AV-Spam

AV-Spam

Email gateway virus and SPAM filtering with GUI interface and web based statistics and tight integration into the BlueOnyx GUI. Additionally it comes with Milter-GeoIP, which protect SMTP-Auth and SMTP against logins and/or connections from undesired countries. Furthermore Milter-GeoIP does traffic accounting for emails and can limit how many emails a virtual site (and its users) or system users are allowed to send.

Not too many years ago SPAM and Email-Virii were a nuisance that one had to deal with off and on. But nowadays each mailserver usually gets hammered with a constant barrage of SPAM and Virii.

So every modern mailserver should have relieable means in place to protect its users from both Virii and SPAM. Since 1998 we are providing providing software for Suasalito enabled devices. The initial AV-Spam was conceived in 2002 and has since then seen many releases for supported platforms. Since 2008 it is available for BlueOnyx to protect your email users against SPAM and virii.

Built in components:

Clam AV Milter:

For one we tie Clam AV directly into Sendmail through Clam AV Milter. Using the Clam AV daemon (which runs persistantly in the background for best performance) all emails are scanned for virii right as they are received. If an email contains an infected attachment, the email is rejected at the MTA level.

SpamAssassin and SpamAssassin Milter:

The AV-SPAM integrates SpamAssassin into Sendmail via a daemonized SpamAssassin and Spamass-Milter. This allows to check all emails that pass through your mail server for SPAM while the sending party is still delivering the mail. Emails with a very high SPAM score can be rejected at the MTA level during reception. Clean emails or emails with lower SPAM score are delivered to the intended recipients. At that point the individual AV-SPAM settings of the recipient kick in and SPAM emails can either be delivered marked as SPAM, or can be deleted on the server. Of course each email user on your BlueOnyx can use the AV-SPAM GUI to configure the SPAM related settings valid for his own email account. So each user can decide if SPAM is just marked and delivered, is quarantined into a separate IMAP folder, or is deleted directly on the server. Optionally a user can choose to disable the SPAM-filter entirely for his account.

SpamAssassin can scan both inbound mail (default) and outgoing mail (can be enabled optionally).

Greylist Milter:

Grey listing works by assuming that, unlike legitimate MTA, spam engines will not retry sending their junk mail on a temporary error. The filter will always reject mail temporarily on a first attempt, then accept it after some time has elapsed.

If spammers ever try to resend rejected messages, we can assume they will not stay idle between the two sends (if they do, the spam problem would just be solved). Odds are good that the spammer will send a mail to a honey pot address and get blacklisted in several real-time distributed black lists before the second attempt. The AV-SPAM allows you to specify IP addresses and IP address ranges which are allowed to bypass Greylisting.

Milter-GeoIP:

One of the key problems of operating an email server (aside from inbound SPAM or Virii) are of course the risks that the server is used to send SPAM. Even if you take all sensible precautions: A clients home or office computer could get compromised to send SPAM via your server, using the clients login details. Or someone "guessed", brute forced or stole the login details of one of your users. Or a weak PHP or Perl script hosted on one of the Vsites gets compromised and is used to send SPAM. Often you don't realize this until the point where it's already way too late.

But no more!

Milter-GeoIP offers two additional lines of defense with which you can prevent this and/or with which you will get notified once something like this happens. The first line of defense is that you can block access to SMTP-Auth and/or SMTP with GeoIP. IP addresses from undesired countries can no longer use SMTP-Auth or SMTP on your server. Should a successful SMTP-Auth login happen from a forbidden country, then you can either block the access, or you can take it one step further and automatically suspend the account in question to prevent further damage.

The second line of defense is that Milter-GeoIP does exact traffic accounting for inbound and outbound email volumes on a per site and per user basis. If a virtual site (or a user belonging to a virtual site) sends more emails per day than allowed? In that case you will receive a warning message by Active Monitor. Additionally: If a virtual site (or a user of a virtual site) has sent more emails per day than allowed, then no further emails can be sent by the affected user(s) and they receive a distinct and informative error message by their email client.

These limits can be configured for system users, virtual sites and virtual site users. The traffic accounting, reporting and blocking also takes emails into account that were sent by scripts.

Milter-GeoIP was developed by Solarspeed.net and has been specifically designed for BlueOnyx and the needs of BlueOnyx server administrators.

Automated updates:

SpamAssassin and Clam AV both use automated updates to download new SpamAssassin rules and virus definitions.

GUI integration:

Our AV-SPAM is tightly integrated into the GUI interface. The GUI allows you to configure all relevant settings, allows to monitor the installed services (via "Active Monitor" integration) and provides the extended Email Statistics on BlueOnyx with information about SPAM and Virus emails that were intercepted.

Availability:

AV-SPAM v7.4 is available for BlueOnyx 5212R
AV-SPAM v7.4 is available for BlueOnyx 5211R
AV-SPAM v7.4 is available for BlueOnyx 5210R

New Features in AV-Spam v7.4:

- SpamAssassin updated to v4.0.2 and all sensible modules enabled
- SpamAss-Milter updated to latest version with ASN and RelayCountry patches
- Clam AV updated to v1.4.3 LTS
- Milter-GeoIP updated
- All relevant Perl modules and dependencies updated to latest releases
- Better Procmail support for servers with Maildir
- Initial install of PKG directly activates SQL support for AV-SPAM

New Features in AV-Spam v7.3:

- Milter GeoIP has been extended with WHOIS checks and the ability to block country TLD's.
- SpamAssassin now uses TxRep instead of AWL.
- Milter GeoIP to prevent SMTP-Auth logins and/or SMTP connections from undesired countries.
- Milter GeoIP based email traffic accounting to report and limit how many emails Vsites and Users can send.
- Tighter GUI integration via BlueOnyx modules
- GUI available in English, Danish, German, Spanish, French, Itallian, Portuguese, Dutch and Japanese.
- Ability to edit Milter-Greylist settings