Glossary. Sophos Unix

पीडीएफ

दस्तऐवज

जाहिरात

Sophos | Appendices | 227

Appendices

The Appendices include a glossary of terms, the PureMessage FAQ, the PostgreSQL Tuning Guide, links to documentation for related applications, a Policy Script tutorial, a Regular Expression Primer, a description of the PerlMx API (along with some examples), as well as the PureMessage Release Notes, and the Copyright and Trademark acknowledgements.

Glossary

The following terms are essential to the understanding of PureMessage.

Active Directory

Active Directory is Microsoft's implementation of LDAP (Lightweight Directory Access Protocol) on Windows.

The Active Directory service provides management of identities and permissions of users throughout a network.

A Record

See DNS A Records.

See

DNS A Records

(page 228).

blackhole list

A blackhole list is a list of hosts known to be sources of spam.

blacklist

A blacklist is a list used to block mail from specific hosts.

In Sophos email and URL filtering products, this list is also referred to as a blocked hosts/senders list. This type of list is also known as a "block list".

blocker

The IP blocker is a utility that rejects messages originating from blacklisted IP addresses prior to either MTA or policy processing.

A Sophos utility that rejects messages originating from IP addresses blacklisted by

SophosLabs

(page 232) and from senders

that are otherwise deemed to be spammers, either prior to processing by the MTA or in the policy. See also "

pmx-blocker

CSM

The "Centralized Server Manager" is one of the server roles that is installed in a PureMessage deployment.

"Centralized Server Manager" is one of the server roles that is installed in a single-server deployment, or one of the roles that you can select for installation on a server in a custom installation. The CSM server must be the first server role that is

installed. It is typically installed on the same server as the Database Server role or the Mail Filter role. See

Server Deployment

Options

and

Custom Installation

. Also, see

Local Services Tab

for the CSM capabilities accessible from the PureMessage

Manager. See also

roles

(page 231).

Dashboard

The Dashboard is the default page in the administrative UI; shows key statistics and status.

228 | Sophos | Appendices

The Dashboard is the initial page displayed by default in Sophos email and URL filtering products. It shows a summary of the key statistics and the system status of the product.

day zero

Day zero is the period during which a threat is so new that no threat detection signatures are available to protect against it.

Fast moving threats such as internet worms can cause huge amounts of damage at day zero. Sophos uses its Genotype

™ technology to block families of spam and viruses, offering a form of protection against previously unseen threats even before specific detection is available.

denial of service (DOS) attack

A denial of service attack is an attack on a host or network that causes a loss of service to its users.

This is usually done by consuming the bandwidth of the target system or overloading its computational resources with multiple, distributed connections.

dictionary attack

A dictionary attack is a technique of trying to guess a user's password by running through a list of likely possibilities, often a list of words from a dictionary.

It contrasts to a brute force attack in which all possibilities are tried. The attack works because users often choose easy-to-guess passwords. In anti-spam terminology this also refers to using a dictionary list to guess email account names in a spam campaign.

directory harvest attack

A directory harvest attack is a technique to build a spam mailing list by sending all possible alphanumeric combinations for the username to an email domain and building a database of all addresses that do not generate a reply.

An attempt to determine valid email addresses for a domain to add to a spam distribution database. The harvesting software uses either a brute force approach (sending all possible alphanumeric combinations for the username), or a more selective method (for example, using all possible first initials followed by common surnames). In either case, the email server generally returns a "Not found" reply for all messages sent to a nonexistent address and none for those sent to valid addresses. The harvesting program builds a database of all addresses that do not generate a reply.

DNS A Records

DNS A records (Address record) map hostnames to IP addresses.

DNSBL

A DNSBL is a published list of the IP addresses of known spam sources that is used as one factor in deciding to identify an email as spam.

A DNS-based

blackhole list

(page 227) is a means of publishing a list of IP addresses, in a format that can be queried via

DNS. DNSBLs are chiefly used to publish lists of addresses linked to spamming. Most

MTA

(page 230) software can be configured to reject or flag messages that have been sent from a site listed on one or more such lists.

DNS MX Records

DNS MX records (Mail exchange record) map domain names to a list of mail exchange servers for that domain.

edge server

An edge server is a server that operates on the security edge of an organization's intranet.

That is, a computer running server applications that interact with systems outside of the control of the organization. In the email and anti-spam world, an MTA that sends and receives messages to and from other organization's MTAs.

Sophos | Appendices | 229

email header

An email header is the meta information prepended to email messages to provide content information and log the message's path from sender to recipient.

Meta information prepended to email messages to indicate the message's sender and content information and log the message's path from sender to recipient. Headers are added by the sender's email client, and by each mail relay that passes the message toward its destination. Normally, the node that retrieves the message doesn't add any further headers. Typical email headers include: To, From, Subject, Date, User-Agent, and Received.

End User Web Interface (EUWI)

The End User Web Interface (EUWI) is a web-based interface for end users that allows them to manage their PureMessage user-specific options.

End users can manage blocked (quarantined) messages, modify their Allowed Senders and Blocked Senders lists, and configure other user-specific options.

false negative

A false negative is a determination that an email message is not spam when in fact it is or that there are no viruses present when in fact there are.

