Configuring the eperi Milter app

How to configure the eperi Milter app.

1. Connect to the target server using your preferred SSH tool (e.g., PuTTY) and log in.
2. Edit the main configuration file /etc/eperi/milter/config.properties and adjust the following parameters:

   Parameter	Explanation
   disableCertificateVerification	When set to true, a custom certificate can be used that doesn't include localhost as its SAN. The default value is false.
   disableHostnameVerification	When set to true, Milter can be connected from another non-local host. The default value is false.
   eperi_gateway	The location of your eperi sEcure Platform, please only adjust the hostname, the URI is fixed: Note: If SSL is not yet configured in your eperi sEcure Platform then please adjust this URL accordingly. https://<yourgateway.de>:8443/onASConsole/ca/default/james
   listener_class	Listener Class for Microsoft 365 in the eperi sEcure Platform. Configure this value: de.eperi.ca.o365.mail.Office365PlainTextEMailModificationService
   appname	For Microsoft 365 configure this value: ___defaultappname
   outbound_header_key	Mail header key to detect outbound emails. Configure the header name defined in the previously created rule: Adding a custom header to outgoing e-mails
   outbound_header_value	Mail header value to detect outbound emails. Configure the header value defined in the previously created rule: Adding a custom header to outgoing e-mails
   outbound_header_rules	As an alternative to configuring outbound_header_key and outbound_header_value you can create a rule based on multiple criteria to identify outbound emails. Please note the following regarding the rule syntax: It can be compared if an object field equals (==), not equals (!=) or given Regular Expression matches (=~) to a certain string value. Examples: X-MS-Exchange-CrossTenantid ==\"value\", X-MS-Has-Attach != \"value\", From =~ \".*postmaster@tenantname.onmicrosoft.com.*\". Note: More information on how Regex works can for example be found and tested here: Regex 101 Comparisons can be connected by AND (&&) or OR (||). Connected comparisons can be grouped with parentheses. Example: (X-MS-Exchange-CrossTenant-id == \"value\" && X-MS-Has-Attach == \"value2\") || X-MS-Exchange-CrossTenant-id == \"value3\" A group can be negated with a ! as prefix. Example: !(X-MS-Exchange-CrossTenant-id == \"value\" && X-MS-Has-Attach == \"value2\")
   remove_outbound_headers	Enter outbound email header rows to be removed after having been processed by the eperi Milter app, comma-separated. In case of a Docker-based Milter-Deployment, please use MILTER_REMOVE_OUTBOUND_HEADERS as parameter.
   remove_inbound_headers	Enter inbound email header rows to be removed after having been processed by the eperi Milter app, comma-separated. In case of a Docker-based Milter-Deployment, please use MILTER_REMOVE_INBOUND_HEADERS as parameter.
   tokenizeAddresses	If activated, the original addresses in an email are replaced with the addresses returned by the Gateway as part of the encrypted or decrypted email. This setting is only required if you use the Microsoft Bookings app. The default value is false.

3. Optionally, adjust some of the optional parameters in the config.properties file.
4. Save and exit the config.properties file.
5. Due to the default SSL/TLS configuration of the eperi sEcure Admin Console (from release 20.9.1.0), it is necessary to import the preconfigured TLS certificate (or your own self-signed certificate) into the truststore of the eperi Milter app as follows:
   Note: If you are using an official SSL/TLS certificate from a trusted CA for the eperi sEcure Admin Console you may skip this step.
   Important: Adding the preconfigured SSL/TLS certificate will only work if eperi sEcure Platform and the eperi Milter app are installed on the same machine and eperi sEcure Platform can be accessed by the name 'localhost', which is the hostname included in the preconfigured SSL/TLS certificate. Otherwise, a certificate that matches the eperi sEcure Platform hostname has to be used and imported.
   1. Get the SSL keystore and password from the server.xml file (Port 8443 Connector).
   2. List the content of the keystore file (and search for the alias name):

      keytool -v -list -keystore /path/to/keystore.p12 | grep -i alias

      Note: To export the certificate from gateway's preconfigured keystore, please provide the default password changeme.
   3. Export the certificate by alias name:

      keytool -export -alias <alias> -file <certname>.cer -keystore /path/to/keystore.p12

   4. Import the previously exported certificate into a new PKCS#12 keystore and place it under /etc/eperi/milter/custom_truststore.p12.

      keytool -import -alias <new_alias> -file <certname>.cer -keystore \
      /etc/eperi/milter/custom_truststore.p12

      Important: The password for the newly created keystore has to be set to changeit

      Note: If the eperi Milter app finds a custom truststore in the above location it will use this truststore, otherwise it will use its default Java Truststore.

      Note: Unlike the Java Truststore, the custom truststore will not be overwritten during an upgrade of the eperi Milter app.
6. Restart the eperi Milter app service:

   systemctl restart eperi-milter

   Note: If a problem occurs during setup, please check the log file out.log in the directory /var/log/eperi/milter.