2.3	Enable public folder scanning

Spamming techniques are in continuously evolving and consequently you might encounter instances when spam still makes it through anti-spam filters on to the recipient’s Inbox. Through public folder scanning, users can manually classify email as spam and ‘teach’ GFI MailEssentials spam patterns to classify similar email as spam.

Public folder scanning enables GFI MailEssentials to retrieve emails from public folders to add to whitelist/blacklist and HAM/SPAM databases. On systems running Microsoft Exchange Server or Lotus Domino, public folders are created automatically on completion of the configuration process.

To enable public folders scanning follow the instructions listed in the sections below.

2.3.1

Public folder scanning setup for Microsoft Exchange Servers

1. From the GFI MailEssentials configuration console right click the Anti-spam ► Anti-Spam Settings and select Properties.

Screenshot 2 - Configuring Public folder scanning

2. Select Public Folder Scanning tab, and click on Enable Public Folder Scanning checkbox.

3. From the Poll public folders via list select the method GFI MailEssentials uses to retrieve emails from public folders.

•	Exchange Server 2000/2003 - Select MAPI, IMAP or WebDAV.

•	Exchange Server 2007 - Choose WebDAV or Web Services.

•	Exchange Server 2010 - Choose Web Services.

Available options are:

•	MAPI - To use MAPI, GFI MailEssentials must be installed on the machine on which Microsoft Exchange Server is installed. No other settings are required.

•	IMAP - Requires Microsoft Exchange IMAP service. IMAP enables remote scanning of public folders and works well in environments running firewalls. In addition, IMAP can be used with other Mail servers that support IMAP. Parameters required are:

o	Mail server name

o	Port number (default IMAP port is 143)

o	Username/password

o	Select the Use SSL option to use a secure connection

•

WebDAV - Specify Mail server name, port (default WebDAV port is 80), username/password and domain. To use a secure connection select the Use SSL checkbox. By default, public folders are accessible under the ‘public’ virtual directory. If this has been changed, specify the correct virtual directory name to access the public folders by editing the text in the URL box.

•

Web Services - Specify Mail server name, port (default Web Services port is 80), username/password and domain. To use a secure connection select the Use SSL checkbox. By default, public folders are accessible under the ‘EWS/exchange.asmx’ virtual directory. If this has been changed to something else, specify the correct virtual directory name to access the public folders by editing the text in the URL box.

 

Screenshot 3 - Public folder scanning test succeeded

4. Click Scan Now to automatically create Public folders.

5. Click Test if you are setting up IMAP, WebDAV or Web Services. On screen notification will confirm success/failure. If the test fails, verify/update credentials and re-test.

2.3.2

Configure a dedicated user account for Exchange Server 2000/3

When GFI MailEssentials is installed in a DMZ, it is highly recommended that for security reasons a dedicated user account is created to retrieve/scan email from public folders. Users will have access to the GFI AntiSpam folders.

1. Create a new Active Directory (AD) user with power user privileges.

2. From the Microsoft Exchange System Manager, expand Folders ► Public Folders node.

3. Right click GFI AntiSpam Folders public folder and select Properties.

4. Click Permissions tab and select Client permissions.

Screenshot 4 - Setting user role

5. Click Add…, select new user, and click OK.

6. Select new user from the client permissions list and from provided list set its role to ‘Owner’. Ensure that all checkboxes are selected and the radio buttons are set to All.

7. Click OK to finalize your configuration.

8. From the Microsoft Exchange System Manager right click GFI AntiSpam Folders and select All tasks ► Propagate settings.

NOTE: For Microsoft Exchange Server 2003 SP2, select click GFI AntiSpam Folders and select All tasks ► Manage Settings option.

9. Select the Folder rights or Modify client permissions option and click OK or Next.

10. Specify the credentials of power user account created in step 1 and test the setup to ensure the permissions are correct.

2.3.3

Configure a dedicated user account for Exchange Server 2007/2010

When configuring a dedicated user account to retrieve the emails from the GFI AntiSpam Public folders, the user would need to have ‘owner’ access rights on the GFI AntiSpam Public Folders.

1. Create a new Active Directory (AD) (power) user.

2. Logon to the Microsoft Exchange Server using administrative privileges.

3. Open ‘Microsoft Exchange Management Shell’ and key in following command:

Get-PublicFolder -Identity "\GFI AntiSpam Folders" -Recurse | ForEach-Object {Add-PublicFolderClientPermission -Identity $_.Identity -User "USERNAME" -AccessRights owner -Server "SERVERNAME"}

Change “USERNAME” and “SERVERNAME” to the relevant details of the Active Directory user in question.

•

Example:

Get-PublicFolder -Identity "\GFI AntiSpam Folders" -Recurse | ForEach-Object {Add-PublicFolderClientPermission -Identity $_.Identity -User "mesuser" -AccessRights owner -Server "exch07"}

2.3.4

Hiding user posts in GFI AntiSpam Folders

For privacy and security purposes, it is highly recommended that you hide user posts made on GFI AntiSpam folders. This way, users will only be able to post to the folders without viewing existing posts (not even the ones they posted themselves). To configure user privileges and hide posts for unauthorized users do as follows:

Microsoft Exchange 2000/2003

1. From the Microsoft Exchange System Manager expand Folders ► Public Folders node.

2. Right click GFI AntiSpam Folders public folder and select Properties.

3. Select the Permissions tab and click Client permissions.

4. Click Add…, and select the user/group to hide the posts from and click OK.

5. Select user/group configured earlier to the client permissions list and set its role to Contributor.

6. Ensure that only the Create items checkbox is selected and the radio buttons are set to None.

7. Click OK to finalize your configuration.

8. From the Microsoft Exchange System Manager right click GFI AntiSpam Folders and select All tasks ► Propagate settings.

