An In-Depth Look at the Novell GroupWise® Internet Agent

Robin Redgrave

Senior Consultant

Novell UK

Tim Heywood

Technical Director

NDS 8

Morris Blackham

Software Engineer

Novell Inc

Agenda

Architecture & design

1

Functionality

2

Security

3

Tips and tricks

4

Troubleshooting

5

The future

6

Architecture & Design

GWIA Architecture

MTA

Agent

SMTP

Daemon

POP

IMAP

LDAP

POA

POP/IMAP

LDAP

Directory Structure

Problem messages

MTA inbound queue

Outbound SMTP messages

Result messages

Inbound SMTP messages

Deferred delivery messages

Working directory

MTA outbound queue

Saved configuration

Character mappings

DSN notification messages

Delayed delivery messages

GroupWise Design

Have domain local to the GWIA

Recommended to be on a secondary domain

Don't run across the network

Only one GWIA per server

Can not have multiple GWIAs using the same port

Will listen on ALL local IP numbers

Will send on the server's primary IP Number

Can bind specific IP number at load time so as to send all messages from the specified IP number

Multiple GWIAs

Why

Provide flexibility	• Enhanced stability

Enhanced security	• Performance

Usage

Inbound/outbound mail

Internal/external mail

Dedicated POP or IMAP services

Resilience

MX records can point to multiple inbound GWIAs

But outbound GWIA is set at Internet Addressing /domain

Clustering

Provides additional resilience

Keep the domain and GWIA as a single resource

Bind IP address at load time

Maintains single MX record for reverse DNS

Functionality

POP3/IMAP

Security

Ensure SSL is enabled

Sending in clear can be so embarrassing

If not in use then disable for improved security

Can now use IMAP at the POA

Direct access to the PO and therefore improved performance

Consider a dedicated IMAP/POP3 GWIA

Enable intruder detection at the POA

IMAP

LDAP

Lightweight Directory Access Protocol

No, not a database, an access protocol

References the GroupWise domain database

Returns only 4 attributes

First Name	• Last Name

Email address	• Telephone

Generally use NLDAP instead

References eDirectory so all user attributes available

eDirectory is optimised for LDAP and is therefore faster

Do not make LDAP access publicly available!

LDAP

ESMTP

Delivery Status Notification

Told delivered status by receiving system

Size limitations

Based on the MIME size of the message

Authentication

Inbound and outbound

STARTTLS

SSL between SMTP servers

DNS

MX records

Weighting

Controls the order in which hosts are tried to send an SMTP message (lowest first)

Useful to have a backup route into the system

Reverse lookup

GWIA will only accept messages that arrive from the correctly registered address for the domain

Have a valid PTR record for GWIA host

SMTP Port

The default port listened on is 25

Can be changed (Pre 6.5 SP2)

NetWare

edit sys:\etc\services

Windows

edit %SystemRoot%\system32\drivers\etc\services

Linux

/smtpport-xx

/smtpport is supported on NW and Win with 6.5 SP3

Deferred Messages

Messages are deferred if the destination is unreachable

In the first hour tries every 20 minutes

Then every 4 hours to the 'Maximum number of hours to retry a deferred message', the default is 96 hours.

Then returns a message undeliverable to the sender

Configuration Files

Gwia.cfg	Startup switches

Exepath.cfg	Path to the Gwia.cfg

Route.cfg	Routing overrides

Status.xml	Returned status messages

Preamble.*	Mime warning

Blocked.txt	Blocked IP sources

Mimetype.cfg	Content type mapping

Frgnames.cfg	Foreign names

GwAuth.cfg	SMTP host authentication

Exepath.cfg

Located in the domain\wpgate\gwia directory

Used by ConsoleOne® to locate the gwia.cfg file

The file must contain the path to the gwia.cfg file

NetWare :	sys:system

Windows :	domain\wpgate\gwia

Linux :	/opt/novell/groupwise/agents/share

or	\\server\opt\novell\groupwise\agents\share

c

Route CFG

Used to override any DNS entries for a destination

Ignore a relay host for some internal destinations

Some hosts are unknown to the DNS

Some destinations you may want to virus scan

Create the file in the domain\wpgate\gwia directory

Ensure that the last entry is followed by a carriage return

novell.com	gwia.novell.com

unixbox	[123.1.2.3]

