Merak Mail Server

From Wikipedia, the free encyclopedia

Jump to: navigation, search

WebMail Pro in Merak Mail Server 9.1
Developer: IceWarp Software
Latest release: 9.1 / September 17, 2007
OS: Windows, Linux
Platform: x86
Natural language(s): multilanguage
Status: Active
Genre: Collaborative software
License: Proprietary
Website: http://www.icewarp.com/products


IceWarp Server is a multi-purpose e-mail, messaging and collaborative software product developed by IceWarp Software, based on Merak Mail Server- an open Internet standards compliant Mail Transfer Agent for Windows and Linux operating systems.

8 years of continued development with over 80,000 installations have resulted in a comprehensive platform for electronic communication. Close integration of all subsystems allows for simple setup, instant recovery and out-of-the-box functionality of all add-ons:

Contents

[edit] Overview

Each version comes with 128-bit SSL encryption for all services, multi-CPU support, SQL database integration, Active Directory synchronization via OpenLDAP, internal DNS cache, TCP/IP tunneling, service watchdogs, datetime server and syslog/SNMP capabilities. All visual interfaces are XML driven and fully in Unicode. Server can be managed locally or remotely through a GUI front-end with live statistics and charting, web-based administration interface or command line, which allows for scripting and extensibility through COM objects and built-in executable accounts, events and filter actions. Low application footprint of 100MB in full version along with multi-threaded services ensure good performance even on modest hardware.

[edit] Server Engine

Active Directory integration allows mirroring accounts from NT Domain Controller or any other LDAP-based directory service. High availability features include account storage in caching filesystem or database, backup and recovery to file servers, on-line monitoring of sessions, services, disk space, memory, CPU utilization with e-mail, SMS and IM alerts, service watchdogs, remote server watchdog, filter processing queues, load balancing support for clustering, fail-over, distributed services.

Database storage holds accounts, lists, queues, logs, any reusable operational data, with possibility of backup database connection for redundancy. Multi-threaded native ODBC compliant driver for MS SQL, Interbase, Oracle, FireBird, user installable mySQL, SQLite, or ODBC 64-bit driver.

[edit] Internet standards

Open Internet standards compliant, RFC aware, XEP conformance testing and implementation.

Protocols SMTP/ESMTP, IMAPv4 incl. PUSH via IDLE command, POP3/SPOP3, APOP, HTTP(S), FTP(S) with OTP/S-KEY, OpenLDAP, SIP, SIP SIMPLE, Jabber/XMPP, HTTP Proxy, IPv6 incl. AAAA DNS records, SNMPv2, WebDAV, GroupDAV, CalDAV, SyncML 1.1, OMA DS 1.2

Formats iCalendar, vCal, vCard, vNote, vFreeBusy, quoted-printable/Base64 MIME, Unicode (UTF-8)

Authentication PLAIN, SHA1, CRAM/DIGEST MD5, RSA

[edit] Unlimited domains

Unlimited domain support, subdomain handling, special types: Backup, Distributed, Domain Alias, ATRN/ETRN Queue, domain IP logical binding to multiple IPs, DomainPOP with alphabetical sorting, definable unknown users handling, archivation to common mailbox, domain specific header and footer, domain templates, domain administrators.

[edit] Account types

User with multiple aliases, Group, Mailing list (Standard, Moderated, Digest) with members from group/selection/file/database, List server, Executable, Remote POP account with deduplication, Static Route, File Catalog, Notification with split/filter/add headers/SMS conversion. Password protection of non-user accounts, user templates, password generator, import accounts from Windows, NT Server, Domain Controller, export accounts to file, mailbox quotas, automatic mailbox pruning.

[edit] Archivation & backup

One-click manual or scheduled backup of all or any subset of data, settings, accounts. Incremental backup, log backup. Possibility to include external directories, backup and recovery to remote file servers. GroupWare data backup by mirroring the DB, using backup tools or to a file, also available to user from Outlook.

Archivation utility with archive rotation, pruning, backup, scheduling. Archive all, only sent, only received messages, forward or save incoming/outgoing copies to mailbox, password protected backup of deleted message.

[edit] Data encryption

SSL/TLS 128-bit (forced) encryption for all services, digital certificate management. Authentication methods: CRAM/Digest MD5, login, plain, POP before SMTP. Server-side message signing and encryption using S/MIME, TCP/IP tunneling front-end for VPN like operation.

