The antispam software works in conjunction with your mail server. The software identifies spam using a wide range of algorithms on e-mail headers and body text. ClarkConnect also includes greylisting and additional blacklists – both are effective tools that can be used to detect spam.

If you did not select this module to be included during the installation process, you must first install the module.

If you want to discard spam before it reaches mailboxes, you can configure the mail discard policy. For example, you can discard spam marked with high probability (or higher) by using this tool.

• Use Subject Tag - enable/disable e-mail subject tag when e-mail is marked as spam
• Subject Tag Threshold - spam score required to trigger a change in the e-mail subject
• Subject Tag - the subject tag to use when e-mail is marked as spam

A subject tag can be added to messages marked as spam. For instance a spam message with the subject “Premier Invest0r Rep0rt” will be transformed into ”[SPAM] Premier Invest0r Rep0rt”. This feature makes it easy for end users to identify and filter spam.

Enabling Image Processing will improve the spam identification rate for spam messages containing images. Using OCR (Optical Character Recognition), antispam engine will convert images to text and perform analysis on the word content of the image.

• White List - a list of e-mail addresses that should never be marked as spam
• Black List - a list of e-mail addresses that should always be marked as spam

The antispam engine includes both white and black lists. The white list is used to mark e-mail addresses that send non-spam, while the black list is used to mark e-mail addresses that are known spam.

Among others, newsletters and legitimate e-commerce e-mail can sometimes be marked as spam. The e-mail addresses for these messages can be added to the white list to prevent the message from becoming marked as spam.

E-mail addresses in the white and black lists can use the * wildcard character to match any characters. For instance, *@example.com and *.gov will mark all e-mail from the example.com and .gov domains.

You can improve the effectiveness of the antispam engine by following training the antispam engine.

ClarkConnect also includes Mail Filters (Greylisting) and additional blacklists – both are effective tools that can be used to detect spam.

• SpamAssassin website

The Dspam antispam system tracks e-mail by mailbox. In other words, the antispam system bases its decisions on individual spam databases for each user on the system.

If you did not select this module to be included during the installation process, you must first install the module.

Since the Dspam antispam solution requires specific details about mailboxes and aliases, the software is not available on systems configured as a mail gateway. For example, a message destined to sales@example.com forwarded to an Exchange server may end up in Mary and David's mailbox. It is not possible for the Dspam system to determine this information in mail gateway mode.

The antispam system tracks important elements and statistics on every e-mail message that you receive. This information is then stored as a “signature” – basically a unique identification number. To train the antispam system (see next section), this signature must be included in an e-mail. You can track these signatures either in the body of the message, or in the message header. Headers

• advantage: does not clutter the body of e-mail messages
• disadvantage: message must be forwarded as an attachment to train the antispam system

Body

• advantage: message can be forwarded (no attachment) to train the antispam system
• disadvantage: spam signature clutters the body of e-mail messages

Select the subject tag used to mark any messaged deemed to be spam.

You can improve the effectiveness of the antispam engine by training the spam engine.

• Dspam

You can improve the effectiveness of the antispam systems on your ClarkConnect system by identifying:

• Messages that were spam, but not identified as such
• Messages that were innocent, but identified as spam (false positive)

With a week or two of diligent training with these messages, you can expect to see a more effective antispam engine.

At least one of the antispam engines must be installed on your system.

• SpamAssassin
• Dspam

There are two ways to train the antispam systems on your ClarkConnect system: webmail and mail-forwarding.

Training the antispam system via webmail is simple and more effective. Simply select the messages that you wish to process and press either the Report as Spam or Report as Innocent buttons (see screenshot). You will then be shown a confirmation message before the actual processing takes place.

Training via e-mail forwarding is available in version 4.1 or later. Training via e-mail forwarding is not as effective since information is lost when you forward a message. If you decide to use this method, there are two e-mail addresses used for training:

• train.notspam@example.org – e-mail address for messages incorrectly identified as spam
• train.spam@example.org – e-mail address for spam that was not identified as such

In order to use this style of spam training, messages must be forwarded as an attachment (see screenshot).

• Dspam

The antivirus system scans mail messages as they pass through your mail server.

If you did not select this module to be included during the installation process, you must first install the module.

When configuring the antivirus system, you must make some mail policy decisions. There are three types of policies available:

• Bounce - bounce the e-mail
• Discard - silently discard the e-mail
• Pass Through - send e-mail with warning (original sent as an attachment)

When a virus is detected, you can choose to either discard the message, or pass the message through. We recommend discard mode for most installations.

