Gateway for the mail server

Not so long ago I was lucky to change my job. I got into a company that, in principle, deserves a separate article for a number of reasons and may appear here later. If in a nutshell about the structure of our department: doing something other than your main activity is not forbidden, so my gaze fell on our mail server, which causes a lot of trouble.

The company has remote affiliate branches, evenly distributed throughout Western Europe, using a single mail server. Unfortunately, the budget of the IT department is not very large, and there are a lot of users (about 700 email accounts). It was used, and now it is used for Exchange 2010 mail with the latest updates and more or less configured spam filtering rules, but it somehow went wrong with the antivirus. The purchased solution refused to work normally, inflating the incoming mail queue to indecent sizes and tightly hanging all the mail. (Yes, I know that all best practice talks about the need for an edge server and a separate archive server, but what happened at that time was what it was.)

We take the initiative in our own hands. To my great surprise, I could not immediately find a detailed manual for solving such a problem, so the idea arose to share my trial and error in RuNet.

From what was ultimately tested and tested:

Zentyal , ASSP and Xeams .



After more googling and trying out a few more products, I opted for Xeams. Yes, unfortunately, this is not OpenSource , but a closed product, however, it is very friendly to those administrators who do not have much experience in Linux & Dovecot & Postfix & etc bundles. In addition, it is cross-platform, so that even those with a link to you will not have problems. It can work in three modes: Stand alone server - yes, xeams can be just a mail server. How much good I can’t say, because this function interested me last. Spam firewall - in this mode, xeams only accepts all mail traffic on itself and further distributes it to corporate mail servers. Hybrid mode




- Hybrid mode. It combines the other two, I recommend setting it, because it cannot fully filter spam without passing outgoing traffic through itself.


Since we already had a mail server, we used the SMTP-Proxy

option. Installation was performed on a clean machine with Ubuntu 14.04. The only thing that needed to be delivered was Java, which, in fact, runs the Xeams engine.

sudo apt-get update && upgrade
sudo apt-get install libc6-i386
sudo update-alternatives --config java
sudo apt-get install default-jre
java -version

Xeams uses ClamAV, however, it recommends putting it on a separate machine, but no problems were noticed during use on one machine. If you need to reconfigure the ClamAV settings later, this can also be done without problems.

sudo apt-get install clamav-daemon

Download the archive with the installer from here . Unpack, give rights and execute.

wget http://www.xeams.com/files/XeamsLinux64.tar
tar -xf ./XeamsLinux64.tar
chmod +x ./Install.sh
./Install.sh

If everything went well, the Web-Interface will be available on port 5272.

The main page contains reports, graphs and basic parameters of resource consumption. We gave the machine 8GB of RAM, the peak load several times reached 6, so these numbers are justified.



We pass to the setting itself. On Firewall, we wrap all traffic on port 25 on our Xeams IP on port 2525. This is because Xeams not only receives, but also sends mail through it, so that incoming mail arrives at port 2525, and outgoing traffic arrives at port 25.

In general, the Xeams setup is simple and quite convenient. On which moments, nevertheless, I would like to draw attention to:









. I strongly recommend that you register all public mail and white list domains there, because a letter delay of 10 hours due to incorrect settings on the sending mail server side, alas, is not uncommon.






Spam filters

Xeams has a fairly large set of spam filters:

Real-time Black-hole servers (RBL) . Each list can be given its own importance points, on the basis of which Xeams determines the reliability of the letter.

Of adaptive filters, Bayesian Analysis is used , which completely copes with the functions assigned to it. There were fears that it will work poorly, due to the large number of languages ​​of correspondence (Russian, German, English, Spanish, Italian, Polish, Greek), however, the percentage of false positives is quite low.

Auto Learn Sender. Great thing, it is because of it that we pass all outgoing mail traffic through Xeams, which analyzes the addresses of the recipients and takes them into account when making the final assessment of the reliability of the letter.

The other filters are standard and I don’t think that they need to be described in this article, which has already turned out to be bloated.

Now I would like to devote a few words to the not entirely obvious nuances:
After several days of use, we changed the standard filter settings and the configuration of the glasses:


and the Bayesian Score were raised to 115.
The most common false positive was the problem of correct encoding, since, nevertheless, Xeams was imprisoned in English, decided to turn off this setting.

By default, ClamAV does NOT check macro attachments in Ofiice documents, i.e. the newfangled .locky can safely pass,
you can fix this with one line:

echo'ScanOLE2 true' >> /etc/clamav/clamd.conf

In general, two weeks after using and analyzing spam, possible spam, we can say that 98% of spam does not go through.

I will be glad to suggestions, comments and criticism in the comments.