Quick Reference Guide. Sophos Unix

Sophos | Getting Started Guide | 45

6. Continue with the upgrade. Once verification is complete, enter: pmx-setup

Updating to PostgreSQL 8.x

As of version 5.5, PureMessage includes an improved version of PostgreSQL. If you are upgrading to PureMessage 5.5 or later from a previous version of PureMessage, the new version of PostgreSQL will be added to your installation, but it will be disabled by default.

To begin using PureMessage with PostgreSQL 8.x, you must first transfer your data from the old version of PostgreSQL to the new version of PostgreSQL using pmx-pg-migrate

.

Following the migration, you must run pmx-pg-switch

(as the root user) to configure PureMessage to use the new version of PostgreSQL.

Before starting the migration, stop PureMessage, and ensure that your PureMessage database server has the minimum shared memory allocation (as described in the “Tuning PostgreSQL for PureMessage 5.x” article in Sophos's online Knowledgebase).

Ensure also that you have sufficient disk space to create a backup of your data before performing the migration. The data is stored in a temporary directory that is created during the migration (

/opt/pmx/home/

by default). The time required for a migration will vary, according to the size of your database.

To upgrade from PostgreSQL 7.4 to 8.x:

1. As the pmx user, run pmx stop

.

2. As the pmx user, run pmx-pg-migrate

.

If you have a large database, this command will take a considerable amount of time to run.

3. Switch to the root user, and run pmx-pg-switch

.

4. Switch back to the pmx user, and run pmx-database restart

.

5. Once you are satisfied that all data has been successfully migrated and the new database is functioning as expected, you can safely remove the old data, which has been moved to

/opt/pmx/postgres-7.x

.

Note:

The pg_xlog

for PostgreSQL 8 is not backwards compatible with the pg_xlog

for PostgreSQL 7.4. If there is symlink to pg_xlog

for PostgreSQL 8, and you opt to roll back to PostgreSQL 7.4, you must reset the pg_xlog

.

To reset the transaction log when rolling back to PostgreSQL 7.4:

$ rm /disk2/pg_xlog/* #Removes the existing PostgreSQL 8 transaction log

$ /opt/pmx/postgres-7.4.8/bin/pg_resetxlog -f #Makes pg_xlog compatible with PostgreSQL

7.4

Quick Reference Guide

Overview

PureMessage is an email-filtering program that analyzes email messages at the network gateway. PureMessage checks messages for characteristics that indicate “spam” (unsolicited bulk email), scans messages for viruses in conjunction with

Sophos Anti-Virus, and can also check messages to ensure that corporate email adheres to an organization's communication policy.

PureMessage processes mail in three main steps. (Functionality may vary, depending on the configuration.)

46 | Sophos | Getting Started Guide

1. The mail server passes a message to PureMessage: The mail server (sendmail, Postfix, JSMS) passes email to

PureMessage via PureMessage's "Milter" service.

2. PureMessage applies the policy filter to the message: The policy script contains tests that check for viruses, spam indicators, or other message characteristics. The tests have associated actions that determine what happens to the message if the test returns true. Available actions include:

• Delivery: Delivery actions can be configured to either deliver the message to the original recipient, redirect the message to other recipients, or remove and add recipients. The policy script can be configured to alter the original message, for example, by altering the subject line or adding a message header.

• Quarantine: The policy script can be configured to quarantine the message if certain conditions are met (such as triggering a sufficient number of anti-spam rules). Quarantined messages are copied to the quarantine directory.

Optionally, the original recipient may be notified that the message was quarantined via a quarantine digest.

3. Quarantined messages are administered: End users can release desired messages from the quarantine by responding to quarantine digests or via the End User Web Interface (EUWI). Other messages are automatically archived or deleted from the quarantine using the pmx-qexpire

program, which is configured by default during the installation to run as a scheduled job.

This document provides an overview of PureMessage. It introduces the major components of a PureMessage installation and explains how they work together to keep networks spam-free. For details about installing PureMessage, see the

“Installation Guide”. For complete operation and configuration instructions, see the Manager Reference and the Administrator's

Reference.

