User manual KASPERSKY LAB KASPERSKY ANTI-VIRUS - SMTP-GATEWAY 5.0 FOR LINUX & UNIX - ADMINISTRATOR GUIDE

KASPERSKY LAB Kaspersky® SMTP-Gateway 5.0 for Linux/Unix ADMINISTRATOR'S GUIDE KASPERSKY® SMTP-GATEWAY 5.0 FOR LINUX/UNIX Administrator's Guide © Kaspersky Lab Ltd. http://www.kaspersky.com Revision date: August 2004 Contents CHAPTER 1. KASPERSKY® SMTP-GATEWAY 5.0..................................................... 6 1.1. Licensing policy ..................................................................................................... 7 1.2. Hardware and software requirements .................................................................. 7 1.3. Distribution kit ........................................................................................................ 8 1.4. Help desk for registered users .............................................................................. 9 1.5. Conventions........................................................................................................... 9 CHAPTER 2. APPLICATION DEPLOYMENT SCENARIOS...................................... 11 2.1. Application architecture ....................................................................................... 11 2.2. How Kaspersky SMTP-Gateway works ............................................................. 12 2.3. Typical deployment scenarios............................................................................. 14 2.3.1. Installing the application at the network perimeter....................................... 15 2.3.2. Installing the application inside your mail system........................................ 17 CHAPTER 3. INSTALLING KASPERSKY ANTI-VIRUS SMTP-GATEWAY.............. 19 3.1. Installing Kaspersky SMTP-Gateway under Linux............................................. 19 3.2. Installing KAV SMTP-Gateway on a server running FreeBSD or OpenBSD ... 20 3.3. Installation steps .................................................................................................. 21 3.4. Configuring Kaspersky SMTP-Gateway............................................................. 22 CHAPTER 4. UNINSTALLING KASPERSKY SMTP-GATEWAY .............................. 25 CHAPTER 5. USING KASPERSKY SMTP-GATEWAY APPLICATION.................... 26 5.1. Updating anti-virus database .............................................................................. 26 5.1.1. Automatic anti-virus database updating....................................................... 28 5.1.2. Manual updating of the anti-virus database................................................. 28 5.1.3. Creating a shared directory for storing and sharing database updates...... 29 5.2. Anti-virus protection of email traffic ..................................................................... 30 5.2.1. Creating groups of recipients/senders ......................................................... 30 5.2.2. General message processing algorithm ...................................................... 33 5.2.3. Main tasks..................................................................................................... 35 5.2.3.1. Deliver messages without changes ...................................................... 35 5.2.3.2. Deliver only clean and disinfected messages....................................... 36 4 Kaspersky® SMTP-Gateway 5.0 5.2.3.3. Delete infected attachments.................................................................. 37 5.2.3.4. Replace infected attachments with messages created using templates................................................................................................. 38 5.2.4. Additional tasks............................................................................................. 38 5.2.4.1. Block messages delivery to recipients .................................................. 39 5.2.4.2. Deliver infected messages .................................................................... 40 5.2.4.3. Notify senders, administrator, and recipients........................................ 41 5.2.4.4. Filter messages by attachment types ................................................... 42 5.2.4.5. Backing up (quarantine, backup storage) ............................................. 43 5.2.4.6. Automatically add incoming and outgoing mail to archives.................. 44 5.3. Protection from hacker attacks and spam .......................................................... 45 5.4. Managing license keys........................................................................................ 46 5.4.1. Viewing information about license keys....................................................... 46 5.4.2. Renewing your license ................................................................................. 48 5.4.3. Removing a license key ............................................................................... 49 CHAPTER 6. ADVANCED SETTINGS ........................................................................ 50 6.1. Configuring anti-virus protection of mail traffic.................................................... 