Online Guide - MailScan for Linux

From eScan Wiki

(Difference between revisions)

Current revision

· eScan · MailScan · Technologies

· Technical Info · Security Awareness · User Guides

MailScan for Linux Mail Servers

1 Required Packages
2 Installation
3 FAQ's

[edit]

Required Packages

RPM Package Name                       File name
    mwadmin                 mwadmin-x.x-x.<linux distro><release>.i386.rpm
    mwav                    mwav-x.x-x.<linux distro><release>.i386.rpm
    mailscan                mailscan-x.x-x.<linux distro><release>.i386.rpm

Debian Package Name                    File name
    mwadmin                 mwadmin-x.x-x.<linux distro><release>.i386.deb
    mwav                    mwav-x.x-x.<linux distro><release>.i386.deb
    mailscan                mailscan-x.x-x.<linux distro><release>.i386.deb

[edit]

Installation

NOTE:The packages should be installed as per the order given below. Installation should be done using a Terminal to run the command line parameters

Command Line Installation:

For RPM Packages:

# rpm -ivh mwadmin-x.x-x.<linux distro><release>.i386.rpm
# rpm -ivh mwav-x.x-x.<linux distro><release>.i386.rpm
# rpm -ivh mailscan-x.x-x.<linux distro><release>.i386.rpm

For Debian packages:

# dpkg -i mwadmin-x.x-x.<linux distro><release>.i386.deb
# dpkg -i mwav-x.x-x.<linux distro><release>.i386.deb
# dpkg -i mailscan-x.x-x.<linux distro><release>.i386.deb

Note:- Mailscan for Linux by default uses SMTP port 25. In case, if the mailserver is on the same system then the mailserver smtp port should use a different port other than port 25.

[edit]

FAQ's

[edit]

General

1. What is MailScan for Linux Mail Servers?

A. MicroWorld's MailScan for Linux is a reliable and 'Real-Time" mail-scanning software for Linux Mail Servers. It offers a complete and secure security solution for mail servers running on Linux. Some of the Linux mail servers that it protects are: SendMail, Qmail, Exim, PostFix, etc.

2. What are the features in MailScan for Linux Mail Servers?

A. MailScan for Linux Mail Servers:

Anti-Virus Scanner,
Content (Spam) Scanning,
Attachment Reservation and Malicious Attachment detection,
Easy and convenient web-based administration
Automatic download of Virus signatures,
Provides extensive Logs for analysis.

3. For which GNU/Linux distributions is MailScan for Linux Mailserver available?

A. MailScan for Linux MailServer is available for

RHEL 5 (32 Bit)
RHEL 5 (64 Bit)
SLES 10.2 (32 Bit)
SLES 10.2 (64 Bit)

New or updated packages for various GNU/Linux distributions are always added in the official web-site www.escanav.com as well as in the eScan Wiki site. To check the latest available packages for your linux distro click here

If you do not find your package in our website, please write to linux@escanav.com with your following details as mentioned below:

MailScan product name,
linux distribution and release version,
the linux kernel version and
32 bit or 64 bit OS.

4. What is the difference between the Evaluation version of MailScan software and fully licensed software?

A. The evaluation version and licensed version of MailScan are identical in feature and functionality wise. While in evaluation version of MailScan, it will function for a limited period i.e. for 30-days after which the license key for MailScan has to be purchased.

5. How can I check the dependencies required for MicroWorld's products?

A. To check the dependencies before installing the packages

command for RPM Package
# rpm -qpR <package>

command for Debian Package
# dpkg --info <package>

6. How can I check the version of the MailScan packages installed?

A. To check the version of the installed MailScan packages

command for RPM Package

# rpm -qi <package-name>
Display   package  information,  including  name,  version,  and description.

OR

* rpm -qa <package-name>
Report status of specified package.

