MailMarshal Secure Email Server

Version: 5.7, Last Revision: December 13, 2012

These notes are additional to the MailMarshal SES User Guide and supersede information supplied in that Guide.

The information in this document is current as of the date of publication. To check for any later information, please see M86 Security Knowledge Base article Q12026.

What's New
Installation Notes
Upgrading MailMarshal SES
Uninstalling
Hardware and Software Requirements
Change History

What's New

See the Change History for additional minor features and bug fixes.

Features New in MailMarshal Secure Email Server 5.7

Updated Operating System Requirements: Version 5.7 server components must be installed on Windows 2008 (SP2) or Windows 2008 R2. See the Hardware and Software Requirements section for a complete list of supported Operating Systems and Service Packs.
Updated SQL Server Version Support: Version 5.7 supports SQL 2008 and 2012 for Reporting and Certificate databases. SQL 2000 is no longer supported. See the Hardware and Software Requirements section for a complete list of supported versions.
Updated Encryption Algorithm Support: Support for SHA2 and AES algorithms.
Updated Secure Email Rule conditions: Detailed options are available when checking for certificate errors (for incoming and outgoing encryption processing). A new condition allows detailed checking of certificate errors for message signing.

Features New in MailMarshal Secure Email Server 5.6

MailMarshal SES (Secure Email Server) is a SMTP content analysis server, specifically designed to implement S/MIME encryption and signing functions.

Installation Notes

For installation scenarios, see the User Guide.
You can install MailMarshal SES as a standalone gateway.
To implement a full Email Content Security gateway, use MailMarshal SES in combination with MailMarshal SMTP (6.4.5 or above).

Upgrading MailMarshal SES

MailMarshal SES 5.7 does not support direct upgrade of server components from version 5.6. You must migrate to the new operating system.
This requirement is due to the encryption algorithm update, which is only available on Windows 2008.
Migration instructions are provided in the Installation chapter of the User Guide.

Upgrade/Migration notes

In version 5.6, a default rule Failure - Unable to Encrypt - Certificate is Invalid was incorrectly included in the "Outgoing SMIME Policies" This rule could cause incorrect behavior if enabled.
- In version 5.7 this rules is not included in new installations; however it would be present in an upgraded installation. You should not enable this rule and you may wish to delete it.

Uninstalling

You can cleanly uninstall the program as follows:

Make sure that all the services have been stopped including the SES Controller.
Close all Console and Configuration programs.
From the Windows Add/Remove Programs control panel, select MailMarshal SES, and select remove.
To delete a MailMarshal SES Certificate database, from a command prompt enter:
d:\>osql -U sa
Password:
1> drop database MarshalSESCertStore
2> go
Deleting database file 'C:\MSSQL7\data\MarshalSESCertStore.mdf'.
Deleting database file 'C:\MSSQL7\data\MarshalSESCertStore_log.LDF'.
1> exit
Substitute the database name used in the example above with the name of your database. You may have two databases, one for Certificates and one for Logging/Reporting.
You may need to delete additional files from the original install path that have been created subsequent to the install by hand.
If you have installed MailMarshal SES Reports or SQL Express, you can uninstall this software from the Windows Add/Remove Programs control panel.
If you have installed components on other workstations, remove them using the Windows Add/Remove Programs control panel on each workstation.

Hardware and Software Requirements

Hardware Required for MailMarshal SES Server

MailMarshal SES will run on any recent hardware designed for server installations. Hardware requirements naturally vary depending on the number of email users, the amount of email traffic, and other software that may be installed (such as MailMarshal SMTP or SQL with large reporting databases). The following minimum specifications are suggested as a guideline:

1,000 users: Dual core 2Ghz, 20 GB HD free, 3GB RAM
10,000 users: 4 cores 2.4 GHz, 100GB HD free, 4GB RAM

Sites with more than 10,000 users may require enhanced hardware. MailMarshal SES supports multi-processor computers and various array implementations for very high traffic sites. Please contact M86 Security for a recommended configuration.

Note: MailMarshal SES will not accept new messages if there is less than 100MB of free disk space available in the disk partitions where its working directories reside.

MailMarshal SES server components require the following software

Windows Server 2008 SP2 or Windows Server 2008 R2.
SQL Server or SQL Express for the certificate database, and for logging if required.
- The minimum SQL version requirements are: SQL 2005 SP4; SQL 2008 SP1; SQL 2008 R2 RTM; SQL 2012 RTM.
If you want to integrate MailMarshal SES with MailMarshal SMTP using the "Return to Sender" delivery method, you must use MailMarshal SMTP 6.4.5 or above.

MailMarshal SES Client Tools (Configurator, Console, Reports) requires

Windows 2008 SP2
Windows 2008 R2
Windows 7
Windows Vista
Windows XP SP3 (deprecated)

Notes:

The MailMarshal SES installation will attempt to install some prerequisites if they are not present. It is however recommended that you install the pre-requisites prior to MailMarshal SES so as to isolate any installation issues to the specific package.

Change History

5.7.2 (December 13, 2012)

MMS-162	In release 5.7.0, the SES-specific performance counters were not available. Fixed. To resolve issues with the counters after upgrade, see Q15044.
MMS-164	Upgrading caused logging to be disabled due to an issue reading database credentials. Fixed.
MMS-165	Importing an invalid configuration could leave the installation in an unusable state. Fixed.
MMS-166	The "Active Sessions Total" performance counter did not decrement when a connection was closed. Fixed.

5.7.1.9707 (November 28, 2012)

MMS-159	Additional Rule Conditions have been added for Secure Email Rules to allow detailed checking of certificate errors when encrypting, decrypting, or signing a message.
MMS-160	Connecting to a SES 5.6 installation with a 5.7 Configurator could leave configuration in an unusable state. Fixed: Connecting from a mismatched Configurator is no longer allowed.
MMS-163	The micalg header was not set correctly for messages signed with sha-2 algorithms. Fixed.

5.7.0.9686 (September 3, 2012)

MMS-79	The Encryptor was checking the database for expired CRLs every 10 seconds. Fixed: the recheck time is now 1 minute.
MMS-100	The Configurator encountered an error when attempting Copy/Paste actions on certificates from the Harvesting folder. Fixed: Only Cut and Paste is allowed.
MMS-125	In version 5.6, upgrading between minor versions failed. Fixed.
MMS-127	MailMarshal SES now supports AES-128, AES-192, and AES-256 encryption algorithms (when using Windows 2008 and Microsoft Enhanced RSA and AES Cryptographic Provider v2).
MMS-129	The Receiver service could incorrectly detect that the mailbox name was too long (more than 255 characters). Fixed.
MMS-130	MailMarshal SES now supports SHA-2 algorithms (SHA-256, SHA-384, and SHA-512).
MMS-133	The MMEncrypt service did not generate a notification when deadlettering a message. Fixed.
MMS-138	Version 5.7 supports upgrade or migration from version 5.6.

5.6.0.5716 (August 8, 2010)

Initial release