Barracuda Spam Firewall FAQ
The Physics Department has installed a new spam-filtering system made by
Barracuda Networks. The following
are the answers to some frequently asked questions about this new system.
How does it work?
The Barracuda Spam Firewall is a stand-alone computer dedicated to
running programs that filter out spam and viruses from our e-mail. All
mail arriving at the Physics Department first passes through this
filter. A variety of schemes are used to test mail. First, the mail is
compared to a "blacklist" of known spammers. Most spam originates from a
relatively small number of hard-core spammers, and many of their mail
servers are tracked by anti-spam services, who publish these blacklists.
Similarly, most spammers send the same message to millions of
recipients; this makes it possible to "fingerprint" bulk mailings and
then test our incoming mail against that fingerprint. Finally, and most
powerfully, the system employs Bayesian statistical analysis of every
recipient's own e-mail to distinguish good mail from bad. The system
will actually learn the difference between your own personal valid
e-mail and your spam.
Every incoming piece of e-mail is assigned a score based on these tests.
Mail assigned exceptionally high scores is certainly spam and is
"blocked", that is, it is simply deleted. Mail that is probably, but not
certainly, spam is saved, but "quarantined" on the spam filter. The
remaining mail is probably all valid and is passed on to the mail server
for delivery.
When you have quarantined mail, the spam filter will send you an e-mail
notification. This notification includes a link to the filter's web
page, where you can review the suspected spam and/or customize the
filter to your own tastes. This web page is at
http://barracuda.phys.ksu.edu:8000. The first notification that you get
from the filter will include your username and password for the system.
The username is just your e-mail address. You can (and should) change
your password the first time that you log in.
The filter web page will display all of your quarantined mail. You can
teach the filter the difference between good mail and bad by clicking on
the checkboxes next to the messages in question, and then clicking
either the "Spam" or "Not Spam" button. If a piece of mail is one that
you expect to receive regularly (such as a message from a mailing list),
you may click "Whitelist" to permanently exempt that sender from being
filtered. Finally, you may then click on either "Delete" or "Deliver" to
remove the spam or allow a good message to proceed.
I still see some spam, so is this thing working?
Yes. As described above, the Barracuda spam appliance uses many methods
for detecting spam, but it can take some time for the machine to learn
what kind of mail we want and what we consider spam. Some spam may also
have leaked through the system during the time that it took us to deploy
the system.
Am I losing any legitimate e-mail?
No. We have configured the filter such that only very worst sorts of
spam are "blocked" and deleted at the filter (and, in fact, even this
cesspool will be examined by the system administrators during the first
few weeks of operation to guarantee accuracy). All other questionable
mail is "quarantined" for your review. No legitimate mail should be
blocked. The real question is whether there any good e-mail being
quarantined. By default, you will be notified daily of any quarantined
mail; you may change this to weekly notification (or turn it off
altogether). When you visit the filter's web page, you may see some good
e-mail quarantined. If you do, check the box in front of the message and
press the "Not Spam" button (as described above). This will help train
the system. Then press the "Deliver" button and the mail will be
delivered to your inbox.
If spam still gets through to my Outlook inbox, what do I do?
You have two options. First you can just delete them, or you can install
an Outlook plug-in that lets you classify the message as "Spam" or "Not
Spam" with the push of a button. Note that you must have administrative
privileges to install this plug-in.
How do I find the Outlook plug-in?
Go to the Barracuda login page
(
http://barracuda.phys.ksu.edu:8000 ); at
the bottom of the page is a link to the software. You will need to be an
administrator to install it, but once installed it works for everyone
that uses that machine. JRM users can simply contact
Vince about this.
How much spam does the Physics department really get anyway?
As of October of 2004, about 82% of the e-mail messages received by the
Physics Department are spam. That is about 16,000 spam messages a day.
Can I get to my quarantine box or preferences from outside of Cardwell
Hall?
Yes, the Barracuda web pages can be reached form anywhere.
What if I forgot my password or username for the Barracuda?
Your username on the Barracuda is always your Physics e-mail address
(username@phys.ksu.edu). If you have forgotten your password go to
http://barracuda.phys.ksu.edu:8000 and enter your username, then click
the "Create New Password" button. A new password will be e-mailed to
you.
Other Questions?
Please contact the
Physics Computer Support Center
(pcschelp@phys.ksu.edu);
JRM personnel may also contact
Vince.