The antivirus software not only performs virus scanning, but also manages file attachment policies. Certain types of file attachments are prone to viruses. The ability to block attachments by file extension is another layer of security for your mail system.

Select the file extensions that you wish to ban from going through your mail system. Both internal and external mail are checked.

• ClamAV web site

Mail aliases allow you to route extra e-mail addresses (for instance sales@, info@, etc) to one or more e-mail addresses. This tool can also be used to create mail distribution lists - for example, staff@example.com can be used to send e-mail to all users on the system.

If you did not select this module to be included during the installation process, you must first install the module.

When you first click on the “Mail Aliases” navigation link, current aliases set up by domain will be displayed (along with Edit and Delete options) and a form below this list provides the fields required to add a new alias. In other words, you are in “add mode”.

As an example, if you wanted to create an email alias mapping veruca.salt to a user that you had created on the system named 'veruca', enter “veruca.salt” in the “Alias” field and select “veruca” from the “Available” mail accounts list, then click “Add”.

There is no limit to how many mailbox accounts an aliased name can be sent to. For example, if you wanted all three people to receive all email sent to the address “sales@yourdomain.com”, you could add the alias “sales” and select the three users on the “Available” list. Multiple users can be selected by holding down the “Control” key on your keyboard while clicking on the user in the list.

To enter “edit mode”, you must have at least one alias present. Click on the “Edit” link next the alias you wish to edit. The form below will now display which of the available recipient's are set-up as aliased (highlighted) and which are not (listed as available but not highlighted). Select/deselect amongst the available recipient names using the “Control” key and your mouse and click “Update” to save your settings.

Mail forwarding to another address/server can be done by addint the e-mail address to the External E-mail field and clicking on the “Add” link, as shown in the screenshot below.

If you are working with multiple domains on your system (i.e. virtual domains are being used), make sure to select the correct domain from the drop down list prior to starting your edits.

• Adding users to the server

The Mail Archival System logs all incoming and outgoing e-mail passing through the gateway to a central database. This module can be used to meet regulatory compliance or assist an organization to enforce internal policies for e-mail use in the workplace.

If you did not select this module to be included during the installation process, you must first install the module.

On first configuring the mail archiver after installation, a warning will be displayed prompting the user to initialize the database. This is perfectly normal and should be done before continuing.

A table containing three form tabs is displayed as indicated in the screenshot above.

• Mail Archive Settings - General configuration settings
• Current Statistics - Data and actions relating to the current database
• Search Statistics - Data and actions relating to the search database

An explanation of the difference between the Current and Search databases will be explained below.

Activation and configuration of the email archive system can be done via the “Mail Archive Settings” tab. The section below explains each setting in details.

Enables or disables the archiving of email passing through the SMTP server.

Allows an administrator to archive all email passing through the server or restrict (exempt) certain users, as required. Set this to “All messages” to archive email for every user. Select “Filter messages” to configure a filter to archive only some users email.

A configure link will be displayed when “Filter messages” is selected as the policy. Click on this link to 'fine tune' which users' email should be archived.

The “Discard Attachments” drop down option is only available when the “Policy” is set to “All messages” - otherwise, discarding of attachments is done in the 'Configure' page.

To save on storage space (and assuming attachments are not required to be archived either by corporate policy or law), select “Always”. Otherwise, select a level in which attachments should be discarded (i.e. “Never”, > 1MB etc.).

Files which are identical but attached to different e-mails as attachments only consume the size of the file, not N x the size of the file, where N is the number of emails going through the archive system with the same attachment.

Auto archive controls the movement of archive data from the “Current” database to an archived file. This allows the email archive to be easily moved from the server to a storage medium (for example, another server, a USB Mass Storage Device, a tape drive etc.) for safe storage. All emails that have been archived to this file can be retrieved and searched at a later date, if required. Use this field to provide consistent archive files for a give period (i.e. weekly or monthly) or of a certain size (i.e. a DVD etc.).

The transition of data from the database to a dump file can be encrypted to prevent unauthorized access. This can be extremely important (and may be required by law) if e-mails contain confidential information.

The password used to encrypt the archive file if “Encrypt Archives” is set to “Yes”. By default, this password must be at least 12 characters and contain both upper and lower case letters and at least 1 number.

The mail archive operates using two databases. The 'Current' database is used to retrieve and store new messages arriving from the SMTP (mail) server. The 'Search' database is a transient database - its contents can be deleted and replaced with data corresponding to the search requirements and space of the drive.

