Removed Functionality in OpenAM 10.0.1

OpenAM 10.0.1 was released late last week. This is not OpenAM 10.1 Xpress, do not be confused. :)

With this release, the following functionalities are removed:

1. OpenAM 10.0.1 does not include the amtune command.

2. OpenAM console only mode is no longer supported. Console only mode is likely to be replaced with a different solution in a future release.

3. The Test Beta Console has been removed. Its functionality is currently available through the ssoadm command.

4. OpenAM no longer includes the SafeWord and Unix authentication modules.


Will they be missed? No. :)


.

Email Forwarding Tracking for Administrator

There is a nice feature in OpenMail.SG that is worthed mentioning - Email Forwarding Tracking for Administrator.

Some of our corporate customers asked for this feature. We thought over it and asked ourselves "Why Not?".

This is a feature that allows administrators to track the forwarded email addresses.

Note that only privileged users (usually the HR or Security teams or the Business Owners) will be allowed this feature.

There are some corporate rules that disallow employees to forward their emails to external parties. Thus this feature allows the administrators to quickly identify employees who might have accidentally forwarded to non-intended parties.

OpenMail Architecture - Part II

This is going to be an exciting week. We are ready to port all our customers to Sun Java Communications Suite 7.

See our old OpenMail Architecture here.

Below is our new OpenMail Architecture for Comms Suite 7.

The new components are:

1. Calendar Server 7

1. Index and Search Server running on top of Glassfish Enterprise Server

2. MySQL database server for Calendar 7

The layers are getting thicker with every new release of Comms Suite. :)

UWC behavior

On most occasions when the configuration is set correctly, the UWC (Communications Express) should render just fine like the one shown below:

At times, the following will be observed (with Mail tab missing):

When will this happen? There are a few likely cases:

1. Mail Host is set incorrectly

2. local.webmail.sso.uwcenabled has not been enabled

3. service.imap.enable has not been enabled (Webmail requires IMAP connections)

Weird UWC behavior

A customer wanted to host a new domain with our OpenMail.SG service today.

As per normal, creating a new domain via Sun Java Delegated Administrator is easy. However, after a new user was created, I was not able to log into UWC (Communications Express - Webmail).

It kept displaying "Login failed" even though I was 100% sure the credential is correct.

So I went to investigate the http log:

[12/Oct/2009:19:01:34 +0800] openmail httpd[844]: Account Notice: [192.168.0.60:50051] Access to smime service for test@ABC.sg denied from client address (mailAllowedServiceAccess)

[12/Oct/2009:19:01:34 +0800] openmail httpd[844]: General Notice: Received login referral for test@test.openmail.sg: IMAP://mail.ABC.sg/

[12/Oct/2009:19:01:34 +0800] openmail httpd[844]: General Notice: Received login referral for test@test.openmail.sg: IMAP://mail.ABC.sg/

[12/Oct/2009:19:01:34 +0800] openmail httpd[844]: General Notice: Received login referral for test@test.openmail.sg: IMAP://mail.ABC.sg/

[12/Oct/2009:19:01:34 +0800] openmail httpd[844]: General Warning: More than 2 referrals received for test@ABC.sg. Ignoring

[12/Oct/2009:19:01:44 +0800] openmail httpd[844]: Account Notice: close [192.168.0.60:50051] [unauthenticated] 2009/10/12 19:01:34 0:00:10 1493 1492 0

[12/Oct/2009:19:02:18 +0800] openmail httpd[844]: General Error: Failed to parse IMAP response at offset 52: F NO Server hosting this mailbox is not available

F OK Completed

SMIME service? What's that? We do not offer SMIME to our customer, nor do we configure any during setup.

I spent more time investigating why... I must say that the SMIME error message was misleading... The actual problem lies in the last statement:

[12/Oct/2009:19:02:18 +0800] openmail httpd[844]: General Error: Failed to parse IMAP response at offset 52: F NO Server hosting this mailbox is not available

F OK Completed

I revisited Delegated Administrator again. Oops! I made a blunder. I have actually entered a wrong Mail Host.

What is EMS?

The company that I work for offers EMS ("Enterprise Messaging System") with OpenMail.SG branding. 

OpenMail.SG is a corporate mail hosting provider. It offers an affordable hosted solution in a secured environment.

Dell, in recent years, acquired MessageOne. Coincidentally, they offer EMS as well. But it stands for Email Management Services.  

Horizontal Scalability of Address Book Server

We are in the midst of setting a new set of servers for our OpenMail.SG hosting. By the way, OpenMail is a corporate mail hosting service based on Sun Java Communications Suite.