Starting and Stopping PureMessage

After installing PureMessage and configuring the connection to the mail server (as described in the Installation Guide,

PureMessage services are started using the pmx

program. The pmx

program must be run as the PureMessage user by default,

“pmx”). The password for the “pmx” user is set during installation.

• To start PureMessage services: a) As the 'pmx' user, enter the following at the command line: pmx start

• To stop PureMessage services: a) As the 'pmx' user, enter the following at the command line: pmx stop

For other command-line options, refer to the Administrator's Reference.

PureMessage and Mail Servers

The PureMessage distribution includes both the Postfix and sendmail SMTP mail servers. See the Installation Guide for more information. In addition, PureMessage can integrate with existing Postfix, sendmail, Sendmail Switch, and JSMS installations.

Postfix

PureMessage can be configured to work with the Postfix mail server. A distribution of Postfix is included with PureMessage, and it is the the MTA installed by default during a “Full Installation” of PureMessage. Alternatively, PureMessage can be configured to work with an existing Postfix installation. PureMessage communicates with the policy engine in PureMessage by using PureMessage as an SMTP proxy. See “Configuring an External Postfix Installation” in the Installation Guide for more information.

Sophos | Getting Started Guide | 47

Sendmail

PureMessage works in conjunction with either the open source version of sendmail or the commercial version, Sendmail

Switch. A distribution of sendmail is included with PureMessage. Alternatively, PureMessage can be configured to work with an existing sendmail or Sendmail Switch installation. PureMessage communicates with sendmail via the Milter (Policy) service. Refer to the Installation Guide for information on installing the PureMessage distribution of sendmail, or configuring

PureMessage to work with an existing sendmail or Sendmail Switch installation.

If you are using the distribution of sendmail included with PureMessage, the sendmail documentation is available via the

“Documentation for Related Applications” section of the Administrator's Reference. Otherwise, refer to the sendmail or

Sendmail Switch documentation included with your installation.

Java System Messaging Server

PureMessage can be configured to work with the JSMS mail transfer agent. JSMS is not bundled with PureMessage and must be installed before PureMessage. PureMessage supports JSMS versions 5.2, 6, 6.3, and 7. JSMS is supported on Solaris only.

PureMessage Services

PureMessage operates as a series of services. Background services such as HTTPD (Manager) and Milter (Policy) are activated when you start PureMessage. PureMessage also uses a set of scheduled jobs to perform a variety of administrative tasks at specified times. These jobs are controlled collectively by the “Scheduler”, which itself is a background service. The services are:

• AntiVirus Service: The Sophos virus-scanning service. This service is enabled only when the Run As Service check box is selected in on the Anti-Virus Options page of the Policy tab.

• HTTPD (RPC/UI): The web server and RPC services that make up the End User Web Interface and the Groups Web

Interface.

• IP Blocker Service: The PureMessage service that runs (if MTA level IP blocking is enabled). This blocks messages originating from IP addresses blacklisted by SophosLabs and from senders that are otherwise deemed to be spammers, which can improve performance by blocking spam before it undergoes more complex testing via the PureMessage policy.

• HTTPD (Manager): The web-based administrative interface to PureMessage.

• Milter (Policy): The PureMessage component that interacts with sendmail or Postfix and runs the policy engine.

• PostrgreSQL Service: The default relational database back end used for reporting and the PureMessage quarantine.

• Queue Runner Service: The service that manages and flushes the PureMessage mail queue.

• Scheduler Service: PureMessage relies on the execution of commands at specified intervals, which is handled by the

PureMessage Scheduler Service.

• Mail Transfer Agent (sendmail, Postfix, JSMS): The service that runs the configured mail transfer agent.

Scheduled Jobs

Scheduled jobs, enabled and disabled collectively by the Scheduler Service, are PureMessage programs that run at set times to accomplish specific tasks. Preconfigured scheduled jobs are displayed in the Manager, and many are enabled by default.

Clicking on the name of an individual job displays configurable time settings for that job. You can also add other PureMessage programs to the set of scheduled jobs.