Example: 
rpm -qa mwadmin
rpm -qa mwav
rpm -qa mailscan

OR

Example: 
rpm -qi mwadmin
rpm -qi mwav
rpm -qi mailscan

command for Debian Package

# dpkg -l <package-name>
List packages matching given pattern

OR

# dpkg -s <package-name>
Report status of specified package.

Example:
dpkg -l mwadmin
dpkg -l mwav
dpkg -l mailscan

OR

Example:
dpkg -s mwadmin
dpkg -s mwav
dpkg -s mailscan

7. How does MailScan for Linux Mail server works?

A. MailScan will scan all incoming and outgoing mails on a real time basis for viruses and other malwares, offensive contents and malicious attachments. MailScan uses content scanning for detection of SPAM mails. It will restrict emails with certain words or phrases that are not useful to an organization.

Thus MailScan will scan for Viruses and content scanning and deliver the mail to the Mail Server.

[edit]

Features

[edit]

Web Based Administration

1. How can I access the MailScan for Linux administration?

A. Mailscan for Linux administration console can be accessed using a web-browser, thus enabling remote administration of the Mailscan.
To login to the Web-Administration from the web-browser:

https://ip-address-of-MailScan-Server:10443

[edit]

Spam Control - Greylisting

1. What is Greylisting?

A. Grey Listing is one of the features used by MailScan to control spam emails. Grey Listing method, when enabled, temporarily rejects a mail when it is received for the first time or from an unknown sender. A genuine mail-server will always retry to re-send the mail, while a spammer, generally, will not try to re-send those mails which fails to reach the recipient.

Greylisting checks for 3 basic informations to identify a mail, which is called as "TRIPLET":

The ip address of the sender domain,
The email address of the sender and
The email address of the recipient

If the triplet is seen for the first time (i.e. the mail is sent to the recipient domain for the first time), then the mail is temporarily rejected. A temporary message is sent to the sender SMTP server like the one given below:

 451 4.7.1 Please try again later

If the triplet has been seen and accepted by the recipient domain before, then the mail is accepted and delivered.

4. How can I enable Greylisting in Mailscan?

A. To enable Greylisting in Mailscan

1. Login the the Web-Administration of the MailScan

https://ip-address-of-MailScan-Server:10443

2. Click on Mail Options ==> Features

3. Check the Enable Grey Listing option

4. Restart the MailScan Services from Server Control ==> Server Status and restart the Anti-Spam and SMTP Services.

3. Can mails from a known domain/s be whitelisted from GreyListing in MailScan?

A. Yes. To whitelist a particular domain from Greylisting add the IP address with its subnet mask (Network prefix) of the Sender domain.

1. Login the the Web-Administration of the MailScan

https://ip-address-of-MailScan-Server:10443

2. Click on Content Filter ==> Grey Listing

3. Add the ip address and the network prefix of the domain to be whitelisted in the space given.

[edit]

Spam Control - RBL & DUL

1. What is RBL & DUL check?

A. The MAPS (Mail Abuse Prevention System), an organization, maintains a list of IP addresses that are known for sending spam emails. The lists are

* Real-Time Blackhole List 
* Dialup Users List (DUL)

When a mail is received from a domain, which is not in the Allow Domain list, MailScan sends a query to the MAPS server which verifies the IP. If the IP is listed in the RBL / DUL list, the connection is dropped.

2. Does MailScan supports multi RBL checks?

A. Yes. MailScan supports multi RBL checks. By default, MailScan checks from the below RBL servers:

* zen.spamhaus.org
* bl.spamcop.net
* list.dsbl.org

To add or modify the list of RBL / DUL Server list

1. Login the the Web-Administration of the MailScan

https://ip-address-of-MailScan-Server:10443

2. Click on Mail Options ==> RBL & DUL Settings

3. Add / modify in the space provided for "Open Relay Blackhole List / Dialup Users List Servers".

4. Restart the MailScan Services from Server Control ==> Server Status and restart the Anti-Spam and SMTP Services.

3. How to Enable RBL / DUL check?

A. To Enable RBL / DUL check,

1. Login the the Web-Administration of the MailScan

https://ip-address-of-MailScan-Server:10443

2. Click on Mail Options ==> RBL & DUL Settings

3. Check the option Enable RBL/DUL check.

4. Restart the MailScan Services from Server Control ==> Server Status and restart the Anti-Spam and SMTP Services.

4. Can domain IP's which are listed in the RBL / DUL server be whitelisted in MailScan?

A. Yes. To whitelist domain IP's which are listed in the RBL / DUL server

1. Login the the Web-Administration of the MailScan

https://ip-address-of-MailScan-Server:10443

2. Click on Mail Options ==> RBL & DUL Settings

3. Add the Domain's IP address, to be whitelisted, in the space provided for "White List RBL Listed IPs".

4. Restart the MailScan Services from Server Control ==> Server Status and restart the Anti-Spam and SMTP Services.

Mailscan will accept all the mails from the whitelisted ip address.