One of the components of Sun Java Messaging Server is the Address Book Server. 

The Address Book Server is nothing but a tree in the same LDAP server which the Communications Suite uses.

 

So I was discussing with my colleague how to to scale the Address Book Server when the mail accounts increase.

It is pretty simple if we take a look at a sample user entry as shown below:

# entry-id: 3858
dn: uid=abc, ou=People, o=openmail.sg,o=isp
uid: abc
userPassword: {SSHA}xHb17CklmBxtaqa517+9P4rqAmS9KzMw9W3iAg==
initials: SA
mail: abc@openmail.sg
inetUserStatus: active
mailUserStatus: active
mailQuota: -1
mailMsgQuota: -1
psRoot: ldap://ldap.openmail.sg:389/piPStoreOwner=abc,o=openmail.sg,o=Pi
ServerDb

There is this ldap attribute "psRoot". This indicates where the Address Book Server is for this particular user account.

So to scale horizontally, it is as simple as:

1. setting up a new LDAP server 

2. migrating the o=PiServerDB tree

3. changing the user entry to point to the new LDAP server

Read more here and here.

Sun Enterprise Messaging Reference Architecture

As I have mentioned before and we have also explicitly highlighted on OpenMail.SG web page:

OpenMail.SG is probably the only Singapore's corporate mail hosting company using Sun Java Communications Suite.

Now, what makes us confident about using Sun Java Communications Suite? 

Well, our team has deployed numerous Sun Messaging solutions in the south-east asia region. Some are for telecos/ISPs; some are for the banks; while others are for government agencies. The minimum mailbox size is of the thousands. 

It's stable and scalable.

Customers might also be wondering whether or not the entire suite is constructed based on best practices.

 

Besides being experienced on-the-ground, we constantly update ourselves with the latest Sun product roadmaps and new technologies.

We follow the Sun Enterprise Messaging Reference Architecture closely.

We know what we are doing. :) Customers have their peace of mind. 

PS: An old copy of the Reference Architecture in PDF can be found here.

What is Sun Convergence?

In my post OpenMail.SG - rebrand, I talked about what our customers really want for their webmail access. 

Along the years, we gave them SquirrelMail. Then we tried Horde. Last year, when we ported over to Sun Java Communications Suite, we offered 2 types of webmail to them - Communications Express and Sun Convergence. 

There's no turning back since. 

So what is Sun Convergence? I have been receiving queries on this. 

Sun Convergence is an AJAX based communications web client. Convergence provides a user access to Mail, Calendar, Address Book, and Instant Messaging services.

Still dun understand? Ok, in layman term, AJAX is something that you can drag and drop over the web browser like what you would do using a email client like Thunderbird or Outlook Express. And more ... of course.

More screenshots can be found here. 

If your organization requires a mail hosting solution, talk to us. We have an experienced team well-versed with Sun Messaging technology. I'm reachable at cheechong @ azimuthlabs.com.sg or you can contact our OpenMail.SG staff directly at info @ OpenMail.SG.

OpenMail.SG - rebrand

I met up with a friend few days back. I told him our OpenMail.SG has a new look-and-feel. It's a rebranding exercise to attract even more customers.

He asked about the business model of OpenMail.SG. In brief, I told him we are no different from what Gmail or Yahoo provides, except:

1. We are a phone-call away (especially for the non-technicals);
2. We provide mostly for the Singapore corporates (especially for the SMEs);
3. We know our product (we are the Sun product specialists)

We need to be a little different and we better be best in our differentiators.

We believe the pie is always big enough for everyone.

Even with tough competition from Google Apps, there is a segment where customers still prefer personal service ("warm" phone call, rather than "cold" email correspondences).

We also concentrate our effort in the Singapore SME (Small-Medium Enterprises) market. This is the market that requires a service provider that can explain the various technologies in simpler terms for them. (You'll be surprised they do not even know what "domain name" means)

Lastly, we know our product! We have been providing Professional Services on behalf of Sun Microsystems for the past 5 years. We are especially strong in Portal, Messaging and Identity.

We could have easily provide our customers with Fedorda/SendMail/SquirrelMail combination. ROI would have be much higher. However, we are not value-adding to our customers.

That is why we deploy what we think is best-of-breed product for our customers - Solaris/Sun Java System Communications Suite. (which comes with 2 choices of Webmail - Communications Express or Sun Convergence).

More costly setup but if this is what our customers are looking for, we are game for it!

A happy customer will refer 2 more potential customers ... and the maths continues ....