PureMessage Manager

The Manager is a web-based graphical user interface for managing and configuring PureMessage. Installed as part of each

PureMessage “role” during installation, the Manager runs as the HTTPD (Manager) service.

The Manager uses Secure Sockets Layer (SSL) and is available through port 18080. To access the Manager, use the following

URL, where

<hostname>

is the name of the host on which PureMessage is installed, and

<domain>

is your organization's domain:

https://<hostname>.<domain>:18080/

The Manager interface is organized into tabs that correspond to the key areas of PureMessage functionality:

48 | Sophos | Getting Started Guide

• Dashboard Tab: Offers a high-level diagnostic overview of the PureMessage system.

• Policy Tab: Provides access to PureMessage policy rule configuration and information. The default page for this tab is the Rules page, which provides a graphical interface to the Sieve-based PureMessage policy. Click edit source to view and edit the Sieve code directly. This tab also displays all of the configured policy lists and maps. Lists and maps can be added, configured and tested from this tab.

• Quarantine Tab: Provides information and management capabilities for the PureMessage quarantine, a temporary storage area for problem messages. Typically, quarantines are used for virus-infected messages that cannot be safely deleted automatically, or messages awaiting review by administrators or end users to determine if they are spam. This tab also has settings for quarantine digest rules and options, and End User Web Interface configuration features.

• Reports Tab: A summary of essential reports data, including virus and spam statistics and system information. For each report, you can modify the graph format, report period, and the server(s) included. You can also export the report data to comma-separated values (CSV) format and configure an automated mailout for each report.

• Local Services Tab: Provides summary information and management for PureMessage services.

• Server Groups Tab: View the status of servers and manage server groups in multi-server installations.

• Support Tab: Contains information about PureMessage licenses and support arrangements, as well as links to support resources and several general PureMessage management utilities.

For information about using the PureMessage Manager, see the Manager Reference.

PureMessage Command-Line Interface

PureMessage tasks can be performed at the command line using utility programs and configuration files. For example, pmx-policy

is the command-line interface to the PureMessage policy engine; pmx-qman

is used to access quarantined messages. The sophos.conf

configuration file is used to specify options for the Sophos Anti-Virus engine. See the relevant section of the Administrator's Reference for descriptions of these programs and hyperlinks to documentation for the individual programs.

“pmx” User

A PureMessage (“pmx”) user is created by default during installation. The PureMessage user's home directory is located beneath the PureMessage installation directory (by default,

/opt/pmx

). The PureMessage user is configured to use a

Bourne-compatible shell; this configuration must not be altered. The PureMessage user account runs PureMessage programs.

You are prompted to specify a password for the PureMessage user during installation.

Policy Engine

Policies, which are built using the Sieve language, provide the filtering definition for PureMessage. PureMessage can be configured to use multiple policy scripts but uses only one by default. The default policy script is stored at

/opt/pmx/etc/policy.siv

, beneath the PureMessage installation directory.

Policies consist of rules; rules consist of tests and actions. As the policy processes messages, rules are executed on the message in the order of their configuration.

Configure policies on the Policy tab of the PureMessage Manager, or by using the pmx-policy

command-line program.

A default policy is installed and enabled during PureMessage installation. The default policy varies according to your

PureMessage license; for example, if you do not have a license for the PureMessage Virus component, virus-checking rules are not configured.

Tests define the characteristics of the message that must be matched in order for the action to be executed. Multiple conditions can be configured for a single rule.

Actions are the parts of rules that determine what happens to a message that meets or does not meet a test. Multiple actions can be specified.

You can modify the PureMessage policy using the options available on the Policy tab of the Manager. Clicking a rule description launches a new Rules page with configurable fields. Alternatively, clicking see the source displays the Sieve code that underlies the policy interface. The code can be edited directly through the Manager. See the Manager Reference and Administrator's Reference for instructions on editing the policy.

Sophos | Getting Started Guide | 49

PureMessage has a Policy Repository for storing Sieve snippets and scripts that can be incorporated into a PureMessage policy script. By default, the repository contains a number of general-purpose snippets that can be copied and pasted from the Policy Repository to the PureMessage policy and vice versa.