The dual-database system is designed for maximum scalability. A single database could quickly become of such enormous size that an administrator would be continually adding drive storage space to accommodate the email archives. By giving the user the ability to take certain sized (or certain periods of time) snapshots from the current database and allowing one or more to be loaded to the 'Search' database, searching for past emails can be done quickly and efficiently without the overhead of hundreds of GB of disk space.

The current database contains all archived emails since the last file archive was performed. A file archive can either be performed manually or can occur automatically if the Auto Archive setting is enabled and triggered.

To view how many emails and the approximate size of the archive in the 'Current' database, click on the Current Statistics tab.

Click on the Search button. A new form will be displayed allowing you to enter your search criteria.

Using the add links you can customize your search using a maximum of five (5) criteria using either AND or OR logic (Match all vs. Match any). The results from your search will be displayed in the results table below.

The Search Database will normally be empty until at least one file-based mail archive restore is performed (or if data from a prior search still in the database). Remember, the Search Database is designed to be reset often so that you can work with datasets that will scale with the ever-increasing demands of archived e-mails.

To restore a file-based archive, click on the Restore Archive button.

All prior restores will be listed in the Archives table. Rows with a green status mean the link is intact (archive exists on the server). Rows with a red status icon indicate the link is broken. If you need to restore from a file whose status is red (broken link), you will need to use Flexshare and the storage device where the archive was moved to in order to re-establish the link.

Simply click on the Restore button to start a restore to the Search database. Once complete, you can Search the database as normal.

To navigate to the Search Database, go to the Mail Archive page and click on the Search Statistics tab. If there is data that you wish to search in the database (given the statistics you may find that there is data, but you do not remember which file archive it originates from - in this case, it is advised to reset the database and start again), click the Search button. A search form will be displayed - the same as occurs when you are searching the Current Database.

You can toggle between searching the Current and Search databases by selecting the appropriate radio button in the search form.

Since the Search Database is simply a MySQL database created by the import of one more archive files, it is perfectly safe to Reset the search database to reinitialize the database. You may want to reset the search database to make make searching the database faster or because searching an entire index (i.e. mail archive over several years) becomes too large a dataset for your existing hard disk.

Once an e-mail has been found using a search procedure, click on the View link next to the e-mail of interest. A new page will be displayed containing the email body contents.

It is sometime of interest to view the original e-mail header. This information is stored in the archive database and can be viewed by clicking on the Original Header link (a '+' icon).

The screen capture below displays an e-mail view with the headers expanded.

To resend the email (either to the original recipient or a separate user), click on the Resend E-mail link. A new form will appear allowing you to resend the email.

The mail archives (both current and search databases) can be searched by the system administrator (logged in under the 'root' account) or by users. To give users access to the archive, use the System Administration ACL to grant access to specific users to the Mail Archive module. When logged in as 'root', all emails will be returned from a search query. However, when logged in as a 'user' system administrator, only email that has been sent to or by the user will be returned from a search query. In other words, users can view/restore mail that was sent or received by them, but no one else.

This module makes use of the system MySQL service for the database back-end. The system MySQL server is a 'sandboxed' service running on a non-standard port. To access the database from the command line, you will need to fetch the database password:

# cat /etc/system/database 

• password = AAAAAAAAAAAAAAA
• reports.password = BBBBBBBBBBBBBB
• zoneminder.password = CCCCCCCCCCCCCCC
• archive.password = PASSWORD
• dspam.password = DDDDDDDDDDDDD

The email archive database password is keyed on 'archive.password'.

Next, you'll need to access the MySQL console in a slightly different manner than the default MySQL server.

/usr/share/system-mysql/usr/bin/mysql DBNAME -uUSER -pPASSWORD 

Where:

DBNAME = archive_current or archive_search USER = archive PASSWORD = the password retrieved from the /etc/system/database file

What if I forget my password? In a word: don't. If you forget your archive password, there is absolutely no way to recover any e-mail from the encrypted mail archive file.

Using Flexshares

Greylisting and mail filters are extra tools to prevent spam from reaching your users' mailboxes.

If you did not select this module to be included during the installation process, you must first install the module.

Greylisting can dramatically reduce the amount of spam reaching your mailboxes. When the service is enabled, a mail message that is not recognized will be gently rejected. If the mail message is legitimate, the sending mail server will re-attempt subsequent deliveries and the ClarkConnect server will then accept it. For the most part, spammers do not bother with the second delivery attempt and this results in less spam. The parameters that you can use to fine tune the greylisting engine are described below.