5. What is "Black List RBL Listed IPs" in MailScan?

A. When an IP address, found in the RBL / DUL server's list, can be added in the "Black List RBL Listed IPs" of the MailScan. Any, connection from the IP address listed in "Black List RBL Listed IPs" will be instantly dropped, without querying the RBL / DUL servers.

[edit]

Scenarios

[edit]

Type I

MailScan for Linux Mailserver can act as a Mail Gateway (Mail Transport Agent – MTA), wherein the MailServer is on a different system. All mails shall be scanned and passed through MailScan and then forwarded to the MailServer located on a different system.

[edit]

Type II

MailScan for Linux Mailserver is installed on the same system where a Mailserver is running. MailScan will be running on Port 25 and the MailServer SMTP service should be made to run on a different unused port eg. Port 26. Incoming mails will be accepted on port 25 & scanned by MailScan and then forwarded to the MailServer SMTP port 26.

[edit]

Type III

MailScan for Linux Mailserver can also act as a Mail Delivery Agent (MDA) for locally configured mail users.

Retrieved from "https://wiki.escanav.com/wiki/index.php/Online_Guide_-_MailScan_for_Linux"

Welcome to eScan Wikipedia

From eScan Wiki

Current revision

Contents

Required Packages

Installation

FAQ's

General

Features

Web Based Administration

Spam Control - Greylisting

Spam Control - RBL & DUL

Scenarios

Type I

Type II

Type III

Main Page

Latest Developments

Product Information

Knowledge Base

For Windows Downloads

For Linux Downloads

For MAC Downloads

General

Support

Views

 |-
 {| id="mp-topbanner" style="width:100%; background:#fcfcfc; margin-top:1.2em; border:1px solid #ccc;"
-|style="text-align:left;"|'''Languages :'''&nbsp;&nbsp;'''·''' [[EPC|<font size=1.5 color="blue">English</font>]]&nbsp;&nbsp;'''·''' [[Escan/latinspanish/protection|<font size=1.5 color="blue">Español</font>]]&nbsp;&nbsp;'''·''' [[Escan/italian/protection|<font size=1.5 color="blue">Italiano</font>]]&nbsp;&nbsp;'''·''' [[Escan/chinese/EPC|<font size=1.5 color="blue">中文（繁體）</font>]]
+| style="width:10%; color:#000;" |
+{| style="width:100px; border:none; background:none;"
+| [[Image:escan-g.jpg]]
 |}
-<!--
+|style="text-align:left;"|'''·''' [[Escan/english/FAQ-eScan|<font size=1.5 color="blue"
-{| class="wikitable" border="0"
-|-
+align="left">eScan</font>]]&nbsp;&nbsp;'''·''' [[Escan/english/MailScan-AFT|<font size=1.5
-{| id="mp-topbanner" style="width:100%; background:#fcfcfc; margin-top:1.2em; border:1px solid #ccc;"
-| style="width:56%; color:#000;" |
+color="blue">MailScan</font>]]&nbsp;&nbsp;'''·''' [[Escan/english/Technologies|<font size=1.5
-{| style="width:280px; border:none; background:none;"
-| [[Image:mwti_logo.gif|left]]
+color="blue">Technologies</font>]]
-|}
+|style="text-align:right;"|&nbsp;&nbsp;'''·''' [[Technical Info|<font size=1.5 color="blue">Technical
--->
-{| id="mp-topbanner" style="width:100%; background:#fcfcfc; margin-top:1.2em; border:1px solid #ccc;text-align:left;"
+Info</font>]]&nbsp;&nbsp;'''·''' [[Escan/english/Security_Awareness|<font size=1.5 color="blue">Security
-|width="1000pt" style="width:18%; font-size:95%;text-align:left;white-space:nowrap;"|
-<B>General</B>
+Awareness</font>]]&nbsp;&nbsp;'''·''' [[User_Guides|<font size=1.5 color="blue">User Guides</font>]]
-* [http://www.mwti.net/<font color="blue">MicroWorld Website</font>]
-* [[Main Page|<font color="blue">MicroWorld WIKI</font>]]
-* [[Marketing|<font color="blue">Marketing</font>]]
-* [[Events|<font color="blue">Events</font>]]