About PureMessage Mail Filtering

The PureMessage mail filter ( pmx-milter

) integrates with the mail transfer agent (MTA) layer of your email infrastructure

(sendmail, Postfix or JSMS) to process messages. Filtering options are defined using a Sieve-based policy script ( policy.siv

) which specifies the order of various tests and actions to be performed on each message. The following list describes some of the configurable filtering tasks:

• Check message content and attachments for known viruses and take specified actions.

• Check messages for suspicious attachment types (such as executables) and take specified actions.

• Identify messages that are spam and take specified actions.

• Check messages for keywords or phrases and take specified actions.

• Log and archive messages based on selective criteria.

• Remove, replace, or add recipients based on selective criteria.

• Add specific banners in the header or body of outgoing messages.

• Annotate email message headers (for example, Subject) with various kinds of additional information.

Tasks can be applied differently to different users and groups within your organization, and can be flexibly ordered and combined to execute your desired email policy.

Lists and Maps

Lists are used to store groups of domains, addresses or other unique identifiers referenced by particular policy rules. For example, in the default PureMessage policy, the first rule checks the message relay against the relays configured in the

Internal Hosts list.

Address maps are used to associate one email address with another, either for the purpose of redirecting notifications generated by PureMessage (such as emailed digests of quarantined mail), or for the purpose of assigning one user's email preferences to other accounts (for End User Web Interface usage).

Note: Lists and address maps with more than 5,000 entries should be converted into CDB format for better performance.

See “CDB Lists and Maps” in the Policy Configuration section of the Administrator's Reference for instructions on editing lists.conf

and converting the files with pmx-makemap

.

Message-Handling Options

“Message-handling” describes the actions that PureMessage performs on messages and depends on the type of message being handled.

Message handling also depends on the components that are configured in your PureMessage installation. For example, the

End User Web Interface

(page 51) provides individual user access to PureMessage mail-filtering functionality via a client browser. Installing this optional PureMessage component lets end users manage their own quarantined messages, whitelists and blacklists, and configure individual mail-filtering options.

Message handling is implemented via the policy script, which is described in detail in the

Policy Configuration

(page 179)

section of the Administrator's Reference. The sections below provide a general overview of the actions that can be specified in the policy script.

Spam-Handling Options

The mechanism by which spam probabilities are calculated, and the actions associated with probability thresholds, are described in the

Tuning Spam Detection

(page 16) section.

• Tag and Deliver: Alter the “Subject” header of messages delivered to end users, generally if the message's spam probability is over a certain "threshold". For example, the default policy alters the Subject header if the message's spam probability is greater than 50%. Users can implement filters within their email client based on the subject line modification,

as described in the

End User Management

(page 212) section of the Administrator's Reference.

50 | Sophos | Getting Started Guide

• Silently Tag and Deliver: Add a custom message header that records the spam probability and the anti-spam rules that were triggered by the message. The default policy adds an

X-PerlMx-Spam

header to all messages with a spam probability.

Custom headers are not visible in most client email programs.

• Quarantine: Quarantine messages with a spam probability greater than a specified percentage, allowing administrators to review quarantined messages. It can be used in conjunction with the options described above. By default, the

PureMessage policy copies messages with a probability of 50% or greater to the quarantine.

• Quarantine and Digest: Move messages above a certain probability to the quarantine.

Quarantine

(page 50) inform

users of which messages have been quarantined.

Virus-Handling Options

The following virus-handling options are available:

• Clean the Message: When the anti-virus engine detects a virus in a message, PureMessage can attempt remove the virus from the message. If the virus cannot be cleaned from the message, PureMessage removes the infected attachment and generates and generates a notification message for the recipient, based on a template. This is the default behavior in the policy for messages that originate from external hosts.

• Reject or Discard the Message: PureMessage can either reject or discard messages containing viruses. By default, messages originating from internal hosts are rejected.

• Scanfailed Action: When a message contains content that cannot be scanned, such as an encrypted attachment,

PureMessage can take specific action, based on the virus engine's response to the failed scan.

