Clearswift SECURE Email Gateway 4.3.0 ReadMe

This release of the Clearswift SECURE Email Gateway provides a fully functional Adaptive Data Loss Prevention (A-DLP) solution, operating on the 64 bit platform of Red Hat Enterprise Linux 6.7. SECURE Email Gateway helps to prevent critical information data loss while protecting the intellectual property and brand of your organization.

New features in version 4.3.0

There are a number of new features included in this release:

• Additional Text Entites
• Support for SNMP monitoring of the system
• Enable SCOM monitoring of the system
• Peering with SECURE Exchange Gateway and SECURE Web Gateway 4.3
• Network console enhancements
• Reduced false positive rate of credit cards in Excel
• Improved detection of embedded objects in Office XML file formats

For more detail on these new features and how you can use them, see What's New in 4.3.0 in the online help.

Before you install the product

We strongly recommend that you follow the installation steps outlined in the Clearswift SECURE Email Gateway Installation & Getting Started Guide. These instructions enable you to install the Gateway correctly and safely.

If you are migrating from a previous version of the Clearswift SECURE Email Gateway, you must :

1. Apply any pending configuration.

2. Back up your system and latest configurations before installing.

Detailed instructions on backup and restore are available in the Installation & Getting Started Guide.

Download the Clearswift SECURE Email Gateway 4.3.0 Installation & Getting Started Guide

Installing the product

You can install the SECURE Email Gateway from the ISO image available for download in the Online Clearswift Repository.

Full installation instructions are provided in the Clearswift Gateway Installation & Getting Started Guide.

Upgrading from an earlier version 4 release to version 4.3.0

Perform the following steps to download and apply software updates when you upgrade to Clearswift SECURE Email Gateway 4.3.0

Open an SSH session and access the Clearswift Server Console. Log in using your cs-admin access credentials.

Online or Offline mode? Offline mode is designed for installations that operate in a closed environment, disconnected from the Internet. Unless this is a specific requirement for your system, you should install the Clearswift SECURE Email Gateway in online mode. To perform an offline upgrade you require a copy of the latest release ISO mounted to suitable media (DVD/USB). Please contact Clearswift Technical Support if you need additional guidance on how to complete this step.

If you have online repositories enabled, updates will be downloaded overnight (automatically). You can apply them immediately. You can also use the Check for New Updates button if you believe that there has been a recent security fix issued.

To apply software updates:

1. Select Configure System > View and Apply Software Updates > Apply Updates > OK from the Clearswift Server Console main menu.

2. Select Yes to confirm that you want to apply the updates.
   All downloaded updates will now be installed. This process can take several minutes. A rolling progress log will be displayed.

3. When the Operation Complete message appears, select Done to complete the install process.

At the end of the upgrade process, the system will prompt you to either reboot or log out. Follow the instructions on-screen.

Gateway services will restart automatically in either case.

Fixed Issues

This update includes the following fixes, which have been implemented since version 4.2.1

• Improvements in PDF and RTF handling

  A number of issues around the processing of PDF and RTF attachments have been fixed by this release. This includes the handling of XMP data and character encoding.

• LDAP query cannot select the OU if the text contains an apostrophe

  LDAP groups containing apostrophes were disabled in the query and returned an error: "The LDAP query failed, no such object" if entered manually.

  This issue has been resolved.

• Manager relationships out of sync using LDAP

  When setting up a manager relationship list to synchronise with LDAP, the displayed relationship list matches users with the wrong manager.

  Manager relationships are now correctly matched.

• Sender Policy Framework (SPF) checks do not work if primary DNS is unavailable

  SPFSender Policy Framework checks were not being performed by a secondary DNS if the primary DNS was not available. SPF checks now use the secondary DNS correctly.

• Greylist response not shared between peered Gateways (4.X to 3.8)

  The Greylist response was not shared between SECURE Email Gateways operating at 3.8 and 4.x.

  This issue has been resolved. Greylisting is now shared between 4.3 and 3.8 Gateways.

• Log reports "warning: 'jsvc' uses 32-bit capabilities"

  A message in the kernel logs warned that jsvc was running in legacy mode (32-bit). This resulted in low performance.

  JVSC is now correctly running in 64-bit mode.

• Installed packages not displayed on German systems

  The list of installed packages was not displayed on German systems. All packages are now displayed correctly for each locale.

• Umlauts and special characters not displayed in decryption summary

  Umlauts and special characters were not correctly rendered in the decryption summary text.

  Special characters are now correctly displayed.

• PMM Portal fails if the IP is changed following implementation

  Changing the IP address of a second ethernet device for PMM prevented access to the PMM Portal. This issue has been resolved. IP changes no longer cause PMM Portal failure.

• Japanese characters in a lexical rule cause message processing failure

  The system returned a Problem message alert: 'Processing failure: Engine failed to process the message' when Japanese characters were included in a lexical content rule. Lexical rules with Japanese characters now process mail correctly.

• Installation wizard does not validate licenses if the customer name contains symbols.

  If a customer name contained symbols, the license was returned as not valid by the Installation Wizard, and the Next button was disabled.

  This issue has been resolved. Licenses are now permitted to contain symbols.

• Unable to remove SNMP configuration

  Configured SNMP servers could not be removed. This release includes extensive changes to SNMP support, which is now configured using the Server Console. A configured SNMP server can be removed using the console.

• JRE contains multiple vulnerabilities

  This issue has been resolved.

• Unable to change the password for keystore

  This issue has been resolved.

Known issues

The following are known issues or limitations in this release:

• Increase in timed out messages

  Improvements made in this release to enforce configured message timeouts will cause the Gateway to time out messages earlier than it did in previous releases. This may lead to an increased number of messages timing out before the Gateway completes processing.

