11TACTEAM -- Dallas

Whacking Spam with Whacking Spam with ISA Server 2000ISA Server 2000

Thomas W Shinder MDThomas W Shinder MD

TACTEAM -- DallasTACTEAM -- Dallas 22

TECHNICAL FAQsTECHNICAL FAQsHere are answers to the most common technical problems users encounter Here are answers to the most common technical problems users encounter

during a Webcast:during a Webcast:  Q: Why can’t I hear the audio part of the webcast?Q: Why can’t I hear the audio part of the webcast?

A: Try increasing the volume on your computer.A: Try increasing the volume on your computer.

Q: I just entered the webcast and do not see the slide that the speaker is Q: I just entered the webcast and do not see the slide that the speaker is referring to. What should I do?referring to. What should I do?A: The slides are constantly being pushed to your screen. You should refresh A: The slides are constantly being pushed to your screen. You should refresh (hit F5) to view the latest slide.(hit F5) to view the latest slide.

  If your technical question is still not answered, please email If your technical question is still not answered, please email webcastSupport@techtarget.com webcastSupport@techtarget.com and describe your problem. A technical and describe your problem. A technical support person will respond within 24 hours. support person will respond within 24 hours.

You can also visit the Broadcast Help page for more information or to test You can also visit the Broadcast Help page for more information or to test your browser compatibility. Click here: http://help.yahoo.com/help/bcst/ your browser compatibility. Click here: http://help.yahoo.com/help/bcst/

  

TACTEAM -- DallasTACTEAM -- Dallas 33

Dr. Tom ShinderDr. Tom Shinder

ISA Server guru in residence at ISA Server guru in residence at www.isaserver.orgwww.isaserver.org

Editor of the Brainbuzz Network Admin Editor of the Brainbuzz Network Admin Weekly NewsletterWeekly Newsletter

Editor of Sunbelt-Software WinXPNewsEditor of Sunbelt-Software WinXPNews Author of best selling “Configuring ISA Author of best selling “Configuring ISA

Server 2000: Creating Firewalls with Server 2000: Creating Firewalls with Windows 2000 Windows 2000

Author or contributors to over 20 Windows Author or contributors to over 20 Windows 2000 and networking books2000 and networking books

TACTEAM -- DallasTACTEAM -- Dallas 44

IntroductionIntroduction

Spam Blocking MethodsSpam Blocking Methods ISA Server Message ScreenerISA Server Message Screener GFI Software’s MailSecurityGFI Software’s MailSecurity Summary and Analysis of Spam Summary and Analysis of Spam

whackingwhacking

TACTEAM -- DallasTACTEAM -- Dallas 55

Spam Blocking MethodsSpam Blocking Methods

Client side solutionsClient side solutions– Outlook Junk Mail FiltersOutlook Junk Mail Filters– Outlook Express Message RulesOutlook Express Message Rules– iHateSpam, Mail Washer, etc.iHateSpam, Mail Washer, etc.

Server side solutionsServer side solutions– ISA Server Message ScreenerISA Server Message Screener– GFI MailSecurityGFI MailSecurity

TACTEAM -- DallasTACTEAM -- Dallas 66

ISA Server Message ScreenerISA Server Message Screener Message Screener works with the SMTP FilterMessage Screener works with the SMTP Filter

– SMTP Filter must be enabledSMTP Filter must be enabled Message Screener is not the same as the SMTP Message Screener is not the same as the SMTP

FilterFilter Message Screener can be installed on the ISA Message Screener can be installed on the ISA

Server, an SMTP Relay or an Exchange ServerServer, an SMTP Relay or an Exchange Server– Preferred solution is on a dedicated SMTP relayPreferred solution is on a dedicated SMTP relay

IIS 5.0 required – cannot install on IIS 4.0 SMTP IIS 5.0 required – cannot install on IIS 4.0 SMTP serviceservice

Message Screener does not control relay!Message Screener does not control relay! Can screen both incoming and outgoing trafficCan screen both incoming and outgoing traffic

– Message Screener does not recognize incoming and Message Screener does not recognize incoming and outgoing trafficoutgoing traffic

– Same rules apply to incoming and outgoing SMTP trafficSame rules apply to incoming and outgoing SMTP traffic

TACTEAM -- DallasTACTEAM -- Dallas 77

Installing and Configuring the Installing and Configuring the SMTP Message ScreenerSMTP Message Screener

Install the Message Screener Install the Message Screener Software on the IIS 5.0 machineSoftware on the IIS 5.0 machine

Enable the SMTP Application FilterEnable the SMTP Application Filter Configure the IIS 5.0 SMTP ServerConfigure the IIS 5.0 SMTP Server

– Configure Remote DomainsConfigure Remote Domains– Configure RelayConfigure Relay

Configure permissions with the Configure permissions with the SMTPCred toolSMTPCred tool

Configure DCOM PermissionsConfigure DCOM Permissions

TACTEAM -- DallasTACTEAM -- Dallas 88

Installing the Message ScreenerInstalling the Message Screener Run from the ISA Server CD if installing on an SMTP Relay Run from the ISA Server CD if installing on an SMTP Relay

or the Exchange Serveror the Exchange Server Use the Use the Add/RemoveAdd/Remove button to add the Message Screener button to add the Message Screener

to the ISA Server if you did not install it when the ISA Server to the ISA Server if you did not install it when the ISA Server was installedwas installed

