Configuring the eperi Milter app

How to configure the eperi Milter app.

1. Connect to the target server using your preferred SSH tool (e.g. Putty) and log in.
2. Edit the main configuration file /etc/eperi/milter/config.properties and adjust the following parameters:

   Parameter	Explanation
   eperi_gateway	The location of your eperi sEcure Platform, please only adjust the hostname, the URI is fixed.
   listener_class	Listener Class in the eperi sEcure Platform. Keep the preconfigured value.
   appname	Name of the Salesforce app as configured in the Admin Console of your eperi sEcure Platform installation. For example:
   outbound_header_key	Mail header key to detect outbound emails. The value for Salesforce is X-SFDC-LK. Keep the preconfigured value.
   outbound_header_value	Mail header value to detect outbound emails. This value varies depending on the Salesforce instance. A simple way to determine the value is as follows: Send out an email (ungated) to your email address and just get the value from the email header. E.g. in Outlook open the email and click File > Properties. In the Properties pop-up that opens, the header is displayed in the Internet Headers text box at the bottom.
   outbound_header_rules	As an alternative to configuring outbound_header_key and outbound_header_value you can create a rule based on multiple criteria to identify outbound emails. Please note the following regarding the rule syntax: It can be compared if an object field equals (==), not equals (!=) or given Regular Expression matches (=~) to a certain string value. Examples: X-MS-Exchange-CrossTenantid ==\"value\", X-MS-Has-Attach != \"value\", From =~ \".*postmaster@tenantname.onmicrosoft.com.*\". Note: More information on how Regex works can for example be found and tested here: Regex 101 Comparisons can be connected by AND (&&) or OR (||). Connected comparisons can be grouped with parentheses. Example: (X-MS-Exchange-CrossTenant-id == \"value\" && X-MS-Has-Attach == \"value2\") || X-MS-Exchange-CrossTenant-id == \"value3\" A group can be negated with a ! as prefix. Example: !(X-MS-Exchange-CrossTenant-id == \"value\" && X-MS-Has-Attach == \"value2\")

3. Optionally, adjust some of the optional parameters in the config.properties file.
4. Save and exit the config.properties file.
5. Due to the default SSL/TLS configuration of the eperi sEcure Platform Admin Console (from release 20.9.1.0), it is necessary to import the pre-configured TLS certificate (or your own certificate) into the truststore of the eperi Milter app as follows:
   Important: This will only work if the eperi sEcure Platform and the eperi Milter app are installed on the same machine and the eperi sEcure Platform can be accessed by the name 'localhost' which is the hostname included in the preconfigured SSL/TLS certificate. Otherwise a certificate matching the hostname of the eperi sEcure Platform machine has to be created and imported.
   1. Get the SSL keystore and password from the server.xml file (Port 8443 Connector).
   2. List the content of the keystore file (and search for the alias name):

      keytool -v -list -keystore /path/to/keystore.p12 | grep -i alias

   3. Export the certificate by alias name:

      keytool -export -alias <alias> -file <certname>.cer -keystore /path/to/keystore.p12

   4. Depending on your version of eperi Milter app, import the certificate to one of the follwing trust stores.
      1. For Milter version < 21.14.1.0: Import the previously exported certificate into the Java Truststore used by the eperi Milter app:

         keytool -import -alias <new_alias> -keystore /opt/eperi/milter/java/jre/lib/\
                                                 security/cacerts -file <certname>.cer

         When prompted for the password of the Java Truststore, enter changeit.
      2. For Milter version >= 21.14.1.0: Import the previously exported certificate into a new PKCS#12 keystore and place it under /etc/eperi/milter/custom_truststore.p12. As password for the newly created keystore specify changeit
         Note: If the eperi Milter app finds a custom truststore in the above location it will use this truststore, otherwise it will use its default Java Truststore.
         Note: Unlike the Java Truststore, the custom truststore will not be overwritten during an upgrade of the eperi Milter app.
6. Restart the eperi Milter app service:

   service eperi-milter restart

   Note: If a problem occurs during setup, please check the log file out.log in the directory /var/log/eperi/milter.