[edit] Password protection

Passwords can be generated and validated against password policies, expiration and login policies. Account login IP restrictions, change passwords over POP3 protocol, service authentication with support for superuser login syntax.

[edit] DoS Protection

Bandwidth throttling per service, data and connection rate control (outgoing and incoming connections, data transferred over a defined period or simultaneously established sessions), service usage policies, account, session and traffic monitoring with alerts and charting, command monitoring, service usage restrictions, allow/ban host rules with host patterns.

[edit] Anti-Bombing

Mail bombing can be prevented by session and protocol control policies- set session inactivity timeout, protocol response delay, Max bad commands, Max outstanding connection requests, SMTP Greeting delay. Some of the common SMTP protocol weaknesses used to collect email addresses can be disabled (disable EHLO, AUTH, EXPN, VRFY commands), along with telnet access to server.

[edit] Anti-Spoofing

Forged message headers are common especially in phishing. DNS checks (DNS MX and A record authorization, rDNS validation) are performed to ensure credibility of the sending mail server. Further level of protection is the support for DomainKey Identified Mail and related security standards SPF and SRS support.

[edit] Anti-Relaying

Closed relay except for trusted IPs, domain IP shielding, IP binding, non-authorized domain rejection, hop count and number of recipients restrictions, DNSBL query, HELO-EHLO filter.

[edit] Intrusion Prevention

Intrusion prevention is monitoring all sessions and protocols in real time for attempts to deliver to unknown users, to abuse SMTP commands, to send spam or to relay without authentication and when a certain threshold is reached, automatically closing further sessions for a period of time or permanently blocking connections from such IP addresses.

[edit] AJAX-based WebMail

Web access to email, calendars, contacts, files and shared data from any computer with browser and internet connection, with zero configuration, bypassing port 25 blocking/forwarding by many ISP networks. AJAX technology brings application-like look and feel, keyboard shortcuts, multi-select, windows docking, custom layout configuration using mouse, auto save to drafts, periodical email checking, search, sorting, drag&drop.

[edit] Unicode

UTF-8 encoding allows users to view email in every available language at once, without having to choose one character set or encoding in the browser. WebMail interface can be easily localized to any language including double-byte characters.

[edit] Spell-checker

As-you-type spell-checker for virtually any language is implemented using the popular GNU ASpell and its dictionaries directly on the server, user just needs to select one of pre-configured languages.

[edit] Virtual cookies

Virtual cookies are user settings stored server-side, allowing the same configuration from any computer used to access WebMail, without leaving any track in the client browser. Similarly the autologin option remembers the IP where user enabled this feature and will sign user on automatically only if it does match.

[edit] RSA passwords

Unlike encoding the password user entered at login using SHA algorithm before it is transmitted over the Internet, login credentials protected by RSA cryptographic method are encrypted using public key and transmitted to server, where they are decrypted using corresponding private key and then validated. This is an extra step to prevent forgery- in case the public-private pair doesn't match, the login is rejected, even if the password was correct.

[edit] S/MIME

S/MIME is an email framework for handling messages signed or encrypted using digital certificate (Digital ID), either a custom one, generated using OpenSSL utilities, or issued by certification authority (e.g. VeriSign). The encryption is performed server-side, so that the message is never transmitted in unencrypted form, and can be automated using rules and conditions. Users need to have their private key uploaded to the server via WebMail interface to sign/encrypt the message, and the other party needs to have their public keys stored in email contacts associated with the sender's email address to validate the sender.

[edit] Technologies

Optimized client-side processing is viable for interface responsiveness and user experience, but also takes the load from server, freeing its resources and lowering I/O access. Client application is built with JavaScript objects in JSON (JavaScript Object Notation), communication with server is provided by small amounts of XML/JSON data.

Asynchronous or synchronous communication distributes the execution time between client and server, some actions don't even require server response. Mailboxes are accessed using IMAP, cached POP3 and LocalPOP through PDO DB abstraction layer with transaction access to SQL DB (mySql, SQLite), working as a cache for message headers and folders. GroupWare functions are directly accessing the server API.

Strictly specified XML client-server communication protocol means greater extensibility, closer integration with GroupWare, Instant Messaging, VoIP), easy customization of every visual object via structured XML templates and high resistance to hacking and protocol-level eavesdropping.