50 6.1.1. Scanning and disinfecting messages .......................................................... 50 6.1.2. iChecker technology ..................................................................................... 51 6.1.3. Setting up application timeouts .................................................................... 51 6.1.4. Setting performance restrictions .................................................................. 53 6.2. Setting up connection receiving interfaces ......................................................... 54 6.3. Setting up the routing table ................................................................................. 55 6.4. Managing the application .................................................................................... 56 6.5. Customizing date and time formats .................................................................... 58 6.6. Reporting options ................................................................................................ 58 CHAPTER 7. FREQUENTLY ASKED QUESTIONS................................................... 61 CHAPTER 8. TESTING APPLICATION OPERABILITY ............................................. 66 8.1. Testing the application using Telnet ................................................................... 66 8.2. Testing the application using EICAR .................................................................. 68 APPENDIX A. SUPPLEMENTARY INFORMATION ABOUT THE PRODUCT......... 70 A.1. Location of the application files in directories..................................................... 70 A.2. Kaspersky SMTP-Gateway configuration file .................................................... 74 A.3. Control signals for the smtpgw component........................................................ 86 Contents 5 A.4. Management files................................................................................................ 86 A.5. Application statistics............................................................................................ 87 A.6. Command line options for the smtpgw component ........................................... 92 A.7. Smtpgw return codes.......................................................................................... 93 A.8. Command line options for licensemanager ....................................................... 94 A.9. Kaspersky licensemanager return codes........................................................... 95 A.10. Keepup2date command line options ............................................................... 95 A.11. Keepup2date return codes ............................................................................... 96 A.12. Anti-virus scan information format.................................................................... 97 A.13. Messages about actions applied to the message ........................................... 98 APPENDIX B. KASPERSKY LAB............................................................................... 101 B.1. Other Kaspersky Lab Products ........................................................................ 102 B.2. Contact Us......................................................................................................... 106 APPENDIX C. LICENSE AGREEMENT .................................................................... 107 CHAPTER 1. KASPERSKY® SMTP-GATEWAY 5.0 Kaspersky® SMTP-Gateway for Linux/Unix (hereinafter referred to as Kaspersky SMTP-Gateway or the application) is designed for processing and scanning SMTP mail traffic for viruses. The application is a full-featured mail relay (compliant with IETF RFC internet standards) that runs under Linux, FreeBSD and OpenBSD operating systems. Kaspersky SMTP-Gateway allows to perform the following functions: · · · · · · Scan email traffic for viruses, including attached files and message bodies. Detect infected, suspicious, corrupted, and password-protected attachments and message bodies. Disinfect infected objects detected in email messages by scanning. Provide additional email traffic filtering by names and MIME types of attachments and apply certain processing rules to the filtered objects. Maintain logs of all email messages sent and/or received by the application, if this is required by the internal security policy of the company; Provide protection against hacking attacks, block unwanted email messages, provide the functions of an open mail relay of unsolicited email messages; Limit the load on your server by configuring the application settings and SMTP parameters. Notify senders, recipients, and the administrator of messages containing infected, suspicious, or corrupted objects. Automatically place infected, suspicious, and corrupted objects to the quarantine or to the backup storage . Automatically update the anti-virus database from the Kaspersky Lab's update servers. · · · · The application detects and disinfects infected objects using the anti-virus database. During scans, the contents of each file are compared with the sample code of known viruses