Administrator's Guide - Kerio Software Archive

2.2 Conflicting software2.2 Conflicting softwareKerio MailServer runs on the application layer and there are not any known low-level conflictswith other software, operating system components or device drivers (except the antivirus thatis used to open files). If a received email message includes an infected attachment, the mailserver stores it into a temporary file on the disk. Antivirus might damage the disk or thesystem. To prevent your computer from such failure, configure your antivirus to not scan thefolder (or the disk) where Kerio MailServer data is kept (refer to chapter 17).A possible conflict is a port clash (if all services are running in Kerio MailServer, these TCPports are used: 25, 80, 110, 119, 143, 443, 465, 563, 993 and 995). It is therefore not recommendedthat users run other mail, LDAP or web server software on the same computer. If thisis necessary, the system administrator must ascertain that there will be no port clashes. Forexample, if Kerio MailServer is running on a computer together with a web server, we recommendchanging the HTTP service port or disabling the service and only enabling its securedversion — Secure HTTP. Another alternative is to reserve one or more IP addresses for portsat which Kerio MailServer services are listening. For detailed information on services and portsettings, see chapter 6.If Kerio MailServer is run on a firewall or on a secured local network behind a firewall, thefirewall will affect the mail server’s behavior to a certain extent (e.g. accessibility of some orall services). When configuring the firewall take into consideration which services should beaccessible from the Internet or the local network and enable communication on appropriateports (see above or chapters 6 and 26.3 for more detail).2.3 Firewall configurationKerio MailServer is usually installed in a local network behind a firewall. In addition to themailserver’s configuration, it is also necessary to perform corresponding additional settingsof the firewall.If the MailServer is to be accessible from the Internet, certain ports have to be opened (mapped)in the firewall. Each mapped port might introduce security problems. Therefore, map portsonly for those services which you want to make available from the Internet.If server is supposed to deliver email directly by DNS MX records, it is necessary to map port25 (standard port for SMTP service). This setting is required for cases where an MX record forthe particular domain is addressed to the server. Any SMTP server on the Internet can connectto your SMTP server to send email to one of its domains.Now, it is necessary to map ports that will be used for connections out of the local network.Since the security risk is higher here, it is recommended to map only SSL/TLS-secured services.Settings are shown in table 2.1.17