A determination that an email message is not spam when in fact it is or that there are no viruses present when in fact there are.

false positive

A false positive is a determination that a virus has been found or that an email message is spam when this is not the case.

A determination that a virus has been found or that an email message is spam when this is not the case.

glob

A glob is a minimal regular expression syntax used in searching.

In this context, a minimal regular expression syntax used in searching.

Groups Web Interface

The groups web interface is a web-based interface that allows a global administrator to delegate administrative responsibilities to "group" administrators.

A web-based interface that allows a global administrator to delegate administrative responsibilities to "group" administrators based on groups/domains and/or roles. Tasks are delegated by way of access rights and can include quarantine management, reporting, list management and the configuration of certain policy settings. Group administrators can only access tabs and features that have been made available by the global administrator.

groups

Groups are lists of users to which differentiated policy settings can be applied.

Lists of users that the Sophos email and URL filtering products use as a basis for the

policy

(page 231) settings that determine

which filtering actions are performed for which users.

heuristics

Anti-spam rules that provide general indications that a message is likely to contain spam or viruses.

Each indicator contributes to the overall spam weight. Heuristics allow PureMessage to detect variants of certain kinds of spam and viruses, even if the specific variants have yet to be analyzed by SophosLabs.

230 | Sophos | Appendices

internal hosts

Internal hosts reside within your network, behind the gateway or proxy server.

In setups where another device, such as another SMTP relay or a firewall, is positioned at the network boundary, "internal" refers to hosts that are further inside the network than the gateway or proxy server.

Manager

The PureMessage Manager is a web-based graphical user interface (GUI) for the PureMessage system (as opposed to the command-line interface).

The PureMessage Manager is the graphical user interface (GUI) for the PureMessage system (as opposed to the PureMessage

command-line interface) that is accessed via a web browser. See the

PureMessage Manager

documentation for detailed information.

milter

A milter is an extension to sendmail (MTA) that allows administrators to add mail filters for filtering spam, viruses or applying mail policy.

Generally, "milter" refers to an extension to the widely used open source mail transfer agent (MTA) sendmail that allows administrators to add mail filters for filtering spam, viruses or applying mail policy. In the PureMessage documentation, however, this concept has been extended to define the PureMessage filtering process(es) that operate with any supported

MTA.

MTA

An Mail Transfer Agent (MTA) is a service that transfers messages from the sender or another relay toward its destination.

Often referred to as a mail relay or a mail hub.

MX record

See DNS MX Records.

See

DNS MX Records

(page 228).

network mask

A network mask specifies which are the subnetwork and host parts of an IP address.

Also known as a subnet mask, netmask or address mask, the network mask is used to specify which parts of the dotted quad of an IP address identify the subnetwork the host is on and which parts identify the host itself. Network masks are usually represented in either dotted quad notation (for example, 255.255.255.0) or CIDR notation (for example, 192.168.1.0/24).

packages

Packages are files that contain modularized grouped components used for software installation and upgrade.

Sophos email and URL filtering products' software is installed and upgraded by downloading and installing package files containing grouped components.

phishing

Phishing is the acquisition of identity or passwords by false bank emails and web sites.

(Also known as carding and spoofing) Attempting to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business in an apparently official electronic communication, such as an email or an instant message. The term phishing arises from the use of increasingly sophisticated lures to "fish" for users' financial information and passwords. Sophos email and URL filtering products are configured by default to detect phishing schemes.

Sophos | Appendices | 231

policy

Policy refers to the Sophos email or URL filtering rules.

Policies consist of rules made up of tests and actions. As messages or web content passes through the policy engine, they are tested to see if they meet specified criteria. Those that match have a specified action performed on them (for example,

Mail With: Unscannable Attachments - Take Action: Quarantine). Rules can relate to the identification and handling of messages or URLs containing:

• spam

• viruses

• unscannable, encrypted, or suspect attachments

• offensive words

• keywords

• malware

Postfix

Postfix is a fast, easy-to-administer, and secure open source mail transfer agent (MTA).

Postfix is an open source mail transfer agent (MTA), a computer program for the routing and delivery of email, that is intended as a fast, easy-to-administer, and secure alternative to the widely-used sendmail. Formerly known as VMailer and

IBM Secure Mailer, it was originally written by Wietse Venema during a stay at the IBM Thomas J. Watson Research

Center, and continues to be actively developed today.

PostgreSQL

PostgreSQL is a free object-relational database server (database management system), released under a flexible BSD-style license.

PostgreSQL is a free object-relational database server (database management system), released under a flexible BSD-style license. It offers an alternative to other open-source database systems, as well as to proprietary systems. PostgreSQL is used by PureMessage to store report data, message quarantines, and end-user resources.

quarantine

The quarantine is a store of messages whose delivery has been blocked by policy rules.

Messages held in the quarantine can be reviewed, released, or deleted.

roles

PureMessage roles refer to predetermined groupings of network services that can be divided between one or more systems on a network.

PureMessage roles are predetermined groupings of network services that can be divided between one or more systems on a network that enable improved performance for organizations of varying size with varying message processing requirements.

See

Server Deployment Options

and