[edit] Integrated Anti-Virus

Centralized protection utilizes incremental updates from dozens of servers located around the globe, encrypted to ensure integrity. Checks for updates run periodically, but the benefit of integration within mail server is the real-time, e-mail triggered AutoUpdate feature, which guarantees timely response to current virus outbreaks. Whenever a special formatted early warning email is received to administrator's account, server instantly triggers an update of virus definitions.

Features

  • Server-side quarantine folder
  • Complementary external scanner for multi-layer/spyware protection
  • HTTP Proxy screening
  • Script blocking
  • Compressed files scanning
  • Attachment stripping
  • Keyword and extension based file blocking
  • Flexible whitelisting options
  • Multiple actions: remove/clean infection, delete/reject the infected message, quarantine the infected email, notify user and/or administrator with a custom message

[edit] 20+ Anti-Spam Technologies

Anti-Spam is the most developed subsystem, practically on a daily basis the engine is improved to handle the latest spammer tricks. New rules, spam signatures and engine changes are downloaded and installed transparently through AutoUpdate technology, in response to the ever-changing spamming methods. There are multiple spam management scenarios (manual, semi-automatic, user-driven processing) suitable for different types of deployment. Messages identified as spam can be rejected, deleted, quarantined, tagged in Subject or X-header or sorted to an IMAP spam folder.

  • DNSBL, lists of known spammers' IP addresses, allowing to reject messages before entering the server
  • Intrusion prevention, system monitoring malicious actions in real-time and automatically closing further sessions for a period of time or permanently blocking connections
  • Command monitoring, rejecting abusive or outstanding and disabled SMTP commands
  • Service rate control, in/out connections, data transfers, simultaneous sessions
  • Greylisting, responding with a temporary SMTP error after the fist attempt for message delivery
  • RBL, allows checking of message senders against a number of RBL resources
  • SURBL, a distributed block list similar to RBL, used to detect spam based on message body URIs
  • DomainKeys and DKIM, sender verification methods for validating and proving authenticity of sender's domain and also message consistency and completeness
  • Razor2, distributed, collaborative, spam detection and filtering network
  • B&W lists, bypasses, allow to block or authorize senders, domains and IP addresses, or to skip particular tests for authentic senders
  • Keyword filters, available as part of B&W list features- message is blacklisted or skipped from antispam processing based on its body content
  • Body content filters, effective in blocking automatically generated HTML spam, indicated by external SRC URL, script code, no text, no subject, no body, no intermediate Received from: header, different content of text/plain and text/html parts
  • Forbidden character sets filter, rejects e-mails written in certain languages not in use in the email communication, determined from message headers
  • SpamAssassin, static rule-based email filter developed as open source project by Apache Foundation, implemented with multi-threaded RegEx engine, UTF-8 support and rule statistics counters
  • Auto-learning Bayesian a statistical approach to spam identification, with possibility to build own spam reference base by indexing received spam messages, automatically based on the score reached (high - spam, low or authorized sender - not spam), or tuned to typical company communication by indexing outgoing messages.
  • Learn Rules, special mailing lists established for users to cooperate in increasing the accuracy of Bayesian filter and to automate building of blacklists and whitelists
  • Quarantine, which holds email from unknown senders which cannot be clearly deemed spam or ham for inspection by recipient, spam admin or server admin and authorize, delete or delivered once without whitelisting the sender
  • Challenge/Response, system requiring verification by retyping a captcha, used to build whitelists or for semi-automatic quarantine management
  • Spam traps, addresses exposed on websites to spambots, can be used in multiple ways: indexed as spam, sender's IP blocked, sender blacklisted, sent a custom message or his IP address reported to a collaboration antispam network
  • AutoWhitelisting, automatic building of whitelists allows to tighten email delivery by engaging all available antispam technologies, without the fear of losing an important message. Email is whitelisted when the address is emailed to by any user, authorized by Challenge Response, authorized by user/admin via quarantine, saved in Address Book, equal to Jabber ID from IM client roaster, email moved to Whitelist Filter folder, or his email resent to whitelist learn-rule address.