Blocking Messages

Real time blacklists

SBL – Known Spam Sources

XBL – Transitory Spam relay sources

Can override by adding to the exceptions list

Blocked.txt

List of blocked sites

Created when editing access control

Can be edited manually with a text editor

bl.spamcop.net

www.spamcop.net

SpamCop

relays.ordb.org

www.ordb.org

Open Relay DataBase

blackholes.mail-abuse.org

www.mail-abuse.org

Mail Abuse Prevention System

Address

Site

Service

GWIA.CFG

Main configuration file

Used instead of startup switches

Most switches can be added through ConsoleOne

Can be modified manually

Accessed from the command line with

GWIA @<path to gwia.cfg>

c

Startup Switches/Settings

Can be used if you're using spamassassin or other anti-spam

solution. If the MIME header contains a field, x-spam-flag:yes,

the GWIA will flag the message to be handled by the

POA/Client junk mail handler.

/xspam

Has the GWIA convert between a text/calendar body and a GW appointment. Gives iCal support.

Not fully supported.

/imip

Startup Switches/Settings

If the message body is blank uses the embedded message.

Resolves the issue of a rule forwarding messages through the GWIA, where all messages come from the original recipient.

/flatfwd

If message if forwarded via a rule, it is sent with a	MAIL FROM:postmaster@mydomain

With this switch enabled, it is:

MAIL FROM:gwuser@mydomain

/realmailfrom

Startup Switches/Settings

Changes the LDAP listen port. This is to enable the GWIA and eDirectory LDAP to coexist if you want to leave eDirectory at the default LDAP port.

With 6.5.1 we added the capability for the GWIA to detect a x-priority field in the MIME header and create the GW message as high or low priority based on this field. GWIA also adds the field to outbound high or low priority messages. This switch turns off this feature.

/ldapserverport

/nomappriority

Startup Switches/Settings

Will force GWIA to immediately terminate any active SMTP threads on a restart.

GWIA will keep the distribution list name on the TO: line instead of expanding it.

/KillThreads

/keepsendgroups

Removes the display name in the address for outbound messages.

/notfamiliar

Startup Switches/Settings

Disables all ESMTP extensions, useful for troubleshooting if you suspect issues with a particular extension.

Forces 7bit encoding for all outbound mail. Should be used if you have a relay host that doesn't support 8BITMIME.

/noesmtp

/force7bitout

Disallows the First_Last addressing format.

/DontReplaceUnderscore

Startup Switches/Settings

The GWIA will not to create a full MIME file as a temp file for messages more than xxK. A MIME skeleton will be created, and attachments will be streamed directly from the message store.

Will let users see more than 4962 items per folder. Value for switch is set in thousands. Can use up server memory.

/imapsizelimit-xx

/imapreadlimit-xx

Enables support for the POA's intruder detect feature.

/popintruderdetect

Accounting Files

Logs all inbound and outbound traffic

Delivered to the accountant as a CSV file at midnight

Inbound/outbound

Sender

Priority

Message type

Account ID

Attachment count

Gives the following information

Date/time

Recipient

Subject

Message ID

Size

Recipient count

and others....

Monitoring

Console

Can view stats for SMTP/POP/IMAP and LDAP

HTTP monitoring

Browser based monitoring of the GWIA

Make sure that it is over SSL

GWMonitor

Visual representation that the Gateway is running

Multiple thresholds can be set

Security

Security

GWIA

MTA

Firewall

Public

Private

Avoid having direct connections from the Internet into the production Network

Port 25

DMZ Security

GWIA

MTA

MTA

DMZ

Private

Port 7100

Port 25

Public

Place the GWIA on its own domain in the DMZ

Ensure the server, if it is NetWare, is in its own tree

Virus/Spam Checking

V/C

DMZ

Public

GWIA

MTA

Private

Port 25

Port 25

Check before the GWIA

Place a virus checker/ relay in the DMZ

Virus/Spam Checking

Check between the GWIA and the MTA.

Examples: Guinevere and GeeWhiz

V/C

Public

GWIA

MTA

MTA

DMZ

Private

Port 7100

Port 25

MTA

Virus/Spam Checking

Check between one MTA and another MTA.

Examples: GWAVA

Public

GWIA

DMZ

Private

V/C

MTA

Port 7100

Port 25

MTA

Virus/Spam Checking

GWIA

MTA

MTA

DMZ

Private

Port 7100

Port 25

Public

Use an external virus checking organization.