contained in the database. Kaspersky® SMTP-Gateway 5.0 7 Remember that new viruses appear every day. To keep your network constantly protected from the latest threats, we recommend that you update your anti-virus database every 3 hours. · Configure and manage Kaspersky SMTP-Gateway either from a remote location using Webmin web interface, or locally, using standard OS tools such as command line options, signals, by creating special command files or by modifying the configuration file of the application. Monitor the antivirus protection status and view the statistics and application logs. · 1.1. Licensing policy The licensing policy for Kaspersky SMTP-Gateway imposes limitations on the use of the product by the following criteria: · · Number of users protected by the application Email traffic (MB/day) Each type of licensing is also limited by a certain period (typically one year or two years from the date of purchase). You can purchase a license limited by one of the above criteria (for example, by the daily mail traffic). The application has slightly different configuration parameters, depending on the type of license you have purchased. Thus, if the license is issued for a certain number of users, you will have to create a list of addresses (domains) that will be protected by Kaspersky SMTP-Gateway. If the license allows protection of the limited amount of email traffic, the application can be configured to notify the administrator when the traffic volume reaches critical values and hence the license is about to expire. 1.2. Hardware and software requirements Minimum system requirements for normal operation of Kaspersky SMTPGateway are as follows: · Hardware requirements: · Intel Pentium® processor (Pentium III or Pentium 4 recommended) 8 Kaspersky® SMTP-Gateway 5.0 · · at least 128 B RAM 100 MB available space on your hard drive to install the application Note that the backup storage, quarantine, and logs of incoming and outgoing mail are not included in the hard disk space required. If your network security policy requires the use of the above features, extra disk space will be needed. · · at least 500 MB available space in the /tmp file system Software requirements: · One of the following operating systems: o o o Linux RedHat (version 7.3, 8.0 or 9.0), Linux SuSE (version 8.1, 8.2 or 9.0), or Linux Debian (version 3.0) FreeBSD versions 4.9 or 5.2.1 OpenBSD version 3.4 · · Perl interpreter, version 5.0 or higher (www.perl.org) to install the application. Webmin version 1.070 or higher (www.webmin.com) to install the remote administration module (optional). 1.3. Distribution kit You can purchase Kaspersky SMTP-Gateway either from our dealers (retail box) or online at one of our online stores (for example, www.kaspersky.com ­ follow the E-store link). The retail box includes: · · · · a sealed envelope containing the installation CD a copy of this User Guide a license key file on the installation CD a license agreement Before you unseal the envelope containing the CD, make sure you have carefully read the license agreement. If you buy the product online, you will download the installation file from the Kaspersky Lab website. This installation file also includes this User Guide. The Kaspersky® SMTP-Gateway 5.0 9 license key will either be included into the distribution kit or will be sent to you by email after receiving your payment. The License Agreement is a legal agreement between you and the manufacturer (Kaspersky Lab Ltd.) that stipulates the terms and conditions under which you may use the anti-virus product you have purchased. Carefully review the License Agreement! If you do not agree to the terms of the License Agreement, you may return the product to your Kaspersky Anti-Virus dealer for a full refund provided that the envelope with the installation CD has not been unsealed. By opening the sealed envelope containing the installation CD, or by installing the application, you confirm that you have accepted all the terms and conditions of the License Agreement. 1.4. Help desk for registered users Kaspersky Lab offers an extensive service package enabling registered customers to boost the productivity of Kaspersky SMTP-Gateway. If you register and purchase a subscription you will be provided with the following services for the period of your subscription: · · · new versions of this anti-virus software product provided free of charge; phone or email support on matters related to the installation, configuration, and operation of the product you have purchased; information about new Kaspersky Lab products and about new computer viruses (available to subscribers of the Kaspersky Lab's newsletter). Kaspersky Lab does not provide information related to operation and use of operating systems or other technologies. 1.5. Conventions Various formatting conventions are used throughout the text of this document depending on the purpose of a particular element. The table below lists the formatting conventions used. 10 Kaspersky® SMTP-Gateway 5.0 Convention Bold font Meaning Menu titles, commands, window titles, dialog elements, etc. Note. Additional information, notes Attention! Critical information To do this, 1. 