  What can I do?

  If you have a high number of messages that time out before the Gateway completes processing, you should increase the Gateway’s timeout threshold beyond the default time of 30 minutes. You can do this in Policy Engine Settings.

• Gateway Branding image does not support transparency

  Images that are uploaded via Gateway Branding for display on the login page of the Gateway do not support transparency. This issue will be addressed in a future version of the Gateway.

• Configuration areas of Email Gateway are lost following peering

  If you are installing a SECURE Exchange Gateway in a peer group with a SECURE Email Gateway, we strongly recommend that you do one of the following:

  • Peer the Gateways before customizing, or
  • Ensure that you add the Exchange Gateway as a peer of the Email Gateway. This ensures that any customization of the Email Gateway is preserved.
• PMM Portal cannot be configured on a remote peer

  You cannot configure a peered Gateway as a PMM Portal if the peered Gateway has no defined IP address. This is because the mechanism for configuring the IP address of each Gateway is now completed using the Server Console. No IP address is displayed as an option for the Portal if this has not been configured.

  What can I do?

  Configure the IP address of the Portal using the Server Console. See Networking Configuration for more information.

• Backup fails if path to backup location contains backslash (\) and does not exist

  If you specify a backup location with a forward slash (/) or no slash in the path name, then backup and restore will work without any issues. If the backup location you specify does not exist, then it will be created. However, if you specify a backup location with a backslash (\) in the path name, backup and restore will only work if that location already exists. If the location does not exist, then the backup will fail.

  What can I do?

  Replace all backslashes (\) with forward slashes (/) in the path name.

• FTP timeout means FTPS backup not available to restore

  Backup over FTPS to a Windows FTP server might be reported as successfully completing, but no files (only folders) are stored on disk. This then results in a warning: There are no backups in that folder when attempting a restore. One initial symptom of this issue is the backup process taking longer than expected.

  What can I do?

  If your backup is taking considerably longer than expected, it is possible that no files are being backed up. We recommend:

  1. Checking your FTP server for the files you are expecting to be uploaded.
  2. Checking the FTP log for multiple time out errors: FTP error: Read timed out

  One possible cause of the file transfer failure is a Microsoft known issue. If your files are not backed up and the backup log has reported time-out errors, please refer to https://support.microsoft.com/en-us/kb/2888853

• HTTPS selection for PMM Digest in Lite Mode

  It is not possible to provide HTTPS links in PMM digests in Lite mode. This is expected behavior.

• Gateway configuration not updated when removing IP address or network adapter using Server Console

  When using Server Console to change your network configuration settings, Server Console is unaware if a Gateway configuration references a particular network adapter or IP address. For example, if PMM references a network adapter or IP address.

  What can I do?

  When disabling network adapters and deleting or changing IP addresses in Server Console, you should update the Gateway configuration immediately after if these network adapters or IP addresses were in use by the Gateway.

• FIPS mode not initiated correctly by Gateway Installation Wizard in IE10

  When completing the Gateway Installation using IE10 as the web browser, FIPS mode is not initiated as expected. The FIPS Mode check box is cleared when the Next button is clicked.

  What can I do?

  Upgrade your web browser to IE11 or use a different browser (Chrome or Firefox 38) to complete the Gateway Installation Wizard.

Product version end of life

Note the following end of life information:

• Clearswift SECURE Email Gateway 4.1.0 started end of life process on 22 March 2016 and will not receive technical support after 22 March 2017
• Clearswift SECURE Email Gateway 3.8.0 started end of life process on 22 March 2016 and will not receive technical support after 22 March 2017. An additional year is available as a cost option. Please contact Clearswift Support for further information.
• All previous versions have reached end of life.

For more details, see the End of Life statement.

Contact information

For contact details, information on product updates and other products, see the Clearswift Website.

Revision 1.0 November 2017

Published by Clearswift Ltd.

© 1995-2017 Clearswift Ltd

All rights reserved

The materials contained herein are the sole property of Clearswift Ltd. No part of this publication may be reproduced or disseminated or transmitted in any form or by any means electronic, mechanical, photocopying, recording, or otherwise stored in any retrievable system or otherwise used in any manner whatsoever, in part or in whole, without the express permission of Clearswift Ltd.

Information in this document may contain references to fictional persons, companies, products and events for illustrative purposes. Any similarities to real persons, companies, products and events are coincidental and Clearswift shall not be liable for any loss suffered as a result of such similarities.

The Clearswift Logo and Clearswift product names are trademarks of Clearswift Ltd.

All other trademarks are the property of their respective owners. Clearswift Ltd. (registered number 3367495) is registered in Britain with registered offices at 1310 Waterside, Arlington Business Park, Theale, Reading, Berkshire RG7 4SA, England. Users should ensure that they comply with all national legislation regarding the export, import, and use of cryptography.

Clearswift reserves the right to change any part of this document at any time.

Copyright © 1997-2017 Kaspersky Labs, 10 Geroyev Panfilovtsev St., 125365 - Moscow, Russian Federation. The Kaspersky Logo and Kaspersky product names are trademarks of Kaspersky Labs.

Copyright © 2000-2017 Sophos Limited. All rights reserved. Sophos is a registered trademark of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

Licensed under US Patent No:5,623,600

Protected by UK Patent 2,366,706

The software allows Clearswift to collect certain data from you regarding spam and other unwanted emails. Clearswift will use this information to improve its service to you (defined as the "Support Service") in the license agreement. Clearswift will use all information provided in accordance with the license agreement and Clearswift's stated privacy policy which can be found at http://www.clearswift.com/about-us/legal-information.