-* [[Marketing/Advertisement|<font color="blue">Advertisement</font>]]
-|width="1000pt" style="width:18%; font-size:95%;text-align:left;white-space:nowrap;"|
-<B>Knowledgebase</B>
-* [[Technical Info|<font color="blue">Technical Information</font>]]
-* [[Beta Testing|<font color="blue">Beta Testing</font>]]
-* [[Release Candidate|<font color="blue">Release Candidate</font>]]
-* [[User Guide|<font color="blue">User Guides</font>]]
-|width="1000pt" style="width:18%; font-size:95%;text-align:left;white-space:nowrap;"|
-<B> Support </B>
-* [[EMail|<font color="blue">eMail</font>]]
-* [[Online Chat|<font color="blue">Online Chat</font>]]
-* [[Telephonic Support|<font color="blue">Telephone</font>]]
-* [[Remote Support|<font color="blue">Remote Support</font>]]
-* [[Forums|<font color="blue">Forums</font>]]
 |}
 {| class="wikitable" border="0"
-|-
+|}
 {| id="mp-topbanner" style="width:100%; background:#fcfcfc; margin-top:1.2em; border:1px solid #ccc;"
 |style="text-align:left;"|<font size=3>'''MailScan for Linux Mail Servers'''</font>
  <B>RPM Package Name                       File name</B>
-     mwadmin                 mwadmin-x.x-x.<linux flavor><release>.i386.rpm
+     mwadmin                 mwadmin-x.x-x.<linux distro><release>.i386.rpm
-     mwav                    mwav-x.x-x.<linux flavor><release>.i386.rpm
+     mwav                    mwav-x.x-x.<linux distro><release>.i386.rpm
-     mailscan                mailscan-x.x-x.<linux flavor><release>.i386.rpm
+     mailscan                mailscan-x.x-x.<linux distro><release>.i386.rpm
  <B>Debian Package Name                    File name</B>
-     mwadmin                 mwadmin-x.x-x.<linux flavor><release>.i386.deb
+     mwadmin                 mwadmin-x.x-x.<linux distro><release>.i386.deb
-     mwav                    mwav-x.x-x.<linux flavor><release>.i386.deb
+     mwav                    mwav-x.x-x.<linux distro><release>.i386.deb
-     mailscan                mailscan-x.x-x.<linux flavor><release>.i386.deb
+     mailscan                mailscan-x.x-x.<linux distro><release>.i386.deb
 <B>For RPM Packages:</B>
- # rpm -ivh mwadmin-x.x-x.<linux flavor><release>.i386.rpm
+ # rpm -ivh mwadmin-x.x-x.<linux distro><release>.i386.rpm
- # rpm -ivh mwav-x.x-x.<linux flavor><release>.i386.rpm
+ # rpm -ivh mwav-x.x-x.<linux distro><release>.i386.rpm
- # rpm -ivh mailscan-x.x-x.<linux flavor><release>.i386.rpm
+ # rpm -ivh mailscan-x.x-x.<linux distro><release>.i386.rpm
 <B>For Debian packages:</B>
- # dpkg -i mwadmin-x.x-x.<linux flavor><release>.i386.deb
+ # dpkg -i mwadmin-x.x-x.<linux distro><release>.i386.deb
- # dpkg -i mwav-x.x-x.<linux flavor><release>.i386.deb
+ # dpkg -i mwav-x.x-x.<linux distro><release>.i386.deb
- # dpkg -i mailscan-x.x-x.<linux flavor><release>.i386.deb
+ # dpkg -i mailscan-x.x-x.<linux distro><release>.i386.deb
 ===General===
+----
 <B>1. What is MailScan for Linux Mail Servers?</B>
 ----
-<B>3. For which flavors of GNU/Linux is MailScan for Linux Mailserver available?</B>
+<B>3. For which GNU/Linux distributions is MailScan for Linux Mailserver available?</B>
 <B>A.</B> MailScan for Linux MailServer is available for
-New or updated packages for various flavors of GNU/Linux are always added in the official web-site www.escanav.com as well as in the eScan Wiki site. <span class="plainlinks neverexpand">[http://download1.mwti.net/wiki/index.php/Escan_for_Linux_Desktop Click here to check the available Packages for download]</span>