2. Step 1. ... Task or example Description of the sequence to actions to be performed by the user A task or an example of how to use the product A solution of the problem stated Solution [option] ­ Function of the option Text of information messages and the command line Command line options Text of configuration files, information messages, and the command line. CHAPTER 2. APPLICATION DEPLOYMENT SCENARIOS This chapter contains a detailed discussion of the application's architecture and operating principles as well as typical scenarios of its deployment. 2.1. Application architecture The review of the functionality of the application must be preceded by a description of its internal architecture. Kaspersky SMTP-Gateway is a full-featured Mail Transfer Agent (MTA) able to receive and route email traffic scanning email messages for viruses. Kaspersky SMTP-Gateway uses SMTP protocol options (RFC 2821), Internet message format (RFC 2822), MIME format (RFC 2045-2049, 2231, 2646), and satisfies the requirements to mail relays (RFC 1123). In accordance with anti-spam recommendations (RFC 2505), the application uses its own relaying table to prevent using of this application as an open relay. In addition, Kaspersky SMTPGateway supports the following SMTP protocol extensions: · · · · · Pipelining ­ Enhances performance of servers supporting this mode of operation (RFC 2920). 8-bit MIME Transport ­ Processes national language characters code tables (RFC 1652). Enhanced Error Codes ­ Provides more informative explanations of protocol errors (RFC 2034). DSN (Delivery Status Notifications) ­ Decreases bandwidth usage and provides more reliable diagnostics (RFC 1891, 3461-3464). SMTP Message Size Declaration ­ Decreases the load and increases transfer rate (RFC 1870). Kaspersky SMTP-Gateway includes the following components: · · smtpgw - the main component ­ a full-featured mail relay with in-built anti-virus protection; licensemanager ­ component for managing license keys (installation, removal, viewing statistics). 12 Kaspersky® SMTP-Gateway 5.0 · · keepup2date ­ components that updates the anti-virus database by downloading the updates from the Kaspersky Lab's update server. Webmin ­ a module for remote administration of the application using a web interface (optional installation). This component allows to configure and manage the anti-virus database updates, specify actions to be performed on the objects depending on their status and monitor the results of the application's operation. The smtpgw component (see Figure 1), in its turn, consists of the following modules: Receiver (incoming mail receiver), Sender (module for sending scanned messages), and AV module (module implementing the anti-virus functionality). Figure 1. Kaspersky SMTP-Gateway general architecture The licensemanager components is used to manage license keys. the keepup2date component updates the anti-virus database used for detecting and disinfecting viruses. 2.2. How Kaspersky SMTP-Gateway works Kaspersky SMTP-Gateway works as follows (see Figure 2): 1. 2. The mail agent receives email messages via the SMTP protocol and passes them to the Receiver module. The Receiver module performs the preliminary email processing using the following criteria: · presence of the sender's IP address is in the list of blocked or trusted addresses. Application deployment scenarios 13 · compliance of the email message size (as well as the mail session and the total number of messages within the session) with the specified limits specified in the application settings. compliance of the number of open sessions (from all IP addresses or a single IP address)with the specified limits specified in the application settings. · If the message satisfies the preliminary processing, it is sent to the working queue to be processed by the anti-virus engine. 3. The processing (scanning and disinfecting) procedure is as follows: a. b. The AV module receives an object to be processed from the working queue. The AV module scans the object and, if this option is enabled, disinfects it using the anti-virus database records. Then it passes the scanned object to the ready-to-send message queue along with the return code that indicates the object's status. The Sender module handles the object depending on the object's status, as defined by the settings stored in the configuration file. c. 4. Scanned messages together with the information on the scan and disinfection results are transferred via the SMTP protocol to the onward mail agent to be delivered to local end users or rerouted to other mail servers. Figure 2. Kaspersky SMTP-Gateway working queue. 5. If saving a backup copy in the backup storage or in the quarantine is specified as the action to be performed on a message (see Figure 3), the copy of the scanned object will be saved in the backup storage or in the quarantine concurrently with sending it to the ready-to-send queue (depending on the message status). 