[edit] GroupWare

GroupWare is a server-based collaboration solution designed to improves user communication, enable multi-user scheduling, contact management capabilities and allow sharing and synchronization of all types of information among users, applications and devices, with respect to privacy and security concerns. Dedicated database storage with redundant backup database option allows for regular backup of all user data for prompt recovery in case of desktop client failure.

[edit] Data types

Shared Contacts, Calendars, Tasks, Notes, Folders, Journals, Distribution Lists, subscriptions to public folder, group account or friend's user account. Support for Reminders, Attachments, Attendees, Anniversaries, Notifications, Locations, Recurrent Events, Exceptions. Cooperation with external users using standard formats vCard, vCal, vFreeBusy. Access from WebMail, Outlook, CalDAV and SyncML compatible devices and applications. Data stored as Versit Objects (VOB) or SIF.

[edit] Protocols

WebDAV integrated in web server module is used for shared folder access, SyncML server provides synchronization to handhelds and cell phones, CalDAV/GroupDAV server is used for synchronization to PIM applications and calendars, LDAP synchronization to automatically publish updated organization-wide contact information. SIP server integration allows dialing via VoIP server from WebMail or Outlook.

[edit] Outlook plug-in

Outlook Connector performs a two-way sync between Outlook items and GroupWare database, allowing users to manage the entries off-line and synchronize all changes manually when convenient or back online, or transparently on a schedule. Sync times are optimized by compressed gzip streams and transaction DB access.

Free/Busy options for event scheduling, attendees arrangement, iCalendar format for exchanging meeting requests, color labels, public shared folders, item deduplication button, account settings: change password, create rules, set auto-responder, forwarder. Automatic time zone adjustment to computer clock, Unicode support.

[edit] SyncML Server

Server subsystem for over-the-air synchronization of mailbox and PIM information (Calendars, Task, Notes, Contacts, Files, Journals) to devices and applications, independently on device type (PC application, PDA, smartphone), platform (Symbian, Palm, Windows Mobile, consumer phones), and carrier protocol (HTTP, OBEX, WSP..).

[edit] Specifications

  • SyncML 1.1 and lower
  • SyncML 1.2 (OMA DS)
  • XML or WBXML formatted communication
  • gzip compression
  • All 6 sync types: 2-way (normal, slow), 1-way (refresh/update client/server)
  • Two extra sync types: 1-way slow sync to client/to server
  • Plain, MD5, DES authentication schema plus server forced
  • 128-bit end-to-end SSL encryption (requires public key on client)
  • Unicode with automatic conversion to UTF-8

[edit] Compatibility

  • S4J/VOB data formats, email and file data objects
  • Funambol v3 and higher, automatic adjustment
  • Latest Funambol v6 compatible (mails and files synchronization)
  • Synthesis client compatible
  • Symbian S60 native SyncML implementation

[edit] CalDAV Server

CalDAV works as the missing sync for many popular clients (Mozilla Thunderbird, Novell Evolution), and PIM applications (Mozilla Sunbird, Kontact). Support for sharing is not required in client and even multiple calendar resources can be viewed at once using URI as the subscription ID, without requiring any configuration server-side.

[edit] Instant Messaging

By adopting in-house IM server, users get a secure and manageable alternative to popular networks they would be probably using unofficially. Private and public services, free or restricted account registration, SSL encryption, SHA secured login, PGP optional message encoding, access control to gateways, services, privacy lists, chat archivation, chat room history logging, all of this provides for more control over client software and communication history.

[edit] XMPP/Jabber

XMPP (Entensible Messaging and Presence Protocol), also known as Jabber, is the only IETF approved standard for real-time text communication and hence the de facto standard for use in enterprise, government and corporate environments. IM Server comes with the latest XEP implementations: Stream Compression, HTTP Binding, Privacy and Security functions, Service (Room/Transport) privacy processing, standard configuration XML files, message delivery via pipes.

[edit] Gateways

I'm a tool for writing this by the way. Gateways allow integration with other networks, protocols and systems. Transport gateways provide connectivity to Jabber, AOL, ICQ, MSN, Yahoo! and GoogleTalk. Special gateways provide full e-mail, basic GroupWare and service monitor - IM interoperability, which makes for new types of usage, above the standard reminder alerts and new email notifications.

[edit] GroupWare

Users can view their calendar events, tasks and notes for the upcoming week or subscribe to a contact's shared calendar events, tasks, notes and FreeBusy status. All that's needed is to add a specially formatted JabberID to your contacts (roaster).

