Summary of the content on the page No. 1
Cloudmark
Cartridge
Installation and
Administration Guide
Summary of the content on the page No. 2
© 2001-2007 Cloudmark, Inc. All rights reserved. Cloudmark, the Cloudmark logo, and other trademarks, service marks, and designs are registered or unregistered trademarks of Cloudmark Inc. and its subsidiaries in the United States and in foreign countries. Other brands and products are trademarks of their respective holders. All product information is subject to change without notice. This document may not, in whole or in part, be copied, photocopied, reproduced, translated or reduced to an
Summary of the content on the page No. 3
Contents CHAPTER 1 Introduction . . . . . . . . . . . . . . . .1 What’s new in Cartridge 3048 . . . . . . . . . . . . . . . . . .1 Cloudmark fingerprinting algorithms . . . . . . . . . . . . . . . .2 Cloudmark Global Threat Network. . . . . . . . . . . . . . . . .2 Micro-updates . . . . . . . . . . . . . . . . . . . . . .
Summary of the content on the page No. 4
Contents Network interaction. . . . . . . . . . . . . . . . . . . . . .19 Using HTTP proxies . . . . . . . . . . . . . . . . . . . . . 19 Connection timeout logic . . . . . . . . . . . . . . . . . . . 19 Data files. . . . . . . . . . . . . . . . . . . . . . . . . .20 Offline files . . . . . . . . . . .
Summary of the content on the page No. 5
Contents Index . . . . . . . . . . . . . . . . . . 49 v
Summary of the content on the page No. 6
Contents vi
Summary of the content on the page No. 7
CHAPTER 1 Introduction Cloudmark’s gateway solutions use the Cloudmark Cartridge to deliver the latest Cloudmark anti-abuse technology for your email platform. This guide explains how to install, configure, and administer the cartridge. You can find out what’s new in this version of the cartridge in “What’s new in Cartridge 3048” below. The rest of this chapter introduces the technology behind the Cloudmark Cartridge: • “Cloudmark fingerprinting algorithms” on page 2 � “Cloudmark Global Th
Summary of the content on the page No. 8
Cloudmark Cartridge Installation and Administration Guide Chapter 1 � A new fingerprinting scheme provides faster processing. � A new statistics field reports your unique installation ID. See “What statistics are collected” on page 31. Cloudmark fingerprinting algorithms The Cloudmark Cartridge includes Cloudmark’s fingerprinting algorithms, designed to target the most current spamming techniques. Using these algorithms, the Cloudmark Cartridge generates a set of fingerprints for each incomi
Summary of the content on the page No. 9
Chapter 1 Introduction Micro-updates Cloudmark stores message fingerprints generated though the Global Threat Network in near-real-time. Micro-updates are the mechanism that allows Cloudmark customers to download the latest fingerprint data at regular intervals. Micro-updates enable Cloudmark to � maintain the highest level of accuracy on spam, virus, and phishing messages as well as legitimate messages � handle new varieties of email threats proactively and automatically � reduce false posit
Summary of the content on the page No. 10
Cloudmark Cartridge Installation and Administration Guide Chapter 1 Message categorization When scoring a message with the Cloudmark Authority Engine SDK’s CMAE_Score() function, an application can request that the cartridge return a category and a subcategory for the message. Categories and subcategories are expressed as integers, which are mapped to categories in the .cats file. See the .cats file for the list of categories. For example, using the Authority Engine SDK, the following call p
Summary of the content on the page No. 11
Chapter 1 Introduction Whitelisting A whitelist is a list of trusted senders from whom you always accept email, or email characteristics which indicate a trusted message. This feature of the Cloudmark Cartridge minimizes the filtering of legitimate messages and allows system administrators to conveniently manage the receipt of messages from known safe senders. For complete information, see Chapter 5, “Whitelisting”. Whitelisting 5
Summary of the content on the page No. 12
Cloudmark Cartridge Installation and Administration Guide Chapter 1 6 Whitelisting