14 Kaspersky® SMTP-Gateway 5.0 6. If your network security policy requires logging of all outgoing e-mail traffic, scanned messages will be automatically saved to the log concurrently with sending them to the working queue. Figure 3. Saving messages to the backup storage or the quarantine. 2.3. Typical deployment scenarios Depending on the initial architecture of the mail server the following options of Kaspersky Smtp-Gateway are provided: · Install the application at the network perimeter on the same computer with your mail system (recommended for Sendmail, Postfix and Exim mail systems). Install the application at the network perimeter on a dedicated server to operate as an anti-virus filter (recommended for Sendmail, Postfix and Exim mail systems). Install the application inside your existing mail system on the same computer. Install the application inside your mail system on a dedicated server to operate as an anti-virus filter. · · · The sections below discuss in detail the above scenarios and specify their advantages. Application deployment scenarios 15 The application, being a mail relay, does not include a local delivery agent. Therefore, no matter which of the deployment scenarios is used, a mail system (or mail systems) that delivers e-mail messages to the local users within the protected domains is required! 2.3.1. Installing the application at the network perimeter The advantage of this option is that it improves the overall performance of your mail system because it minimizes the number of transfer cycles for email messages. Besides, in this case the existing mail server of the company has no connection to the Internet, which enhances your data's security. In addition, demilitarized zones (DMZ) may be set up. To install the application and the mail system on the same server, the following algorithm is provided to ensure their joint operation: 1. 2. Configure all interfaces of Kaspersky SMTP-Gateway to listen on port 25 for incoming email traffic. The application will scan and process email traffic and then pass the processed objects the mail system of the company via a different port (for example port 1025). The mail system, configured to use a local interface, will deliver messages to users. 3. When implementing this deployment scenario the following settings must be configured: The following steps are to be followed in order to install the application and the mail system on the same server: · Configure the application for receiving mail via port 25 on all network interfaces of the server. In order to do this, specify the following value in section [smtpgw.network] of the configuration file: ListenOn=0.0.0.0:25 · Specify in the routing table transferring all scanned messages to the mail system via port 1025. In order to do this, specify the following value in section [smtpgw.network] of the configuration file: ForwardRoute=company.com [host:1025] 16 Kaspersky® SMTP-Gateway 5.0 where:company.com ­ protected company's domain; host ­ name of the mail server of the company. · Change the settings of the existing mail system for receiving messages from the application via port 1025. This will ensure receipt, anti-virus scanning of all incoming mail messages and delivery of these messages to the local users within the protected domains of the company. Specify the transferring of all messages received by the existing mail system via port 25 to the application. This will ensure anti-virus scanning of all outgoing mail messages from the local users and delivery of such messages to the internet. Specify the list of all local domains of the company by modifying the value of parameter ProtectedDomains in section [smtpgw.network] of the configuration file of the application (special symbols "*" and "?" can be used). Mail messages for the specified domains will be scanned and licensed (a detailed description of the configuration file see section A.2, page 74). Application configuration for this deployment scenario will be implemented by default during the process installation. The application operation algorithm, when the application is installed on a dedicated server, is similar to operation on the same server, but the settings for this scenario will differ. When installing the application to a dedicated server, follow the below instructions. · Configure the application for receiving mail via port 25 on all network interfaces of the server. In order to do this, specify the following value in section [smtpgw.network] of the configuration file: · · ListenOn=0.0.0.0:25 · Specify in the routing table transferring all scanned messages to the mail system via port 25. In order to do this, specify the following value in section [smtpgw.network] of the configuration file: ForwardRoute=company.com [host:25] where:company.com ­ protected company's domain; host ­ name of the mail server of the company. · Specify the list of all local domains of the company by modifying the value of parameter ProtectedDomains in section [smtpgw.network] (special Application deployment scenarios 17 symbols "*" and "?" can be used). Mail messages for the specified domains will be scanned and licensed. This deployment scenario is the most convenient, especially if the installation of Kaspersky SMTP-Gateway is performed concurrently with the deployment of the network and of the company's mail system. 