Policy-Handling Options

In this context, “policy-handling options” refer to tests and actions that can be implemented in the policy script. These options can include checking for attachments, adding banners to messages, or placing the result of shell commands in a template variable. Because policy-handling options vary depending on an organization's needs, there are no general recommendations.

For examples on configuring policy-handling options, see

Customizing Policies

(page 187) in the Administrator's Reference.

Quarantine

The PureMessage quarantine stores messages that have been quarantined according to the configuration of the PureMessage policy. For example, messages quarantined because their spam probability exceeds a certain level.

By default, PureMessage uses the PostgreSQL database to index its quarantine.

Messages are quarantined when the Copy the message to quarantine (“ pmx_file

”) or Quarantine the message (“ pmx_quarantine

”) action is used in a policy rule.

When a message is quarantined, the message is moved to the var/qdir/new

directory beneath the PureMessage installation directory. The quarantine indexer then assigns a quarantine identifier to the message, updates index files and moves it to the var/qdir/cur

directory.

When messages are first quarantined, they are temporarily stored in

/opt/var/qdir/new

. At regular intervals, the quarantine indexer parses this directory, assigns quarantine ID numbers to the messages, updates the index, and moves the messages to

/opt/var/qdir/cur

.

Quarantined messages are managed using either the Manage Quarantine feature in the PureMessage Manager or the pmx-qman

command-line program. Message management actions include deleting, approving for delivery, and saving.

Quarantine Digests

When quarantine digests are enabled, end users receive email notifications of quarantined messages. Notifications contain lists of quarantined messages that were originally destined for particular users. Users can reply to automatically release the desired messages from the quarantine.

Sophos | Getting Started Guide | 51

Centralized and Consolidated Quarantines

Administrators can configure PureMessage to use either a centralized or consolidated quarantine. In a centralized quarantine, metadata from multiple quarantines is collected in a single PostgreSQL database. In a consolidated quarantine, messages are drawn from multiple quarantines and stored in a single location.

End User Web Interface

The End User Web Interface (EUWI) gives PureMessage users access to email-filtering features. Users can view and manage messages that are quarantined by PureMessage, manage user-specific sender lists, and configure various email-filtering options.

The EUWI is a PureMessage service that runs, by default, on port 28443. End users are granted access by one of three means of authentication: session ID, flat-file and LDAP. The default authentication method is session ID. See “End User

Authentication” in the Manager Reference for details on configuring an authentication method for the EUWI.

Administrators can control which features are available to users through the EUWI. For example, an administrator could choose to let users view a list of quarantined messages but not the contents of those messages.

Groups Web Interface

The PureMessage Groups Web Interface allows a global administrator to delegate administrative responsibilities to “group” administrators based on groups/domains and/or areas of responsibility. Delegated tasks can include quarantine management, reporting, list management and the configuration of certain policy settings.

The Groups Web Interface is a PureMessage service that runs, by default, on port 28443. Group Administrators can only access the tabs and features that have been made available by the global administrator.

Central Server Management

PureMessage can be deployed in multi-server configurations. “Server groups” consist of a central server and one or more

“edge” servers. The edge servers are managed, configured, and maintained from the central server, which has connection and authentication profiles for the other machines. Centralized management of server groups is achieved through remote procedure calls (RPC) run from the central server.

By default, PureMessage has an “RPC User” account configured for the HTTPD (Manager) service. This user has a limited set of privileges, sufficient for starting and stopping services and updating configuration files.

Central server management makes it possible to:

• view the status of all PureMessage servers on the network

• add and remove edge servers

• start and stop PureMessage services on edge servers

• build and test configurations on the central server; distribute configurations to edge servers

• generate reports for edge servers (or groups of edge servers) from the central server

Publications

PureMessage uses “publications” to distribute the configuration files on the central server to edge servers. Edge servers are

“subscribed” to these publications.

By default, PureMessage includes publications with configuration files for major aspects of the program's functionality, such as Sophos-Anti-Virus-Conf and Anti-Spam-Config. Existing publications can be viewed and edited on the Server

Groups tab of the PureMessage Manager.

Optionally, create custom publications using either the PureMessage Manager, or the pmx-share

command-line program.