KASPERSKY LAB Kaspersky® Anti-Spam 3.0 Administrator's Guide KASPERSKY® ANTI-SPAM 3.0 Administrator's Guide © Kaspersky Lab http://www.kaspersky.com Revision date: November 2006 Contents CHAPTER 1. KASPERSKY ANTI-SPAM 3.0................................................................. 6 1.1. What's new in version 3.0 ..................................................................................... 7 1.2. Licensing policy ..................................................................................................... 8 1.3. Hardware and software requirements .................................................................. 9 1.4. Distribution kit ...................................................................................................... 10 1.5. Help desk for registered users ............................................................................ 10 1.6. Conventions......................................................................................................... 11 CHAPTER 2. ARCHITECTURE OF KASPERSKY ANTI-SPAM AND PRINCIPLES OF SPAM FILTERING........................................................................ 12 2.1. Product structure ................................................................................................. 12 2.2. Recognition technology....................................................................................... 16 2.2.1. Analysis of formal signs................................................................................ 16 2.2.2. Content filtration............................................................................................ 16 2.2.3. Checks using external services.................................................................... 17 2.2.4. Urgent Detection System ............................................................................. 18 2.3. Recognition results and actions over messages................................................ 19 2.4. Content filtration databases................................................................................. 20 2.5. Filtration policies .................................................................................................. 20 2.6. Control Center ..................................................................................................... 21 2.7. Monitoring ............................................................................................................ 21 CHAPTER 3. INSTALLING KASPERSKY ANTI-SPAM.............................................. 23 3.1. Preparing for installation...................................................................................... 23 3.2. Installing Kaspersky Anti-Spam distribution package ........................................ 24 3.3. Configuring access to the Control Center........................................................... 25 3.4. Installing the license key...................................................................................... 26 3.5. Integrating Kaspersky Anti-Spam with your mail server ................................... 27 3.6. Configuring updates of content filtration databases and UDS use.................... 29 CHAPTER 4. MANAGING THE SPAM FILTRATION SERVER................................. 30 4.1. Starting and managing Kaspersky Anti-Spam components.............................. 30 4 Kaspersky Anti-Spam 3.0 4.2. Kaspersky Anti-Spam Control Center................................................................. 31 4.3. Filtration policy management .............................................................................. 32 4.3.1. General filtration policy ................................................................................. 33 4.3.1.1. The General section .............................................................................. 34 4.3.1.2. The DNS & SPF Checks section .......................................................... 36 4.3.1.3. The Headers Checks section ................................................................ 37 4.3.1.4. The Eastern Encodings section ............................................................ 39 4.3.1.5. The Obscene Content section............................................................... 39 4.3.2. Managing the white and black lists .............................................................. 40 4.3.3. Managing the lists of employed DNSBL services ....................................... 42 4.3.4. Managing the list of protected domains ....................................................... 44 4.3.5. Group management ..................................................................................... 45 4.3.6. Managing the group filtration policy ............................................................. 48 4.3.7. Actions over messages ................................................................................ 49 4.4. Updating the content filtration databases ........................................................... 52 4.4.1. Configuring the update parameters ............................................................. 52 4.4.2. Initiating an update........................................................................................ 55 4.5. Configuring the spam filtration server ................................................................. 56 4.5.1. Common filtration server parameters........................................................... 57 4.5.2. Parameters of the filtration master process ................................................. 58 4.5.3. Parameters of the filtering processes .......................................................... 59 4.5.4. Spam recognition parameters...................................................................... 60 4.5.5. Client module settings .................................................................................. 62 4.5.6. Notifications about rejected messages ........................................................ 64 4.6. Control Center settings........................................................................................ 65 4.7. Managing the license keys.................................................................................. 66 4.7.1. Viewing the license information.................................................................... 67 4.7.2. Installing a new license key.......................................................................... 68 4.7.3. License key removal..................................................................................... 