Overview

In order to increase the security level of your Kerio Connect installation, it's required to configure certain security control settings. To prevent repeating dictionary attacks from the multiple sender hosts, you can restrict communication on the firewall side; enforce a strong password and security policy; enable DKIM and Anti-spoofing protection; configure the data encryption.

Configuring Your Firewall

If you install Kerio Connect in a local network behind a firewall, map these ports as follows:

By using IP Address Groups, you can define a list of IP addresses that can access a particular service. For instance, if there are only selected users in the company that uses IMAP (Internet Message Access Protocol) or POP (Post Office Protocol), you can allow access only to these users' IP addresses. You can also limit the maximum number of concurrent connections.

Please note that Kerio Connect does NOT have any built-in firewall, therefore does not have a built-in capability of blocking specific IPs that are attempting to spam the Kerio mailserver. This task would fall in the scope of the firewall that is sitting in front of Kerio Connect.  The lack of a built-in firewall is complemented with the additional security features detailed in the next sections.

Back to top

Password Policy

• Read the Password policy in the Kerio Connect article for detailed information on user passwords.
  Note: please do NOT store passwords as a plain text in Description or any other Public-accessible field.
  

Back to top

Configure a Secure Connection to Kerio Connect

Kerio Connect can do either of the following:

• Secure user authentication.
• Encrypt the whole communication.

Go to Configuration > Security > Security Policy to select your preferred security policy.

You can define a group of IP addresses that can authenticate insecurely (e.g., from local networks).

Securing User Authentication

If you select the Require secure authentication option, users must securely authenticate when they access Kerio Connect.

You can select any of the following authentication methods:

CRAM-MD5 — password authentication using MD5 digests. DIGEST-MD5 — password authentication using MD5 digests. NTLM — use only with Active Directory. SSL tunnel — if no authentication method is used.

If you select more than one method, Kerio Connect performs the first available method.

If the users' passwords are saved in the SHA (Secure Hash Algorithm) format:

• Select PLAIN or LOGIN.
• Do not map users from a directory service.

Check out Enforcing SSL and Encrypted Communication in Kerio Connect for more information.

Back to top

Authenticating Messages with DKIM

DomainKeys Identified Mail (DKIM) signs outgoing messages from Kerio Connect with a unique signature to identify the sender. The users take responsibility for the messages they send, and the recipients are sure the messages came from verified users (by retrieving their public key).

For more information please refer to Configuring DNS for DKIM in Kerio Connect.

Back to top

Enabling Anti-Spoofing

Although it is not part of the Kerio Connect Anti-Spam filters, the anti-spoofing feature prevents spammers from "spoofing" your email address and pretend their messages are sent from you. A typical example in a Kerio environment (if this feature is not enabled) is that users can send messages as other users, even without delegation, when using mail clients that can modify the From address field, like Microsoft Outlook.

This feature implements Sender Identify, which users must authenticate with to be able to send an email using any of the local domain and the users are only allowed to send an email from the following addresses:

• The user's email address.
• The email address of groups they are a member of.
• The aliases to their email addresses.
• The aliases to public folders they can access.
• The email address of users who granted them a delegation.

If the email does not meet the conditions above, then Kerio Connect will block it as a spoofed message. It is important to note that this feature will only prevent your domain from being spoofed. Kerio Connect has other means of detecting if an incoming email comes from a spoofed sender.

Anti-Spoofing can be enabled from the following settings:

• From Security > Sender Policy:
  
  

• Or under Domain > Security:
  
  

Back to top

Data Encryption

Enabling Encryption

You can configure Kerio Connect to encrypt user settings, logs, system configurations, and messages saved to the disk.

1. In the Kerio Connect administration interface, go to Configuration > Advanced Options > Store Directory.
2. Go to the Data Encryption section.
   
   

3. Key-in the Password and re-enter to confirm the same.

4. Click Encrypt and confirm the action.
   
   Note: during Encryption initialization, the Kerio Connect service is restarted.

Disabling Encryption

To decrypt data and disable encryption:

1. In the Kerio Connect administration interface, go to Configuration > Advanced Options > Store Directory.
2. Go to the Data Encryption section.
   
   

3. Click Disable.
4. Key-in the Password set while encrypting and confirm the action.

Troubleshooting

For any encryption-related issues, it's recommended to enable Data Encryption in Debug logs:

Encrypting User Communication

If you select the Require encrypted connection option, clients connect to any service via an encrypted connection (the communication cannot be tapped).

• Check out Enforcing SSL and Encrypted Communication in Kerio Connect for more information. 

Back to top

Related Articles

• Antivirus and Content Filters
• Blacklists and Caller ID
• Sender Policy Framework and Greylisting
• Securing the SMTP Server
• Kerio Connect: Anti-Spam Advanced Filter

Back to top