State of the greylisting engine.

The amount of time that must pass before a subsequent delivery attempt is allowed.

The greylisting engine keeps track of both mail servers and sender e-mail addresses for a specified amount of time (default is 35 days). If messages from validated sender or server arrives, the greylisting engine will accept delivery on the first attempt. For example, if dave@example.com sends an e-mail to one of your users on a weekly basis, only the very first mail message is delayed. All subsequent messages are delivered automatically since dave@example.com has been validated.

ClarkConnect provides extra mail blacklists to protect against spam. You can enable or disable this blacklist at any time.

• Postgrey
• SA-Blacklist

The fetchmail package can conveniently retrieve mail from other servers allowing the 'centralization' of e-mail on a single server.

If you did not select this module to be included during the installation process, you must first install the module.

Any number of servers can be added to the maildrop list using the “Add Maildrop Entry” form. The interval polling time can be configured from 1 minute up to 3 hours.

Have a look at the system log if you are having problems. The fetchmail daemon logs to /var/log/maillog. Ignore any entries you see similar to:

Server CommonName mismatch: localhost.localdomain != mail.pointclark.net

This entry is a result of fetchmail attempting to use SSL for authentication.

• Fetchmail Home Page

ClarkConnect provides both POP and IMAP servers for providing mail delivery to desktop clients.

If you did not select this module to be included during the installation process, you must first install the module.

The mail server supports four different protocols (see screenshot):

• IMAP
• Secure IMAP
• POP
• Secure POP

We strongly suggest using the secure protocols if possible. Keep in mind, you will need to generate an SSL Certificate to enable the secure protocol.

Some mail clients support the push e-mail feature (also known as the IMAP Idle feature). With this feature enabled on both the server and client, e-mail will appear in your mailbox as soon as it arrives. This feature is most useful on wireless and hand held devices. The following mail clients are known to support push e-mail (IMAP Idle):

• Thunderbird - Many platforms
• Chattermail - Palm Treo
• FlexMail - Windows Mobile

If you are using Mozilla's Thunderbird, click on “Tools Account Settings”, then select “Server Settings” from the navigation bar. Ensure the “Use secure connection (SSL)” checkbox is enabled.

For Outlook and Outlook Express, click on “Tools » Accounts”, select the account you wish to configure and click on the Properties button.

Next, click on the “Advanced” tab, and ensure the “This server requires a secure connection (SSL)” checkbox is enabled.

For other mail clients, similar set-up/configuration will exist. Please refer to documentation for your mail client for specific instructions.

Do not forget to open up firewall ports for e-mail. You only need to open the POP or IMAP ports if you plan on picking up your mail from outside your local network. The default ports are listed below:

• POP - 110
• Secure POP - 995
• IMAP - 143
• Secure IMAP - 993

• Dovecot Secure IMAP Server
• Setting up a Mail Server - SMTP
• Adding Users
• Adding incoming firewall rules

You can manage your own mail server. There are a number of reasons this might be advantageous:

• Ability to have a customized user and domain name - ie. anyone@anydomain.com
• Mailboxes limited only by hard disk storage capacity and your own administration settings
• Alias support - i.e. sales@yourcompany.com can be sent to bob@yourcompany.com and joe@yourcompany.com
• No waiting around for new users to be added
• Custom antispam control
• Antivirus support
• Privacy
• Full control

Point Clark Networks provides an MX backup service for mail servers. Please visit the Gateway Services page for details.

If you did not select this module to be included during the installation process, you must first install the module.

The Hostname does not have to be related to the e-mail domains that you host. It can be ANY valid Internet name for your machine. For example, you may wish to have a dedicated mail server on your network. In this case, you might want to name this machine mail.yourdomain.com. This would be the Hostname you would enter.

The Primary Domain field indicates the domain name this server will act as an SMTP/Mail server for. If you have a single domain name that you receive mail for, enter the domain here.

If SMTP Authentication field is set to on, any client attempting to send mail through the server will require a username/password before accepting mail for delivery.

The Maximum Message Size sets the maximum size of an individual mail message. Most Internet service providers (ISPs) block mail larger than 10 or 20 MB, so do not expect to have larger messages delivered to outside users. Due to the way e-mail systems work, an attached file may be 50% larger once attached.