2.3.2. Installing the application inside your mail system If you install the application inside your mail system, the advantage is that the information and settings for the anti-virus software installed on the server are not available on the Internet. Besides, if the application is installed inside the mail system on the dedicated server, this provides for the possibility to distribute the load among several servers performing anti-virus scan. The following algorithm is provided for joint operation of the application and the mail system installed on the same server: 1. 2. Duplicate your mail system and configure one of them to listen to port 25 and receive email messages via all available interfaces. This mail system forwards all incoming messages through the local interface via a different port (port 1025, for instance) to the application for scanning. The application scans the email messages for viruses and forwards scanned and processed messages to the second mail system on a different port (for example, port 1026). The second mail system delivers email to the local users. This deployment scenario is recommended if you are sure of the reliability of your mail system. The installation of the application will not affect the stability of your mail system. In general, installation on a dedicated server is similar to the above procedure. Besides, when installing the application on a dedicated server, you can create and run several copies of the application on different servers. This can help you distribute the anti-virus processing load among several servers. To implement this scenario: Specify the list of all local domains of the company by modifying the value of parameter ProtectedDomains in section [smtpgw.network] (special 3. 4. 18 Kaspersky® SMTP-Gateway 5.0 symbols "*" and "?" can be used). Mail messages for the specified domains will be scanned and licensed. Deploying Kaspersky SMTP-Gateway may require changes of all settings within the mail clients throughout the company so that all outgoing mail messages will be delivered to the application that will pass the messages to the external network after an anti-virus scan. If the network includes a firewall or demilitarized zones (DMZ's), it is necessary to provide mail clients and internal and external networks servers with access to the installed application to ensure joint operation and routing of the mail traffic. CHAPTER 3. INSTALLING KASPERSKY ANTI-VIRUS SMTP-GATEWAY Before installing Kaspersky SMTP-Gateway, it is necessary to: · · · Make sure that your system meets the minimum system requirements (see section 1.2 on page 7). Configure your Internet connection (optional; it is necessary for updating the anti-virus database). Log in to the system as root or as a privileged user. 3.1. Installing Kaspersky SMTPGateway under Linux For servers running the Linux operating system, Kaspersky SMTP-Gateway is distributed in three different installation packages, depending on the type of the installation program for your OS. You can use an rpm package to install Kaspersky SMTP-Gateway under Linux Red Hat and Linux SuSe. To install Kaspersky SMTP-Gateway from the rpm package, enter the following in the command line: rpm ­i smtpgw-linux-5.0.x-yy.i386.rpm If you are installing the application from the rpm package, after the files have been copied to your server, run the postinstall.pl script to perform post-installation configuration. Under Linux Debian, Kaspersky SMTP-Gateway installation is performed from a deb package. To initiate installation of Kaspersky SMTP-Gateway from the deb package, enter the following command in the command line: dpkg ­i smtpgw-linux-5.0.x.yy.deb 20 Kaspersky® SMTP-Gateway 5.0 After you enter the command, Kaspersky SMTP-Gateway will be installed automatically. You can also use a universal distribution file for all Linux OS. Use this distribution file if your Linux version does not support the rpm or deb formats or if your network administrator does not wish to use (or cannot use) a built-in package manager. The universal Kaspersky SMTP-Gateway distribution file is supplied as an archive (tar.gz). To install Kaspersky SMTP-Gateway from the universal distribution file, do the following: 1. 2. Copy the archive of the distribution file to a file system directory on your server. Extract the archive using command tar -xvf smtpgw-linux-5.0.x.yy.tar.gz The archive contains the installer and the file tree of the application distribution file that will be extracted by the above command. 3. Run the following installation script: cd smtpgw-install ./install.sh After you enter the command, Kaspersky SMTP-Gateway will be installed automatically. 3.2. Installing KAV SMTP-Gateway on a server running FreeBSD or OpenBSD The distribution file for installation of Kaspersky SMTP-Gateway on servers running FreeBSD or OpenBSD OS is supplied as a pkg package.