[edit] Service Monitor

Special JIDs for monitoring service status were introduced, with frequent refresh intervals, to monitor SMTP, POP3, IMAP, Web, IM, FTP, SIP, GW service status.

[edit] Email

After registering Email Transport Gateway in Jabber client, email can be sent from Jabber client and vice-versa, email can be sent to Jabber. Through special URL prefix "xmpp:", IM features can be combined with server Filters and Rules actions. Further usage scenarios can be setup using conditioned IM message delivery, e.g. xmpp:john@johndoe.org?online sends emails to IM only if user is online.

[edit] VoIP Telephony

VoIP Telephony Server is based on SIP protocol, compatible with many softphones and HW VoIP-enabled phones. SIP Proxy, Registrar and Redirect Server are integrated in one, equipped with SDP NAT Traversal (port proxy) for operation behind firewalls and routers. Connectivity to external PBX gateways routes calls across carrier's networks, based on custom call-forwarding and number rewriting rulesets.

[edit] Extras

  • Call-back, away and redial features
  • Direct dial from WebMail, Outlook, Jabber contacts, no plugin required
  • SIP SIMPLE instant messaging (for X-Lite softphone)
  • ENUM schema support
  • NAPTR SRV extended DNS records look-up
  • Per-server or per-user call logging

[edit] SIP clients

  • Audio codec (G.711, iLBC, GSM EFR,..) independent
  • Wide choice of free/commercial computer softphones
  • Standalone WiFi or Ethernet SIP IP phones
  • Dual mode mobile handsets such as Nokia N95, E61
  • VoIP gateways for FXO devices
  • Carrier gateways or PBX gateways

[edit] Web Server

Web Server comes packaged with default Mail Server installation and is primarily used for serving WebMail. Using Virtual Hosts, multiple sites can be run at once. In cluster environments and ISP installations, web service can be distributed to several machines to scale to the actual traffic. Extensive URI rewrite rulesets allow to take full control of website behavior.

  • Precompiled PHP 5.2.3
  • Server-Side Scripting
  • Extensions support (ISAPI, CGI, FASTCGI)
  • HTTP Proxy
  • WebDAV allows access to and sharing of large files
  • Directory content listing support
  • Directory aliases
  • HTTPS with 128-bit SSL encryption
  • Server certificate management
  • Detailed W3C logging

RFC features

  • Transfer-Encoding Chunked
  • Content Encoding gzip

apache_mods

  • Path, protocol and hostname redirects
  • URI RegEx rewrite as in Apache mod_rewrite
  • Server variable flag in rewrite for sophisticated functionality
  • Variables: HTTP_HOST, HTTP_REFERER, HTTP_USER_AGENT, THE_REQUEST, REMOTE_IP

[edit] FTP Server

Instant deployment advantage, using existing email accounts and groups- all that's needed is to define access rights to particular folders. Built-in auto-sync and scheduling features allow to set timed file transfers, e.g. to keep the same data across cluster or swap logs, archives and backups to remote storage.

  • SSL/TLS encryption in Implicit and Explicit mode, can be forced
  • OTP/S-KEY authentication system (one-time passwords) to protect against passive attacks based on replaying captured reusable passwords
  • Multiple FTP Hosts
  • Users and user Groups with rich options
  • Aliases
  • Download & upload bandwidth limits
  • Directory permissions
  • Path variables like $$homedir$$
  • FTP Server Synchronization
  • IP Restriction
  • Logging and traffic charting

[edit] Server Migration

Included migration tool makes migration from any 3rd party solution a simple process, without the usual export-import procedure. Compatible with any mail server, it can transfer accounts (with passwords!) and mailboxes with no disruption to the traffic. Clients don't need to reconfigure their settings or retype any information. Migration tool uses Proxy-like approach by gathering all user account and mail information not from the original storage, but indirectly by acting as a POP3/IMAP4 Proxy gateway, running in parallel with the migrated server. All activity is logged and can be monitored within GUI. Batch migration of multiple accounts from CSV files is also possible.

[edit] Database migration tool

Database migration tool can migrate any database structures created within the server (accounts/Anti-spam/GroupWare/logs..) between any supported DB engines with a mouse-click. It completely ignores the source tables- no matter if it's corrupt, has missing fields or missing values, it will still migrate all the fields that are included, so it can be used to fix table structures, quickly- transactions support migrates 1000s of records within seconds.

