Zimbra and spam protection
One of the key tasks facing the administrator of the company's own mail server is filtering emails containing spam. The harm from spam is obvious and understandable: in addition to the threat to the information security of the enterprise, it takes up space on the server’s hard drive, and also reduces the efficiency of employees when they get into the Inbox. Separating unwanted newsletters from business correspondence is not as easy as it seems at first glance. The fact is that there is simply no solution to guaranteeing 100% results in eliminating unwanted emails, and an incorrectly configured algorithm for detecting unwanted emails can cause the company much more harm than spam itself.
In the Zimbra Collaboration Suite, anti-spam protection is implemented using the free software package Amavis, which implements SPF, DKIM and supports black, white, and gray lists. In addition to Amavis, Zimbra uses the ClamAV antivirus and SpamAssassin spam filter. Today, SpamAssassin is the best solution for spam filtering. The principle of its operation is that each incoming letter is checked for compliance with regular expressions characteristic of unwanted mailings. After each validated check, SpamAssassin assigns a certain number of points to a letter. The more points you get at the end of the check, the higher the likelihood of the email being analyzed is spam.
Such a system for evaluating incoming letters allows you to quite flexibly configure the filter. In particular, you can set the number of points at which a letter will be recognized as suspicious and be sent to the Spam folder, or you can set the number of points at which a letter will be permanently deleted. By setting up a spam filter in this way, two questions can be solved at once: first, to avoid filling up valuable disk space with useless spam mailings, and second, to minimize the number of business letters missed due to the spam filter.
')
The main problem that can arise for Russian Zimbra users is the unavailability of the built-in anti-spam system for filtering Russian-language spam from the box. The reason for this lies in the lack of built-in rules for Cyrillic text. Western colleagues solve this issue by unconditional deletion of all letters in Russian. Indeed, it is unlikely that someone who is in his right mind and sober memory will try to conduct business correspondence with European companies in Russian. However, users from Russia cannot do this. Partially solve this problem can add Russian rules for Spamassassin , but their relevance and reliability is not guaranteed.
Due to its high prevalence and open source code, you can embed other, including commercial, information security solutions into the Zimbra Collaboration Suite. However, the best option could be a cloud protection system against cyber threats. Cloud protection is usually configured both on the side of the service provider and on the local server side. The essence of the setting lies in the fact that the local address for incoming mail is replaced with the address of the cloud server, where the letters are filtered, and then all the checks that have passed all checks are sent to the address of the enterprise.
Such a system is connected using a simple substitution of the IP address of the POP3 server for incoming mail in the MX record of the server to the IP address of your cloud solution. In other words, if earlier the MX record of the local server looked like this:
After replacing the ip address with the one provided by your cloud security provider (assuming that it will be 26.35.232.80), the entry will change to the following:
Also, during the setup, you will need to specify the address of the domain from which the unfiltered email will come in, and the address of the domain where the filtered email should be sent in the personal office of the cloud platform. After these actions, your mail will be filtered on servers of a third-party organization that will be responsible for the security of incoming mail in the enterprise.
Thus, Zimbra Collaboration Suite is perfect for both small businesses that need the most inexpensive, but safe e-mail solution, as well as large enterprises that are constantly working to reduce the risks associated with cyber threats.
In the Zimbra Collaboration Suite, anti-spam protection is implemented using the free software package Amavis, which implements SPF, DKIM and supports black, white, and gray lists. In addition to Amavis, Zimbra uses the ClamAV antivirus and SpamAssassin spam filter. Today, SpamAssassin is the best solution for spam filtering. The principle of its operation is that each incoming letter is checked for compliance with regular expressions characteristic of unwanted mailings. After each validated check, SpamAssassin assigns a certain number of points to a letter. The more points you get at the end of the check, the higher the likelihood of the email being analyzed is spam.
Such a system for evaluating incoming letters allows you to quite flexibly configure the filter. In particular, you can set the number of points at which a letter will be recognized as suspicious and be sent to the Spam folder, or you can set the number of points at which a letter will be permanently deleted. By setting up a spam filter in this way, two questions can be solved at once: first, to avoid filling up valuable disk space with useless spam mailings, and second, to minimize the number of business letters missed due to the spam filter.
')
The main problem that can arise for Russian Zimbra users is the unavailability of the built-in anti-spam system for filtering Russian-language spam from the box. The reason for this lies in the lack of built-in rules for Cyrillic text. Western colleagues solve this issue by unconditional deletion of all letters in Russian. Indeed, it is unlikely that someone who is in his right mind and sober memory will try to conduct business correspondence with European companies in Russian. However, users from Russia cannot do this. Partially solve this problem can add Russian rules for Spamassassin , but their relevance and reliability is not guaranteed.
Due to its high prevalence and open source code, you can embed other, including commercial, information security solutions into the Zimbra Collaboration Suite. However, the best option could be a cloud protection system against cyber threats. Cloud protection is usually configured both on the side of the service provider and on the local server side. The essence of the setting lies in the fact that the local address for incoming mail is replaced with the address of the cloud server, where the letters are filtered, and then all the checks that have passed all checks are sent to the address of the enterprise.
Such a system is connected using a simple substitution of the IP address of the POP3 server for incoming mail in the MX record of the server to the IP address of your cloud solution. In other words, if earlier the MX record of the local server looked like this:
domain.com. IN MX 0 pop
domain.com. IN MX 10 pop
pop IN A 192.168.1.100
After replacing the ip address with the one provided by your cloud security provider (assuming that it will be 26.35.232.80), the entry will change to the following:
domain.com. IN MX 0 pop
domain.com. IN MX 10 pop
pop IN A 26.35.232.80
Also, during the setup, you will need to specify the address of the domain from which the unfiltered email will come in, and the address of the domain where the filtered email should be sent in the personal office of the cloud platform. After these actions, your mail will be filtered on servers of a third-party organization that will be responsible for the security of incoming mail in the enterprise.
Thus, Zimbra Collaboration Suite is perfect for both small businesses that need the most inexpensive, but safe e-mail solution, as well as large enterprises that are constantly working to reduce the risks associated with cyber threats.
Source: https://habr.com/ru/post/424001/
All Articles