Examples: MessageLabs

V/C

Access Control

Can be set for

Domain	• Post Office

User	• Distribution List

Can control

Incoming/outgoing SMTP

Maximum message size

Allow/deny messages to/from specific users/domains

Access to POP/IMAP

Stored in the gwac.db

Can be deleted if there are problems

Security

Relay

Disable, users can relay if they authenticate

Mailbomb

Enable mailbomb protection

SSL

If another site supports it consider using TLS

Enable for POP/IMAP

Enable for HTTP monitoring

Authenticating with AUTH LOGIN

Inbound

Need to use a valid GroupWise user and password

Outbound

Listed in GWAuth.cfg

domain_name1	authuser1	authpassword1

domain_name2	authuser2	authpassword2

Can be forced with

/forceinboundauth

/forceoutboundauth

Tips and Tricks

Improving Performance

Send and receive threads

The number of concurrent messages processed

The more threads more server resources used

Timings

Decrease the poll intervals for agent and daemon

Directories

Conversion and queue directories should be local

Increase the Maximum Packet Receive Buffers

NetWare only, use default setting with default threads

Passthrough

Provides GroupWise communication between

Separate GroupWise systems

GroupWise domains in the same system

Gives advantages

MTP not working with poor communications

A relay is required or the Firewall can not be opened

Configuration

Set up link configuration as gateway through the GWIA

Set the access string to the destination's DNS name

Aliases/Nicknames

Users can be known by other than the default names

Gateway alias

A user can only have one per gateway alias type

A GWIA instance can have only one alias type

Effects the return address on outbound mail

Try not to use

Use the override option on Internet Addressing

Nicknames

Can have more than one per user

Does not effect the return address on outbound mail

Schizophrenia

Users can have multiple inbound personalities

Multiple inbound iDomains

Multiple personalities from

Internet addressing	- Nicknames	- Gateway alias

But they only have the one outbound address

Resolution

Use multiple outbound GWIAs

Define different gateway alias types for each

Define gateway aliases as required

Use POP/IMAP accounts on client

Relay off GWIA

Using Non-GroupWise Domains

Used to simplify routing

Route messages to a specific GWIA

Used to simplify addressing

External users can appear in the system address book

Assign the user a public Internet address

Internet addressing override on the user or post office

Gateway alias can be assigned to the user or post office (old method – but can be imported)

External users can be given a corporate mail address

Undeliverable Messages

If unknown recipient

The 'Undeliverable or Problem Messages' setting does not effect undeliverable messages

'550 No such recipient' is returned to sending server

The Message is not placed in problem directory

Why?

Saves bandwidth and disk space

Use /FUT to redirect to a GroupWise 5.5 GWIA to place in a problem directory or send to a postmaster

Use nicknames to monitor addresses

Troubleshooting

Message Flow

Why understand the message flow

Know which component is causing a problem

Know which directories to find messages in

Message Flow

MTA

Message Flow

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

SMTP

Daemon

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

SMTP

Daemon

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

SMTP

Daemon

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

SMTP

Daemon

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

SMTP

Daemon

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

SMTP

Daemon

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

SMTP

Daemon

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

SMTP

Daemon

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

SMTP

Daemon

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Message Flow

SMTP

Daemon

Agent

MTA

GWIA

Wpcsin

Send

Results

Receive

Wpcsout

Troubleshooting

Telnet to the GWIA on port 25

Helo acme.com

Mail From:John@Acme.com

Rcpt To:John.Smith@Novell.com

Data

This is a test

.

Quit

SMTP Response Messages

Code

2xx

3xx

4xx

5xx

Status

Command succeeded

Command accepted but more information expected

Command failed, however the problem may be temporary. Retry later

Command failed

SMTP 420 Error

Errors

420 TCP Read Error

420 TCP Write Error

Traditionally

Communications problem

Poor cabling

MTU problems

Internet problems.

But today...

SMTP 420 Error cont.

