The Messaging Server provides the following protection against unsolicited email (or "spam"):
built-in defaults | The Messaging Server includes a simple built-in filter that diverts any mail not directly addressed to a Messaging Server user or alias. Diverted mail can be sent to a folder or destroyed. This eliminates messages sent as Blind CC (bcc), a major delivery vehicle for unsolicited email. This filter is activated by the msgaclset utility for any user who is added to the system. The filter and exception lists can also be managed for individual users using the msgusermod utility. See the msgaclset(8) and msgusermod(8) manual pages for more information. | |
Postfix UCE configuration | ||
By default, the Postfix SMTP server only accepts mail from or to the local network or domain, or to domains that are hosted by Postfix. This prevents your system from being used as a mail relay to forward bulk mail from unknown sources. You can also implement UCE (unsolicited commercial email) policies that prevent such email altogether; for example, you can configure Postfix to use RBL (real-time blackhole list) name servers. For more information, see "Postfix Configuration - UCE Controls" in the Wietse's Postfix Project documentation. |
The Messaging Server provides integration with anti-virus software. To enable supported anti-virus software:
Install the anti-virus software.
Edit the /etc/opt/lsb-caldera.com-volution/msg/vscan.conf file and remove the comments appropriate to your anti-virus software.
For more information, see:
the vscan.conf(5) manual page
the current list of supported anti-virus software packages in the Late News document on the Messaging Server documentation website:
your anti-virus software product documentation
Postfix provides support for filtering the headers of incoming mail messages. In addition to routine message sorting, this can be useful in the early stages of a virus' distribution when the subject heading is known but anti-virus checking software has not been updated to protect against it.
Postfix MTA can protect against such attacks using a "header_checks" file. For example, to block all messages with the subject header ILOVEYOU from being received or propagated:
Create the file /etc/postfix/header_checks with the contents:
/^Subject: ILOVEYOU/ REJECT
Change the file ownership to the postfix account:
chown postfix /etc/postfix/header_checks
Then modify the file /etc/postfix/main.cf to include:
header_checks = regexp:/etc/postfix/header_checks
Restart Postfix using either:
Server Manager | In the System menu, click on Mail Services, then click on Reload in the postfix display. | |
command line | Enter: /etc/rc.d/init.d/postfix reload |
The Messaging Server provides SSL (Secure Socket Layer) configuration by default. That is, https can be used immediately using demonstration keys, and should be used to provide secure web connections.
However, many SSL benefits are not available without a signed certificate and key. These can be obtained:
from commercial Certificate Authority (CA) providers, using Webmin to generate a Certificate Signing Request (CSR) .
using Webmin to generate a self-signed certificate and key.
We recommend using commercial products, because they guarantee unique certificates, and they provide legal protection. Nonetheless, self-signed certificates are adequate for many installations.
Both self-signed certificates and CSRs can be managed with Webmin. In the Webmin interface, select System and Certificate and Key Management. Then select either:
Once you have acquired or generated a key, you must provide the Cyrus and Postfix services with read/write access to the key. Assuming that the new key is /etc/ssl/private/hostkey.pem, enter:
cd /etc/ssl
cp private/hostkey.pem cyrus-key.pem
chown cyrus cyrus-key.pem
chmod 600 cyrus-key.pem
cp private/hostkey.pem postfix-key.pem
chown postfix postfix-key.pem
chmod 600 postfix-key.pem
For more information about SSL configuration, see "4.8. Using Certificate and Key Management" in the Caldera OpenLinux System Administration Guide.