68 4.8. Monitoring the filtration server activity................................................................. 69 4.8.1. General product status information.............................................................. 69 4.8.1.1. Detailed information about the Anti-Spam Engine ............................... 70 4.8.1.2. Detailed information about the updater module.................................... 72 4.8.1.3. Detailed information about the licensing module.................................. 73 4.8.2. Monitoring system messages and reports................................................... 74 4.9. Kaspersky Anti-Spam statistics........................................................................... 75 Contents 5 CHAPTER 5. UNISTALLING KASPERSKY ANTI-SPAM ........................................... 77 CHAPTER 6. FREQUENTLY ASKED QUESTIONS................................................... 79 APPENDIX A. ADDITIONAL INFORMATION ON KASPERSKY ANTISPAM 83 A.1. Location of product files in the file system.......................................................... 83 A.2. Client modules for mail servers .......................................................................... 84 A.2.1. Interaction of client modules with the filtering server................................... 84 A.2.2. Global settings of client modules ................................................................. 85 A.2.3. kas-milter ­ a client module for the Sendmail mail server .......................... 86 A.2.4. kas-pipe ­ a client module for the Postfix and Exim mail servers .............. 88 A.2.5. kas-exim ­ a client module for the Exim mail server................................... 94 A.2.6. kas-qmail ­ client module for the Qmail mail server ................................... 97 A.2.7. kas-cgpro ­ a client module for the Communigate Pro mail server ........... 98 A.3. Kaspersky Anti-Spam configuration files.......................................................... 100 A.3.1. Main configuration file filter.conf................................................................. 101 A.3.2. Configuration file kas-thttpd.conf ............................................................... 106 A.4. Kaspersky Anti-Spam utilities ........................................................................... 106 A.4.1. kas-htpasswd ............................................................................................. 106 A.4.2. kas-show-license........................................................................................ 107 A.4.3. install-key.................................................................................................... 107 A.4.4. remove-key................................................................................................. 108 A.4.5. kas-restart................................................................................................... 109 A.4.6. mkprofiles ................................................................................................... 110 A.4.7. sfmonitoring ................................................................................................ 111 A.4.8. sfupdates .................................................................................................... 111 A.5. Special headers of the filtering module ............................................................ 112 A.6. Configuration using cron service ...................................................................... 115 APPENDIX B. HOW TO SEND SPAM MESSAGES TO SPAM ANALYSTS. 118 APPENDIX C. KASPERSKY LAB...................................................................... 120 A.7. Other Kaspersky Lab Products ........................................................................ 121 A.8. Contact Us......................................................................................................... 128 APPENDIX D. APPENDIX E. THIRD PARTY SOFTWARE ..................................................... 129 LICENSE AGREEMENT............................................................ 144 CHAPTER 1. KASPERSKY ANTISPAM 3.0 Kaspersky® Anti-Spam 3.0 (hereinafter also referred to as Kaspersky AntiSpam or the product) is a software suite filtering e-mail in order to protect mail system users from unsolicited mass mail (spam). Kaspersky Anti-Spam uses administrator-defined rules to process received messages accordingly. Namely, it delivers a message without modifications, blocks it, generates a notification informing that a message could not be received, adds or modifies message header and performs other actions specified by the administrator. The application checks every e-mail message for the presence of signs typical for unwanted mass mail (spam). First, it checks various message parameters: the sender's and recipient's addresses (envelope), message size and its various headers (including From and To). In addition, Kaspersky Anti-Spam runs the following checks as a part of its analysis procedure: · · a check of message sender's address (e-mail and / or IP address) using black and white lists; the presence of the sender's IP address in a DNS-based real time black hole list (DNSBL); DNSBL (DNS based black hole list) is a database that lists IP addresses of mail servers used for uncontrolled mass mailing. Such servers receive mail from anyone and deliver it further to arbitrary recipients. Using of DNSBL will allow automatic blocking of mail receipt from that mail server. Various services use different policies for generation of such lists. Please examine carefully the policy of each service before you start using it for mail filtration. · · availability of a DNS record for the sending server (reverse DNS lookup); a check of the sender's IP address for compliance with the list of addresses allowed for a domain based on the Sender Policy Framework (SPF); a check of addresses and links to sites in message text using the Spam URL Realtime Blocklists (SURBL) service. · Kaspersky Anti-Spam 3.0 7 Second, the application employs content filtration, i.e. it analyzes the actual message contents (including the Subject header) and attached files1. The product uses to that effect linguistic algorithms based on comparison with sample messages and search for typical terms (words and word combinations). Kaspersky Anti-Spam also scans attached images comparing them to the signat ...