MessageLabs TLS support

I continued to read up more on TLS following up with my customer's query. I know their solution is fronted with MessageLabs Anti-Spam/Anti-Virus Filtering Service. 

So in order to turn-on TLS on Sendmail to receive in-coming mails, I need to find out whether or not MessageLabs supports TLS communication.

Yes, it does. Read here.

MessageLabs is using this bombastic term - Email Boundary Encryption Service (End-to-End TLS Email Encryption). Wow!

Oh ya, forget to mention, you need to pay extra for this service. Nothing is free in this world. :)

Symantec Registration Server is down - Cannot imagine!

I was trying to install an evaluation copy of Symantec BrightMail Message Filter. The final step to get it run for 30-days trial was to register the eval-copy.

[root@mail bin]# /opt/symantec/sbas/Scanner/sbin/register.sh

Please enter the path to a valid license file: /tmp/13311525.slf

Connecting to Brightmail. This may take a few minutes.

Unable to communicate with Symantec to register. Please check your connection settings, and try again.

Registration Server returned: 503 Service Unavailable

I blogged and found out that the Registration Server URL is register.brightmail.com. So I thought maybe my machine could not resolve the FQDN.

[root@mail bin]# nslookup

> register.brightmail.com

Server: 192.168.0.54

Address: 192.168.0.54#53

Non-authoritative answer:

Name: register.brightmail.com

Address: 216.250.24.63

Name: register.brightmail.com

Address: 143.127.103.14

> exit

Hmm... it was able to resolve.

I could not believe this is happening. So I double-check using my browser.

OpenMail Architecture

Some people have asked for an architectural diagram of our OpenMail.SG solution. Here we go:

Key Features

• Flexible 2nd layer of anti-spam/anti-virus hosted security protection (Google Postini, TrendMicro IMHS, IronPort, MessageLabs)
  
• Mobile Synchronization (Sun Java Mobile Communications Server)
  
• Calendar Access (for Premium customers)
• WebMail Access

Logical Component Diagram as below:

Why TrendMicro IMHS is dropped? -Review 2!!

Looks good... The daily Quarantine Summary is coming.... Finally!

Why TrendMicro IMHS is dropped? -Review!!

In my 3rd post on why TrendMicro IMHS was dropped, I mentioned the importance of visibility of the quarantined messages, especially in a hosted security solution. 

I still cannot believe that TrendMicro's hosted security solution is that bad, because I have very good impression of their technical support when my previous company used OfficeScan Client-Server Suite.

I must admit TrendMicro technical support is one of the better ones. 

So, I decided to conduct a review. 

I was saying the end-user Message Center was always empty for a particular user who we are very sure that his account receives a lot of spam emails daily. 

Yesterday, I log into the Administrator Console again. I clicked on Policy and bingo! I then realized most of the Action have been set to "Delete", by default, including Spam or Phish. No wonder no quarantined email was found for that user. 

So I went ahead to modify the Action from "Delete" to "Quarantine".

This morning, I checked the Message Center again. Yeah! The quarantined emails are shown.

Hmm... now I am left wondering why Spam or Phish emails are deleted by default. It's back to "Opt-In or Opt-Out" rule. I would say for emails, it should be a Opt-Out, rather than Opt-In. Why do you say?

Google Postini Service

We use Google Postini Service for our hosted security. It has been running for months. Today, Postini caught the 1st virus email. ( Should I say - finally? :> )

Anyway, catching the virus aside, what I like about Postini is how user-friendly it is. It's telling me my incoming email transaction daily. It's providing a high-level of transparency, which is what is required for any hosted service. 

Dedicated channel for outgoing email

The company I work for provide Corporate Email Hosting service - OpenMail.SG.  This is a hosted environment with backend being Sun Java System Messaging Server. 

Recently, a customer broadcasted tons of emails for her marketing campaign. All of us were affected. Urgent emails are queued along with the marketing emails (which are of lower priority). 

We received complains from other customers on the same hosted environment. That's bad for business. We need to resolve this issue!

We re-looked at the MTA architecture.  

The bottle-neck is at tcp_local channel. This is where emails get routed out to the Internet. We need to create a dedicated channel for the Broadcasting Application. It happens that this application is hosted with us in a standalone machine with a dedicated IP address.

Hmm... this makes our job easier.. In fact, the MTA architecture diagram already gives us a hint. It has a dedicated channel tcp_sesta channel that handles mails to be delivered to sesta.com domain. 

We only need to change the requirement slightly. It's fairly simple. We want a dedicated channel tcp_bc that accepts mails from a fixed internal IP address that can deliver emails to the Internet, without affecting tcp_local channel.