+New or updated packages for various GNU/Linux distributions are always added in the official web-site www.escanav.com as well as in the eScan Wiki site. To check the latest available packages for your linux distro <span class="plainlinks neverexpand">[[MailScan for Linux|<B>click here</B>]]</span>
 If you do not find your package in our website, please write to [mailto:linux@escanav.com <font color="blue">linux@escanav.com</font>] with your following details as mentioned below:
 :* MailScan product name,
-:* linux flavor and release version,
+:* linux distribution and release version,
 :* the linux kernel version and
 :* 32 bit or 64 bit OS.
  dpkg -s mwav
  dpkg -s mailscan
 ----
-<B>7. How does MailScan for Linux Mail server work?</B>
+<B>7. How does MailScan for Linux Mail server works?</B>
 <B>A.</B> MailScan will scan all incoming and outgoing mails on a real time basis for viruses and other malwares, offensive contents and malicious attachments. MailScan uses content scanning for detection of SPAM mails. It will restrict emails with certain words or phrases that are not useful to an organization. <br/>
 ===Features===
+====Web Based Administration====
+----
+<B>1. How can I access the MailScan for Linux administration?</B>
+<B>A.</B> Mailscan for Linux administration console can be accessed using a web-browser, thus enabling remote administration of the Mailscan.<br/>
+To login to  the Web-Administration from the web-browser:
+ <B>https://ip-address-of-MailScan-Server:10443</B><br/>
+<!--====Virus Control====-->
+<!--====Spam Control - Content Filter====-->
 ====Spam Control - Greylisting====
+----
 <B>1. What is Greylisting?</B>
-<B>A.</B> Grey Listing is one of the features used by MailScan to control spam emails. Grey Listing method, when enabled, temporarily rejects a mail when it is received for the first time or from an unknown sender. A genuine mail-server will always retry to re-send the mail while a spammer generally will not re-send those mails which fails to reach the recipient.
+<B>A.</B> Grey Listing is one of the features used by MailScan to control spam emails. Grey Listing method, when enabled, temporarily rejects a mail when it is received for the first time or from an unknown sender. A genuine mail-server will always retry to re-send the mail, while a spammer, generally, will not try to re-send those mails which fails to reach the recipient.
 Greylisting checks for 3 basic informations to identify a mail, which is called as <B>"TRIPLET"</B>:
 ----
-<B>2. Can mails from a known domain/s be whitelisted from GreyListing in MailScan?</B>
+<B>4. How can I enable Greylisting in Mailscan?</B>
+<B>A.</B> To enable Greylisting in Mailscan
+:<B>1.</B> Login the the Web-Administration of the MailScan<br/>
+ <B>https://ip-address-of-MailScan-Server:10443</B><br/>
+:<B>2.</B> Click on Mail Options ==> Features<br/>
+:<B>3.</B> Check the Enable Grey Listing option<br/>
+:<B>4.</B> Restart the MailScan Services from Server Control ==> Server Status and restart the Anti-Spam and SMTP Services.
+----
+<B>3. Can mails from a known domain/s be whitelisted from GreyListing in MailScan?</B>
 <B>A.</B> Yes. To whitelist a particular domain from Greylisting add the IP address with its subnet mask (Network prefix) of the Sender domain.
 :<B>2.</B> Click on Content Filter ==> Grey Listing<br/>
 :<B>3.</B> Add the ip address and the network prefix of the domain to be whitelisted in the space given.<br/>
+----
+====Spam Control - RBL & DUL====
+----
+<B>1. What is RBL & DUL check?</B>
+<B>A.</B> The MAPS (Mail Abuse Prevention System), an organization, maintains a list of IP addresses that are known for sending spam emails. The lists are
