GoodMessaging for Systems

This document discusses what Systems people (ie. Systems Administrators and the like) need to know for compliance with GoodMessaging at the Basic, Bronze, and Silver levels of compliance. It will most likely only make sense after reading the GoodMessaging Introduction.

GoodMessaging Compliant Software

All the software used must be GoodMessaging compliant. Your GoodMessaging certification level can only be as high as the lowest level awarded to the piece of software that you're using. Additionlly, you must have all the relevant options turned on.

For a complete suite of GoodMessaging compliant software, you need to have:

• A Mail User Agent that you supply to your clients that is GoodMessaging compliant (although whether they choose to use it or not is their problem)
• A Mail Sending Agent (ie. sendmail) on your server that is configured to:
  • Perform authentication (ie. SMTP-auth)
  • Listens on port 587 (may optionally listen on 25 as well)
• A Mail Transfer Agent on your server
• A Mail Delivery Agent on your server
• A Mail Access Agent (ie. POP or IMAP server)

Bronze Level

The Bronze level of compliance additionally requires:

• Access for your customers to an NNTP server (it need not be one that you run yourself)
• A Jabber server (must support addresses with the same domain as their e-mail address)
• You must provide your clients with:
  • An NNTP client
  • A Jabber client

Validation

Content Validation

The Mail Delivery Agent and Mail Sending Agent must also perform Spam checking. Outgoing (MSA) Spam checking should not modify the e-mail (but reject Spam), but incoming (MDA) software should. The MDA should also provide the option of filtering the Spam into a separate, server-side folder.

The MTA needs to accept e-mail for only local addresses, so that customers who wish to send outgoing e-mail must use the MSA.

The MSA and MTA should both reject viruses before accepting the message.

Bronze Level

The Mail Delivery Agent and Mail Sending Agent also need to check that the message complies with Internet Standards, and rewrite it if it doesn't. This can be done with tools such as Anomy Sanitizer and MIMEDefang.

The Mail Transfer Agent also needs to perform Spam checking before accepting the e-mail, and reject it out of hand if its very Spammy.

Support

A service is not a service unless it is supported. In particular, there are two areas in which support is needed.

Anti-Spam Support

A procedure must be in place for dealing with Spam complaints. The procedure must state that all communications regarding a spam complaint will be responded to within a week. Any spam from sources controlled by the GoodMessaging environment (ie. your own clients) must be dealt with in such a way as to ensure no further abuse occurs fromt hat source.

Update Support

A procedure must be in place for doing software and antivirus updates. The procedure must specify that updates are installed within a week after they are released by the vendor.

End-User support

There must either be a trouble-ticket system in which all attempted solution details are recorded, or there must be a way for the person to return to the original support person on the next call.

Support must provide (possibly for a fee) a CD (or other portable media) containing GoodMessaging client software for the End User.

Bronze: Telephone support must be available to your own paying end users, with a hold time of no less than fifteen minutes. If the support person cannot solve the problem, they must have someone who is knowledgeable about the messaging system to whom they can turn, or some way of lodging the trouble ticket with someone more knowledgeable who can call the end user back.

Security

Ingress and Egress filtering

Ingress and egress filtering are necessary for a secure mail system. These are not part of the mail system as such, but need to be part of the network it is on.

• Any packets coming into the network from "downstream" (usually end users or client networks) must be filtered to ensure that clients are only sending from addresses which are theirs
• Any packets coming from upstream must be filtered to ensure that they do not claim to be from within your own network, or from one of the private IP ranges (ie. 192.168.x.x)

Encryption

The system must support STARTTLS in:

• The MTA (and use it where possible)
• The MAA (and use it)

Authentication

• The MAA and MSA must authenticate the user (ie. POP/IMAP and SMTP authentication)
• The MTA must authenticate the user as best it can. This involves using DNSSEC and SPF, and requiring a valid reverse-name lookup.

Flexibility

• IMAP must be available (POP may also be an option)
• Webmail must be available

• Silver: An ACAP server must be available, and must be useable from the webmail and the MUA distributed to the users, at least as far as the following datasets are concerned:
  • Addressbooks
  • E-mail account settings
  • E-mail personalities

Redundancy

At the basic level, only the following are required:

• Redundancy for the MTA and the MSA (ie. secondary MX servers)
• SRV records

Monitoring

Availability/Capability Monitoring

Monitoring is absolutely essential for any service. All server-side MAs should be monitored. Client-side MAs do not need monitoring, as they are not a service.

Monitoring should be done of various vital areas. The service should be monitored for:

• Service existance (ie. connect to the port it runs on, and test that it is there)
• Network connectivity (this can be subsumed into the above item if the above item is tested from a different machine; if the above item does not respond, then then it must be tested whether the machine on which it resides is also dead, or whether it is still running)
• Service response time should be monitored
• Available Hard Drive space should be monitored, as should response time
• Available RAM should be monitored (in conjunction with swap space usage)
• Available CPU should be measured
• Available bandwidth should be measured

(What about connectivity to outside world?)

Monitoring is intended for the following functions:

• Service Assurance
• Capacity Management
• Problem debugging

Logging

Logging should also be done in such a way as to expedite the Monitoring and Support functions.