Here's what we did:

mappings

Define a new mapping for the Broadcasting Application IP address in mappings.

BC_IP

  w.x.y.z  $Y

  *  $N

imta.cnf

Add new rewrite rule in Domain Rewrite Rules section.

!

$* $F$E$U%$H@tcp_bc-daemon$Mtcp_bc

Add new mapping lookup for internal IP addresses.

! tcp_intranet

! Do mapping lookup for internal IP addresses

[] $E$R${BC_IP,$L}$U%[$L]@tcp_bc-daemon

[] $E$R${INTERNAL_IP,$L}$U%[$L]@tcp_intranet-daemon

Define a new channel tcp_bc 

(It's actually cut-and-paste-and-modify from tcp_local)

! tcp_bc-daemon

tcp_bc smtp mx single_sys remotehost inner switchchannel identnonenumeric subdirs 20 maxjobs 7 pool SMTP_POOL maytlsserver maysaslserver saslswitchchannel tcp_auth missingrecipientpolicy 0 loopcheck

tcp_bc-daemon

Once done,

bash-3.00# /opt/sun/comms/messaging/sbin/imsimta cnbuild

bash-3.00# /opt/sun/comms/messaging/sbin/imsimta restart job_controller

bash-3.00# /opt/sun/comms/messaging/sbin/imsimta restart dispatcher 

Why IronPort and Red Condor are dropped?

We wanted to evaluate Cisco IronPort Hosted Email Security, but they did not give us the chance. I was initially thrilled when I saw on their website "Try Before You Buy". I applied twice. No luck!



Our company policy is as such: Before we recommend a product to our customers, we'll evaluate internally first. The criteria is simple:

1. Product capability and suitability
2. Customer/Support service experience
3. Pricing

Notice that we are very particular about service experience before any recommendation is made. If the experience with the pre-sales or sales is no good, we do not even proceed further. We are always against spending money on vendors who do not give a dime on customer service experience.

Honestly speaking, there are far too many comparable products out there in the market. The ones that support our customers best, we'll stick our heads with them. (even if their pricing might be the highest)

So, what about Red Condor? Why did we drop it?

Below is the email respond from Red Condor's Director Channel Management:

Regarding your reseller application: Red Condor is not currently signing resellers in Asia. We are in the process of reviewing this decision and to approach partners throughout Asia as we are expanding internationally.

It's a matter of presence. Red Condor is a relatively young company with main focus in the US/Europe markets. I think it will take them a couple of years before they get serious with the booming Asia market.

.

Why TrendMicro IMHS is dropped? -Reason 3

There must be visibility of the messages that are quarantined, especially in a hosted security solution. Otherwise, customers do feel uneasy. (This is really a feedback from our customers)

And this is something we look out for in evaluating a good hosted security product. Our company offers OpenMail. It is a secure-hosted environment for corporate customers. Internally, we subscribe to Google Postini Service for our own domain. We allow our customers to choose any hosted security product of their choice, if they want to have that extra layer of protection.

What we like about Google Postini Service is a daily Quarantine Summary email which each of us will receive.

If any of us detects that a genuine email has been detained, a simple click on "Deliver" will instruct Postini to deliver that email to our mailbox. There is also a Message Center for each user to manage his/her own quarantined emails.

In TrendMicro IMHS, there is this very nice Quarantines Settings module. Initially, it was not enabled, so we did not receive any Quarantine Summary email. However, even after we enabled it, we still receive nothing from IMHS. (Is it because we are testing with Free Trial account? We do not know why.)

Even when we log in as Administrator, there is no quarantined message being displayed for a particular user account which, we know for sure, receive lots of spam each day.

Yes, this particular user account does receive lesser spam when IMHS is activated during the trial period. However, if the visibility is not there, customer will never feel at ease.

Why TrendMicro IMHS is dropped? -Reason 2

In terms of look-and-feel, TrendMirco IMHS leaves a very good first impression.

Google Postini Service can never compete in terms of look-and-feel. Or rather, Google has never been bothered too much with slick design. They place their focus on functionalities instead.

For example, in IMHS, there is no way for administrator to know how many accounts he has created so far. I can understand that it's convenient for a CSV upload utility. It's helpful and most welcomed. However, after importing, there must be an intuitive way to show the list of imported users.

Google Postini Service's experience, again, is vastly different. A list of user accounts is shown distinctly. What's more? There is a way to adjust anti-spam for different categories (Sexually Explicit, Get Rich Quick, Special Offers, Racially Insensitive) at per-user level.

For each category filter, there is a way to set a base level (from Lenient to Aggressive).