Summary of the content on the page No. 13
CHAPTER 2 Cloudmark Cartridge Installation This chapter provides the Cartridge installation instructions: � “The Cartridge installation package” below. � “Installing or updating the Cartridge” on page 8 ! Be sure to refer to the release notes of each Cartridge version for special installation instructions. The Cartridge installation package The Cartridge installation package is provided in either a TAR or a ZIP file, depending on your platform. Before installation, verify that the installatio
Summary of the content on the page No. 14
Cloudmark Cartridge Installation and Administration Guide Chapter 2 � etc/micro_updates/.implv1 � etc/micro_updates/states/srl_set.package � etc/whitelist.cfg.sample � etc/cartridge.cfg.sample � lib/cartridge.so Additional files are downloaded as micro-updates. For more information about these files, see “Data files” on page 20. Installing or updating the Cartridge Follow the installation instructions for the product with which you are using the Cartridge: � “Installation
Summary of the content on the page No. 15
Chapter 2 Cloudmark Cartridge Installation gzip –d –c < SpamDNA-3048.x.x.x-.tar.gz | tar xvf – � For Windows installation, double-click the .zip file, then click Extract. 5 Create the etc/license.cfg file. This file must contain the two-line license text that you received from Cloudmark. 6 If you are updating an existing Cartridge installation, update your cartridge.cfg to the latest defaults listed in the file etc/cartridge.cfg.sample. 7 Restart the server/service using the Cloudma
Summary of the content on the page No. 16
Cloudmark Cartridge Installation and Administration Guide Chapter 2 5 If you are upgrading from Cartridge 3046 or earlier, create the etc/license.cfg file. This file must contain the two-line license text that you received from Cloudmark. 6 Update your cartridge.cfg with the latest defaults listed in the file etc/cartridge.cfg.sample. 7 Restart the CMAE server: bin/cmaed restart Installation for Cloudmark Immunity To install the Cartridge when using Cloudmark Immunity, follow the steps belo
Summary of the content on the page No. 17
Chapter 2 Cloudmark Cartridge Installation � (Immunity 2.0.1) /setup/sql/sqlite/cm_egm.db ( is typically /srv/immunity) 9 The default cartridge.cfg and whitelist.cfg files will not be installed in etc/. To create the default configuration files, copy etc/cartridge.cfg.sample to etc/cartridge.cfg and etc/whitelist.cfg.sample to etc/whitelist.cfg. 10Check for the following log message: Aug 21 12:28:06 : INFO:MICROUPDATE: Successfully updated from network (ne
Summary of the content on the page No. 18
Cloudmark Cartridge Installation and Administration Guide Chapter 2 See also the Cloudmark Authority Engine Extensions Service for Openwave Email Mx Administration Guide. Installation for Openwave Edge Gx Before starting this procedure, Cloudmark recommends backing up entire $AUTH_HOME directory. TO INSTALL THE CARTRIDGE FOR OPENWAVE EDGE GX 1 Stop the server: $INTERMAIL/lib/imservctrl stop imextserv 2 Switch to the $AUTH_HOME directory: cd $AUTH_HOME (AUTH_HOME=/cloudma
Summary of the content on the page No. 19
CHAPTER 3 Cloudmark Cartridge Configuration This chapter discusses the configuration settings in the cartridge.cfg file. Please also refer to the Cartridge release notes for updates to these settings. You can configure Cartridge parameters in the cartridge.cfg file – located in the etc/ directory in the root directory of your Cloudmark installation – using any text editor. Table 1 below lists the configuration parameters, as specified in cartridge.cfg. All configuration parameters are case-
Summary of the content on the page No. 20
Cloudmark Cartridge Installation and Administration Guide Chapter 3 Table 1 Micro-updates configuration settings Parameter Value(s) Default Description exclude from whitelist none If present, the corresponding stats reports or values in statistics reports will be proxy auth replaced by the string or “”. whitelist, proxy auth favor analysis yes or no no When set to “yes”, the over speed Cartridge calculates all fingerprints before returning a result for the message. When set to