The Catch-All setting can be used to catch mis-addressed e-mail and deliver it to a specific user account. We highly recommend avoiding this feature for the following reasons:

• Your system will scan all messages for viruses and spam instead of bouncing the message right away. This means more system resources (CPU, RAM) are required.
• Your system will attract more spam. Spammers will avoid invalid e-mail addresses, but setting a catch-all user means all e-mail addresses to your domain are valid.

For Mozilla's Thunderbird, click on “Tools » Account Settings” and then click on the “Outgoing Server (SMTP)” field. You should see a window similar to the screenshot below.

Ensure the “Use name and password” setting is checked and enter the username of the mail account in the username field. The password will be requested by the mail client application on the first attempt to send mail. There will be an option to save it to the “Password Manager” so that you do not have to enter each time you send mail through the server.

If you are using MS Outlook/Outlook Express, click on “Tools Accounts”. Select the account which will use this mail server to send mail and click on the “Properties”.

Make sure the “My server requires authentication” is checked. Click on the “Settings” button to enter the details of your username/password.

Setting the Catch All User to an valid user on the server will pass all mail sent to an “Unknown user” to this account. To bounce mail addressed to an invalid recipient, set to Return to sender.

A trusted network is a list of networks that are allowed to send mail through the SMTP server. Dynamic IP's should not be added to this list. It is important that you do not make an error with this parameter. The default setting allows any user with a 192.168.x.x address send e-mail through the server. If you use a 10.x.x.x address, you should add 10.0.0.0/8 to the list of trusted networks.

Some ISPs will block all traffic on port 25 unless it it destined for their mail servers. In this case, you would want to specify your ISPs mailserver as the Outbound Relay Hosts.

In addition, if you are subscribed to the ASP Antivirus service and want to scan your user's outgoing mail, you should enter the following: antivirus.pointclark.com

This address points to a cluster of three (or more) mail servers. The change is required since the newer version of Postfix included with ClarkConnect supports only one outbound relay host.

If your company/organization has multiple domains and you wish to receive email sent to any user for any of the domains, enter additional domains to the Destination Domains list. For example, if our primary domain was setup to be “pointclark.net” and we wanted all emails sent to the following registered domains to be valid:

• pointclark.com
• pointclark.org
• clarkconnect.com
• clarkconnect.org

we would add the bulleted domain list above to the “Destination” domains list.

Use the “Virtual Domains” list if you are using ClarkConnect as an SMTP server for multiple clients. By adding to the Virtual Domains list rather than the Destination Domains list, you will have complete control over which user receives mail for a particuliar domain.

If you are configuring your server as a mail gateway, add the domain name to the “Mail Forward Domain list”. If the antispam engine is installed and running on the server, mail will be subject to the spam identification rules you have configured. Similarly, if the antivirus module is installed and running, all mail for the domains will be scanned before passing the mail on to the destination server.

• Follow the link for more information on Configuring an Antivirus and Antispam Gateway.

Do not forget to open up firewall ports for your e-mail server: port 25 on the firewall configuration page.

Some ISPs are known to block SMTP (port 25) traffic to residential broadband connections in an attempt to cut down on SPAM originating from their network. If you think your configuration is set-up correctly and you suspect your ISP is blocking SMTP traffic, try a port scan.

If you are using the server to provide mail service to multiple domains (virtual domains), it is advisable to set up all domains on the system as virtual and enter a false domain (ie. placeholder.com) in the “Primary Domain” field. Otherwise, all users would have access to the domain listed in the primary domain field.

• Setting up a POP/IMAP server
• Postfix Documentation
• Adding incoming firewall rules

A web-based e-mail solution ideal for allowing users 'on the road' and without a mail client to access mail on the server using any computer connected to the Internet.

If you did not select this module to be included during the installation process, you must first install the module.

• The webmail system runs on port 83 on the HTTPS protocol. To access the system type https://192.168.1.1:83/ or https://yourdomain.com:83/
• If webmail access is required from the Internet, please allow connections to port 83 (webmail) on the firewall.
• Web-based mail requires the IMAP server to be running.
• Users will receive a pop-up warning in their web browser similar to that shown below. This is normal and does not diminish the fact that the connection is encrypted and secure. If desired, you can customize and manage the secure certificate using the SSL Certificate Manager.

The webmail system includes a vacation / auto-reply system. To access this feature:

• Login to your webmail account
• Click on Mail » Filters in the menu
• Select the Vacation filter

• Horde Web Site
• Adding incoming firewall rules

Previous: Database | Next: File Services || Return: Index