.1. Creating a new list entry........................................................ 77 5.2.5.3.2. Editing list entries .................................................................. 78 5.2.5.3.3. Deleting list entries ................................................................ 79 5.2.5.3.4. Editing list name and description........................................... 79 5.2.5.4. Deleting lists ........................................................................................... 80 5.2.5.5. Saving lists ............................................................................................. 81 5.2.6. Working with sample spam messages ........................................................ 82 5.2.6.1. Adding sample messages ..................................................................... 82 5.2.6.2. Editing sample messages ..................................................................... 83 5.2.6.3. Deleting sample messages ................................................................... 84 5.2.7. General filter settings.................................................................................... 84 5.2.7.1. Notifications of rejection sent to the original message sender ............. 85 5.2.7.2. Generating the list of licensed users ..................................................... 86 5.2.8. Saving Filter configuration ............................................................................ 87 CHAPTER 6. UPDATING THE CONTENT FILTERING DATABASE ........................ 89 6.1. Selecting the source of the content filtering database update ........................... 90 6.2. Launching the updating process......................................................................... 90 6.2.1. Scheduled launch ......................................................................................... 91 6.2.2. Launching the content filtering database update process from the command line................................................................................................ 91 6.3. Viewing results..................................................................................................... 92 APPENDIX A. ADDITIONAL INFORMATION ABOUT KASPERSKY ANTI-SPAM .. 93 A.1. The ap-process-server program (master process)............................................ 93 A.1.1. Starting and stopping the master process................................................... 93 A.1.2. The ap-process-server program configuration file ...................................... 94 6 Kaspersky Anti-Spam 2.0 Enterprise Edition / ISP Edition A.1.3. System log (syslog) records detail levels .................................................... 95 A.2. The ap-mailfilter program (filtering process) command line parameters .......... 96 A.3. Client modules for mail systems......................................................................... 98 A.3.1. Interaction of the client modules with the filtering service........................... 98 A.3.2. kas-milter (client module for Sendmail) ....................................................... 99 A.3.2.1. Operation of the kas-milter program ..................................................... 99 A.3.2.2. The kas-milter program configuration file ........................................... 100 A.3.2.3. Configuring Sendmail when using kas-milter ..................................... 101 A.3.3. kas-pipe (client module for Postfix, Exim) ................................................. 101 A.3.3.1. kas-pipe operation............................................................................... 101 A.3.3.2. kas-pipe configuration file.................................................................... 102 A.3.3.3. Configuring Postfix when using kas-pipe............................................ 104 A.3.3.4. Configuring Exim when using kas-pipe .............................................. 105 A.3.4. kas-exim (client module for Exim).............................................................. 106 A.3.4.1. Compilation of the kas-exim program................................................. 106 A.3.4.2. kas-exim configuration parameters..................................................... 107 A.3.5. kas-qmail (client module for Qmail) ........................................................... 108 A.3.5.1. kas-qmail operation ............................................................................. 108 A.3.5.2. The kas-qmail program configuration file ........................................... 108 A.3.5.3. Configuring Qmail when using kas-qmail ........................................... 110 A.3.6. kas-cgpro (clien ...