Performa Anti-Spam Update nicht moeglich mit ISA Server und NTLM + Basic authentication

The anti-spam module doesn’t update if there is an ISA server with NTLM + Basic authentication

Symptoms

• The Anti-spam module cannot be updated if there is an ISA server 2000 with NTLM authentication on the network. When Cloudmark authenticates with a Proxy of these characteristics, it first attempts to update without using authentication. Then it retries it using Basic authentication.The ISA Server 2000 proxy servers close the connection after the first attempt, and then it unsuccessfully retries using the same method over and over again.

Version

• Panda GateDefender Performa 8200 series (Portwell); Panda GateDefender Performa 8100 series (Supermicro)

Sollten Sie dieses Problem innerhalb Ihrer Topology reproduzieren koennen so kontaktieren Sie uns bitte. Wir werden Ihnen kurzfristig einen Hotfix zu verfuegung stellen.

GateDefender 3.00.00: New FAQs

The following web FAQs have been added to the GateDefender Performa/series 8000 Knowledge Base at the official Supportsite:

1. System profile ‘how-to’ guides: Defining an LDAP group exempt from the Web filter.
2. System profile ‘how-to’ guides: Defining a local group exempt from the Web filter.
3. System profile ‘how-to’ guides: Defining a company user exempt from the outbound SMTP anti-malware scan.
4. System profile ‘how-to’ guide: Defining a user exempt from the SMTP Anti-malware scan.
5. System profile ‘how-to’ guide: Applying a specific configuration to connections with a specific source and target subnet.
6. System profile ‘how-to’ guides: Resolving ambiguities between profiles and trusted sites.
7. System profile ‘how-to’ guides: Resolving ambiguities between profiles and blacklists.
8. System profile ‘how-to’ guide: Resolving ambiguities between profiles and white lists. 
9. System profile ‘how-to’ guide: Define a group of websites using specific content-filter settings

[tags]gatedefender,performa,gd3.0,faq[/tags]

Gatedefender Cloudmark Updateverhalten

Gatedefender ab der Version 3 enthalten die bekannte Cloudmark Engine zur Spamerkennung. Die Spamerkennungssignatur wird Gatedefenderintern zusaetzlich ueber die von Cloudmark bereitgestellten Micro-Update Fingerprints aktuell gehalten. Hierzu wird eine TCP Verbindung zum Host microupdates.cloudmark.com hergestellt. Der Gatedefender versucht diese Kontaktaufnahme HTTP basierend zuerst auf dem Standartport fuer HTTP (80). Schlaegt dieser Versuch fehl so wird eine Kontaktaufnahme HTTP basierend auf dem SMTP Port (25) initiert.

!!! Es handelt sich NICHT um einen Versuch eine eMail zu versenden !!!

Cloudmark Micro-Updates

Micro-updates is the mechanism that allows the Cloudmark Cartridge to regularly download the latest fingerprint data used to identify abusive messages. The fingerprint data is provided by highly trusted reporters and analysis by the Trust Evaluation System in the Cloudmark Collaborative Security Network in near real-time. Therefore, proper use of the micro-update mechanism is critical in maintaining cartridge accuracy as new types of spam, phishing, and virus messages are reported.

Network interaction

Micro-updates are downloaded using standard HTTP requests. If an HTTP proxy is not enabled, then at the specified interval, a download will be attempted over port 80. If the filtering server is unable to connect to the Cloudmark micro- updates service on port 80, it will attempt to download on port 25. If this also fails, the most recent offline version of the data file in the micro_updates directory will be used until the next micro-updates interval before attempting to download again.

[tags]gatedefender,gd3.0,cloudmark[/tags]

Gatedefender Performa Version 3 freigegeben

Alle von Panda Security Deutschland vertriebenen Gatedefender der Perfoma Serie werden ab sofort in der Version 3 ausgeliefert. Bestandskunden koennen ueber die unten aufgefuehrten Downloadlinks das Update selbststaendig durchfuehren.

WICHTIG: NACH EINEM UPDATE VON DER VERSION 2.x auf die VERSION 3 IST KEIN ROLLBACK MEHR MOEGLICH!

Screenshot des neuen Webinterfaces

Changelog

• Definitions: It is now possible to define in the console a series of items and groups of items such as IP addresses, domains and users –to be used in profiles-, and LDAP or Active Directory sources, as well as servers that validate against them.
• Settings and profiles: Until this version, there was only one configuration for the Performa protection, which applied to all the traffic that passed through it. Now it is possible to define multiple configurations to profiles that can correspond to LDAP users, IPs, domains or mail addresses.
• Quarantine: Malware, spam and content-filter quarantine configuration.
  Viewing of the items stored in quarantine, and the option to take actions on them: deleting and restoring items, redirecting mail, scanning malware items, sending suspicious or non-disinfectable items to Panda, downloading items and excluding them from the malware quarantine.
• P2P and instant messaging application filter: Configuration of P2P and instant messaging application filtering. New graphs in the status and activity screens. Data reported by the protection in reports along with Web filtering.
• Diagnosis tools: Tools for diagnosing network problems. Including connectivity to Panda, ping, traceroute, DNS resolution, appliance network status and packet capture. All with multiple execution options.
• Advanced configuration tools. Configuration through the console of those advanced parameters that Panda technical services used to edit manually accessing via ssh.
• Hotfix installation: Hotfixes can be installed through the console. Hotfixes installed are displayed.
• New drop-down menu to aid access to all sections of the console through sub-menus.
• Graph scale: The scale of the graphs can now be adjusted, because previously, when the maximum value on a graph was very low, variations were imperceptible.
• Importing lists from internal domains: Now it is possible to import a list of internal domains from a file using the Web console.

Anleitung zum Update finden Sie hier in unserem Blog.

Downloadlinks

• DVDISO zum Download
  http://pandatechnik.de/86
• CDISO (Supermicro)
  http://pandatechnik.de/143
• Hotfix Pack 3.00.00.0100
  http://pandatechnik.de/89
• Hotfix 3.00.00.0101 (Race Condition Fix fuer GD8200) 
  http://pandatechnik.de/90

[tags]gatedefender,3.0[/tags]