If you install on a dedicated SMTP relay or the ISA Server, If you install on a dedicated SMTP relay or the ISA Server, you need to enable the IIS 5.0 SMTP serviceyou need to enable the IIS 5.0 SMTP service

If you install on the ISA Server, you must disable SMTP If you install on the ISA Server, you must disable SMTP service socket poolingservice socket pooling

TACTEAM -- DallasTACTEAM -- Dallas 99

Enable the SMTP FilterEnable the SMTP Filter

TACTEAM -- DallasTACTEAM -- Dallas 1010

Enable the SMTP FilterEnable the SMTP Filter

SMTP Application Filter is disabled by SMTP Application Filter is disabled by defaultdefault

SMTP filter examines SMTP traffic SMTP filter examines SMTP traffic even without Message Screenereven without Message Screener

Only examines for SMTP buffer Only examines for SMTP buffer overflows as stand-aloneoverflows as stand-alone

Current implementation of the SMTP Current implementation of the SMTP Filter does not support AUTHFilter does not support AUTH

TACTEAM -- DallasTACTEAM -- Dallas 1111

Configure IIS 5.0 SMTP ServiceConfigure IIS 5.0 SMTP Service

TACTEAM -- DallasTACTEAM -- Dallas 1212

Configure IIS 5.0 SMTP ServiceConfigure IIS 5.0 SMTP Service

Configure a Remote DomainConfigure a Remote Domain Remote domains for all your email Remote domains for all your email

domainsdomains You will allow relay only for these You will allow relay only for these

domainsdomains All mail not directed to a Remote All mail not directed to a Remote

domain is rejecteddomain is rejected

TACTEAM -- DallasTACTEAM -- Dallas 1313

Configure IIS 5.0 SMTP ServceConfigure IIS 5.0 SMTP Servce

TACTEAM -- DallasTACTEAM -- Dallas 1414

Configure IIS 5.0 SMTP ServiceConfigure IIS 5.0 SMTP Service

Relay configuration for default SMTP Relay configuration for default SMTP virtual servervirtual server

NO relay if used only for incoming NO relay if used only for incoming messagesmessages

Limited relay if used for outgoing Limited relay if used for outgoing messagesmessages

Allow only internal mail servers to Allow only internal mail servers to access outbound relayaccess outbound relay

TACTEAM -- DallasTACTEAM -- Dallas 1515

Configure CredentialsConfigure Credentials Message Screener on Message Screener on

independent relay or independent relay or internal Exchange internal Exchange ServerServer

Do not need to configure Do not need to configure credentials if on ISA credentials if on ISA ServerServer

Use credentials of user Use credentials of user that installed the ISA that installed the ISA Server or local AdminServer or local Admin

TACTEAM -- DallasTACTEAM -- Dallas 1616

DCOM PermissionsDCOM Permissions

TACTEAM -- DallasTACTEAM -- Dallas 1717

Message Screener Variations Message Screener Variations Do not need to configure SMTPcred tool Do not need to configure SMTPcred tool

credentials when installed on ISA Servercredentials when installed on ISA Server Do not need to configure DCOM Do not need to configure DCOM

permissions when installed on the ISA permissions when installed on the ISA ServerServer

If the Message Screener is installed on an If the Message Screener is installed on an Exchange Server, it will not reliably screen Exchange Server, it will not reliably screen outbound messages from Outlook MAPI outbound messages from Outlook MAPI clientsclients

If Message Screener is installed on the If Message Screener is installed on the Exchange Server, it will screen all Exchange Server, it will screen all messages inbound and outbound using messages inbound and outbound using SMTPSMTP

TACTEAM -- DallasTACTEAM -- Dallas 1818

Configuring the Message ScreenerConfiguring the Message Screener

Filtering Email AttachmentsFiltering Email Attachments Filtering by account or domain Filtering by account or domain Filtering by keywordsFiltering by keywords

TACTEAM -- DallasTACTEAM -- Dallas 1919

Message Screener ConfigurationMessage Screener Configuration

TACTEAM -- DallasTACTEAM -- Dallas 2020

Message Screener ConfigurationMessage Screener Configuration

TACTEAM -- DallasTACTEAM -- Dallas 2121

Message Screener ConfigurationMessage Screener Configuration

TACTEAM -- DallasTACTEAM -- Dallas 2222

Message Screener RecommendationsMessage Screener Recommendations

Use a dedicated SMTP relayUse a dedicated SMTP relay Keep the Message Screener off the Keep the Message Screener off the

ISA Server and Exchange ServerISA Server and Exchange Server If the Message Screener is off the ISA If the Message Screener is off the ISA

Server, make sure to configure SMTP Server, make sure to configure SMTP credentials and DCOM permissionscredentials and DCOM permissions

Image your server regularly, since Image your server regularly, since you can’t back up your configuration!you can’t back up your configuration!

TACTEAM -- DallasTACTEAM -- Dallas 2323

For More InformationFor More Information

TACTEAM -- DallasTACTEAM -- Dallas 2424

Thank youThank youIf you have any additional questions or comments for Tom, send them to editor@searchwin2000.com. Be sure to note that the question relates to the ISA Server Message Screener webcast.

For an immediate response to a question, go to the new SearchWin2000.com Webcast Question and Answer forum. Navigate from the home page. Tom will patrol the forum through the end of November.

For more information on our library of on-demand webcasts, or to pre-register for an upcoming live event, go to http://searchwin2000.techtarget.com/webcasts/

To submit your comments or suggestions for future webcasts, send an e-mail to the SearchWin2000.com Site Editor at editor@searchwin2000.com.