9. Select Folder rights checkbox and click OK.

Microsoft Exchange 2007/2010

1. From Microsoft Exchange Management Shell, key in the following command:

ReplaceUserPermissionOnPFRecursive.ps1 -Server "server" -TopPublicFolder "\’GFI AntiSpam Folders’" -User "Default" -Permissions Contributor

Replace “server” with the full computer name.

2. When prompted, key in y to confirm permissions for each folder.

This command will set the default permissions for the GFI MailEssentials Public Folders to contributor, where users can move emails to the Public Folders but cannot view or modify entries. By default administrators are owners of the Public Folders and can view or modify entries. For more information about Public Folders permissions in:

•	Microsoft Exchange 2007 refer to http://technet.microsoft.com/en-us/library/bb310789.aspx

•	Microsoft Exchange 2010 refer to http://technet.microsoft.com/en-us/library/bb310789(EXCHG.140).aspx

2.3.5

Public folder scanning setup for Lotus Domino servers

Step 1: Create a new database which used to store GFI MailEssentials Public folders.

1. From the IBM Domino Administrator, click on File ► Database ► New.

2. Key in the following details for the new database:

•	Server: <Your Domino Server details>

•	Title: Public-Folder

•	File name: Public-F.nsf

•	Select ‘Mail (R7)’ as the template for the new Database

3. Click OK to create the database.

Step 2: Convert the database format of the newly created database.

1. From the Lotus Domino server Console, run the following command:

Load Convert -e -h <Database Filename>

•

Example:

Load Convert -e -h Public-F.nsf

Step 3: Create a new Mail-In database:

A new mailbox needs to be created in order to store the new GFI MailEssentials Public Folder.

1. From the IBM Domino Administrator, select People & groups tab and click on Mail-In Databases and Resources.

2. Click Add Mail-In Database and key in the New Mail-In Database as follows:

•	Mail-in name: Public Folders

•	Description: The GFI MailEssentials Mailbox

•	Internet address: <public@<yourdomain.com>

•	Internet Message: ‘No Preference’

•	Encrypt incoming mail: ‘No’

•	Domain: <yourdomain>

•	Server: <Your Domino server name>

•	File name: ‘Public-F.nsf’

NOTE: You will need to associate a user with the Mail-In-database created above. This account will be used by the GFI MailEssentials server to connect to the Lotus Domino Server.

Step 4: Configure GFI MailEssentials

Define the shared namespace which will be used when connecting to the Lotus Domino IMAP service:

1. Click Start ► Run and type Regedit.

2. Locate the following Registry Key:

<HKEY_LOCAL_MACHINE\SOFTWARE\GFI\ME14\Attendant\rpfolders:8\>

3. Create the following Keys:

Name: ‘FolderDelimiter’	Name: ‘SharedNamespace’
Type: STRING	Type: STRING
Value: ‘\\’	Value: <Public Folder Prefix\Name of new Mail-In Database\>

Get the values for the ‘sharednamespace’ key as follows:

Public folder prefix name

1. From the IBM Domino Administrator, click Configuration Tab.

2. Expand Server ► Configurations, click on your Domino Server and click Edit Configuration.

3.From the IMAP tab, select Public and Other Users’ Folders tab. The ‘Public Folder Prefix’ can be found under the Public Folder Section.

Mail-In database name

1. From the IBM Domino Administrator select People & Groups tab.

2. Click on Mail-In Databases and Resources node. Name of the New Mail-In Database is listed within the right pane.

Step 5: Restart the IMAP Service on the Domino Server

1. Open the Lotus Notes Console

2. Type ‘tell imap quit’ and wait until the task completes.

3. Once the above is complete, type ‘load imap’

Step 6: Configure GFI MailEssentials

Configure the GFI MailEssentials Public Folder Scanning properties. 1. From the GFI MailEssentials Configuration, right click Anti Spam Node and select Properties.

2. Select Public Folder Scanning tab and key in the following values:

•	Server: <IP Address of Domino Server>

•	Port: 143 (default)

•	Username: Username associated with the mail-in database

•	Password: User password

3. Test configuration by clicking Test button and click Scan now to generate the public folders.

Step 7: Ensure the Public Folders are created

Using telnet to determine if Public folders were created successfully:

1. From the GFI MailEssentials machine load up command prompt.

2. Type ‘telnet’

3. Type ‘Open <IP ADDRESS> 143’

4. Type ‘ao1 login <public@yourdomain.com> <password>’

5. Type ‘ao5 list “<Public Folder Prefix\Name of new Mail-In Database\>” “*”

6. The output of the above command should show the public folders as in the following screenshot:

7. Type ‘ao3 logout’

NOTE: Use the Lotus notes designer to remove any unwanted views and forms from the database created previously.