+ * Real-Time Blackhole List
+ * Dialup Users List (DUL)
+When a mail is received from a domain, which is not in the Allow Domain list, MailScan sends a query to the MAPS server which verifies the IP. If the IP is listed in the RBL / DUL list, the connection is dropped.
+----
+<B>2. Does MailScan supports multi RBL checks?</B>
+<B>A.</B> Yes. MailScan supports multi RBL checks. By default, MailScan checks from the below RBL servers:
+ * zen.spamhaus.org
+ * bl.spamcop.net
+ * list.dsbl.org
+To add or modify the list of RBL / DUL Server list
+:<B>1.</B> Login the the Web-Administration of the MailScan<br/>
+ <B>https://ip-address-of-MailScan-Server:10443</B><br/>
+:<B>2.</B> Click on Mail Options ==> RBL & DUL Settings<br/>
+:<B>3.</B> Add / modify in the space provided for <B>"Open Relay Blackhole List / Dialup Users List Servers"</B>.<br/>
+:<B>4.</B> Restart the MailScan Services from Server Control ==> Server Status and restart the Anti-Spam and SMTP Services.
+----
+<B>3. How to Enable RBL / DUL check?</B>
+<B>A.</B> To Enable RBL / DUL check,
+:<B>1.</B> Login the the Web-Administration of the MailScan<br/>
+ <B>https://ip-address-of-MailScan-Server:10443</B><br/>
+:<B>2.</B> Click on Mail Options ==> RBL & DUL Settings<br/>
+:<B>3.</B> Check the option Enable RBL/DUL check.<br/>
+:<B>4.</B> Restart the MailScan Services from Server Control ==> Server Status and restart the Anti-Spam and SMTP Services.
+----
+<B>4. Can domain IP's which are listed in the RBL / DUL server be whitelisted in MailScan?</B>
+<B>A.</B> Yes. To whitelist domain IP's which are listed in the RBL / DUL server
+:<B>1.</B> Login the the Web-Administration of the MailScan<br/>
+ <B>https://ip-address-of-MailScan-Server:10443</B><br/>
+:<B>2.</B> Click on Mail Options ==> RBL & DUL Settings<br/>
+:<B>3.</B> Add the Domain's IP address, to be whitelisted, in the space provided for <B>"White List RBL Listed IPs"</B>.<br/>
+:<B>4.</B> Restart the MailScan Services from Server Control ==> Server Status and restart the Anti-Spam and SMTP Services.
+:Mailscan will accept all the mails from the whitelisted ip address.
+----
+<B>5. What is "Black List RBL Listed IPs" in MailScan?</B>
+<B>A.</B> When an IP address, found in the RBL / DUL server's list, can be added in the <B>"Black List RBL Listed IPs"</B> of the MailScan. Any, connection from the IP address listed in <B>"Black List RBL Listed IPs"</B> will be instantly dropped, without querying the RBL / DUL servers.
+----
+===Scenarios===
+====<B>Type I</B>====
+MailScan for Linux Mailserver can act as a Mail Gateway (Mail Transport Agent – MTA), wherein the MailServer is on a different system. All mails shall be scanned and passed through MailScan and then forwarded to the MailServer located on a different system.
+{| style="width:50px; border:none; background:none;"
+[[Image:MS-scenario1.jpg| ]]
+|}
+----
+====<B>Type II</B>====
+MailScan for Linux Mailserver is installed on the same system where a Mailserver is running. MailScan will be running on Port 25 and the MailServer SMTP service should be made to run on a different unused port eg. Port 26. Incoming mails will be accepted on port 25 & scanned by MailScan and then forwarded to the MailServer SMTP port 26.
+{| style="width:50px; border:none; background:none;"
+[[Image:MS-scenario2.jpg| ]]
+|}
+----
+====<B>Type III</B>====
+MailScan for Linux Mailserver can also act as a Mail Delivery Agent (MDA) for locally configured mail users.
+{| style="width:50px; border:none; background:none;"
+[[Image:MS-scenario3.jpg| ]]
+|}
 ----