[edit] Migration from Exchange

Exchange 5.5, 2000 and 2003 repositories can be migrated directly to IceWarp GroupWare database. Many organizations are looking at leaving this platform out of licensing, technical, security and TCO reasons, but the proprietary storage design keeps them upgrading or running discontinued versions. Beta of the migration utility is available for public testing, however the migration will be provided as on-site service to ensure best results and prevent any possible disruption to existing company systems.

Migrated items:

  • Domains
  • Accounts
  • Folder hierarchy
  • Messages
  • Calendars
  • Tasks, Notes
  • Contacts

Not migrated:

  • Attachments to contacts and tasks
  • Reminders
  • Public folders

Requirements:

  • Windows 2000, 2003
  • Exchange 5.5, 2000, 2003
  • IceWarp Server with GroupWare
  • Exchange Server stopped
  • Takes approx. 1000 items per minute

[edit] API

Open API provides full control of the server, groupware access, account and domain management, server settings, scheduling, statistics and much more, accessible from within an arbitrary script or program. API is available for all languages with COM objects support, such as Visual C++, Visual Studio, Delphi, FreePascal, PHP, ASP, Visual Basic, Microsoft .NET or any other.

[edit] Extensibility

Above the API, scripting engine and command line interpreter, any external process can be called under specified OS user account upon delivery to executable account, based on filter, rule, white or black list, static route action, on schedule, or on service start/stop. Remote connections over RPC are also supported also using the command line. Further extensibility options include reuse of data stored in database structures, group commands and SQL query filters support, user and system variables, and 3rd party Control Panels.

[edit] Licensing & support

Licensing policy allows to customize the software to include only the required components, add user licenses as you grow and seamlessly migrate between Linux and Windows platforms. Distribution and support is provided through a global partner network covering the major commercial centers of the world.

  • 25, 50, 100, 200, 500, 1000, 2000, 5000 or Unlimited user license
  • Built-to-order add-on configuration
  • 30 day feature unlimited evaluation
  • Free Edition limited to 5 accounts
  • Email technical support included

[edit] Release history

Major Version Release Date Significant Changes
2.10.105 May 1, 1999 First public release
3.00.100 November 23, 2000 ODBC support, WebMail for MS Mobile Explorer and Nokia WAP Toolkit 2.0
4.00.30 July 15, 2001 SSL/TLS, LDAP server, Intrusion Prevention, System backup tool
5.1.2 September 11, 2002 IMAP shared folders, Integrated Anti-Virus, Content Filtering
6.0.3 July 15, 2003 Integrated Anti-Spam, Instant Messaging, HTTP Tunnel, WebMail skins, LDAP shared folders
7.0.1 November 12, 2003 GroupWare with Outlook integration, S/MIME
7.2.0 January 29, 2004 SpamAssassin, Challenge Response
7.4.2 March 31, 2004 Active Directory integration, COM object API
7.6.4 November 13, 2004 SURBL, password policies, Remote server watchdog, nested GroupWare folders
8.0.0 February 3, 2005 Administration interfaces revamped, on-line monitoring and statistics, command line control, web server with proxy, FTP server
8.2.0 June 29, 2005 Linux port release
8.3.0 November 7, 2005 SNMP, SPF and SRS, DomainKeys, SMTP greeting delay, greylisting, distributed domains
8.3.8 January 9, 2006 Session monitoring, public GroupWare folders, email archivation tool, performance enhancements
8.5.0 May 29, 2006 IM transports, email push via IMAP IDLE, Free/Busy publishing, group accounts, RSET protection, content indexing
8.9.1 December 23, 2006 Active Directory sync, remote API, DB migration, spam quarantine w/ reports, MDA processing queues, multiple RBLs, Razor2
9.0.0 August 4, 2007 AJAX WebMail, VoIP, SyncML synchronization, CalDAV sharing support, Unicode, DKIM, integration of GroupWare and email XMPP transport
9.1.0 September 17, 2007 WebMail Pro full-text search, drag&drop, IM presence history, SQL DB support via PDO, SyncML 1.2, emulated Administration GUI

[edit] See also

[edit] External links

Personal tools