420 – Caused by Anti-Spam rules

Disconnect by remote host due to;

Blacklisting

Graylisting

Unable to resolve a reverse lookup

No MX record

Refuse mail to:<> connections (RFC)

Troubleshooting

Problem messages are stored in the gwprob directory

Can be re-queued

Rename the .BAD file to .001 or other number extension

Open the message and determine if it is inbound or outbound

Modify the message, if required, to correct the problem

Move the message in the respective RECEIVE or SEND directory

These messages can be deleted without causing a problem

Troubleshooting

Third party directory

Separate send and receive directory used by daemon

Need to move mail between the directories

Receive

GWIA

Send

Results

Third

Send

Receive

Results

The Future

Sequoia Enhancements

Outbound redundancy

GWIA communicates to and from MTA via MTP

Can configure a “Alternate GWIA” for each GW domain

Run as “non-root” user on Linux

POA's threading model adopted for SMTP POP and IMAP

Support for IPV6

High availability for Linux

Conclusion

There is more to the GWIA than just SMTP

Ensure that your agent is secure

Monitor the Agent

What is the GWIA?

The GroupWise Internet Agent (GWIA) is the software that connects your GroupWise system to the Internet.

The GWIA achieves this by using a number of standard protocols.

GWIA

What is the GWIA?

LDAP

IMAP

POP

SMTP

What services?

Linux

Windows

NetWare

What Platforms?

What is SMTP/MIME

Simple Mail Transport Protocol

RFCs 2821 & 2822

7 bit US ASCII protocol

Plain text

Multipurpose Internet Mail Extension

Identifies the type of data in a file based on its extension

Allows you to send binary files as attachments

Is not encryption

Expands the message size by 33%

MIME

SMTP

Status messages

Return status messages can be generated for inbound mail

Delivered	• Opened	• Deleted

Optional Gateway settings

Outbound status level

Full	- Opened

delivered	- undelivered

None

Convert status to messages – Yes

Can be annoying

Setting Status Messages

Edit the Status<xx>.xml file in the GWIA directory

Can modify

Undeliverable Recipient	• Undeliverable Message

Deleted	• Delivered

Opened	• Transferred

Use

\t Tab	• \r Carriage return

\n Line feed	• %s original info

Save as Status.XML

Administrators

PostMaster

Receives messages sent to the post master

Can get problem messages

Accountant

Receives accounting file once a day

Operator

Receives warnings from the gateway

Can shut down the gateway with GWIA:shutdown

Pager Services

Allows a user to send messages to a paging device

Smart forwarding

Easy to read original header information

User block control

Configuration

Configure a foreign domain

Set the link to this domain through the GWIA

Set Gateway access string to –page

Users can send to pin@service provider

Use /l to set block length

Use /b options to set number of blocks

Pin /l=255 /b=4@service provider

Threads

Many threads that can be set

SMTP send	• SMTP receive

Inbound conversion	• Outbound conversion

POP	• IMAP

LDAP

Baseline the system and set appropriately

Usually the bottleneck is the Internet connection not the GWIA

Remember

ETRN and Scheduling

In the system but designed for dialup

Getmail.NLM and cron

www.3net.cz/software

Scheduling

Used with

ETRN

Other dial up (PSTN/ISDN)

Specify schedules based on the time of day

Size

Wait time

Number of messages

Internet Addressing

User’s can receive to multiple inbound addresses

Multiple Internet domain names

But user’s are only known by one outbound address

c

Startup Switches/Settings

Many options

Most can be set in ConsoleOne

DNS A record

MH

FUT

Internet mail view

Some have to be added by hand

/flatfwd

Dynamic Internet Links (1)

MTA to MTA connectivity between systems

No need to define the external system

No loss of functionality

Busy Search

Status tracking

Message retraction

Need to create

An address ("A") record that maps the MTA servers host name to its IP address.

A service ("SRV") record or a text ("TXT") record that maps the Internet domain name to the host name or IP address assigned to the MTA s server.

Dynamic Internet Links (2)

Need to enable the option on the MTA to send directly to external systems

Need Internet addressing enabled

Messages will not be virus checked if you use SMTP virus checking

Help Files

Can be used to give users help on using the GWIA

Create a directory called HELPRQST

Add help files to this directory

Mail to GWIA:help

Receive a mail message in return with the help documents

Why?

SMTP Response Messages

220 <domain> Service ready

250 Requested mail action okay, completed

354 Start mail input; end with <CRLF>.<CRLF>

450 Requested mail action not taken: mailbox unavailable

452 Requested action not taken: insufficient system storage

500 Syntax error, command unrecognized

501 Syntax error in parameters or arguments

503 Bad sequence of commands

550 Requested action not taken: mailbox unavailable

554 Transaction failed

An In-depth Look at the GroupWise Internet Agent

2003-12-08T12:43:39