hackerbruecke.net

amavisd

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:57:55 +0000

AmaVisd-new /etc/amavis/amavisd.conf: use strict; # a minimalistic configuration file for amavisd-new with all necessary settings # # see amavisd.conf-default for a list of all variables with their defaults; # see amavisd.conf-sample for a traditional-style commented file; # for more details see documentation in INSTALL, README_FILES/* # and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html # COMMONLY ADJUSTED SETTINGS: # @bypass_virus_checks_maps = (1); # uncomment to DI…

config

anonymous@undisclosed.example.com (Anonymous) — Mon, 27 Dec 2010 16:20:41 +0000

eGroupWare Version 1.4.001 pre-requisites: * required PHP version 4.3+ (recommended 5+) * php.ini: safe_mode = Off * php.ini: magic_quotes_runtime = Off * php.ini: register_globals = Off * php.ini: memory_limit >= 16M * php.ini: max_execution_time >= 30

slapd_conf

anonymous@undisclosed.example.com (Anonymous) — Mon, 27 Dec 2010 16:20:43 +0000

/etc/openldap/slapd.conf # The database configuration parameters must appear *after* the "database" # directive, as DB_CONFIG files are 'per backend'. dbconfig set_cachesize 4 0 1 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 dbconfig set_lg_dir /var/log # Automatically remove log files that are no longer needed. dbconfig set_flags DB_LOG_AUTOREMOVE # # Setting set_tas_spins reduces resour…

relayhost

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:56:33 +0000

Postfix configuration for a relayhost (MX) / Anti-SPAM-/UCE-settings smtpd (smtp + daemon) = server = Postfix receives mail from a client smtp = client = Postfix sends mail to another mailserver used Ports: 10023/tcp: postgrey 10024/tcp: amavisd-new 10025/tcp: policyd-weight

openssl_ca

anonymous@undisclosed.example.com (Anonymous) — Mon, 27 Dec 2010 16:20:44 +0000

simple OpenSSL Certficate Authority Create Certificate Authority station7:/etc # station7:/usr/share/ssl/misc # ./CA.sh -newca CA certificate filename (or enter to create) Making CA certificate ... Generating a 1024 bit RSA private key .....++++++ .....................................++++++ writing new private key to './demoCA/private/./cakey.pem' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your c…

ldap_secure

anonymous@undisclosed.example.com (Anonymous) — Mon, 27 Dec 2010 16:20:43 +0000

TLS and LDAP over SSL (ldaps) Modifying /etc/openldap/ldap.conf Modify / append the TLS-settings: #--- SSL/TLS setting ---# TLSCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP TLS_CACERT /etc/ssl/certs/ca_cert.pem TLS_CERT /etc/ssl/certs/station7_cert.pem TLS_KEY /etc/ssl/private/station7_key.pem TLS_REQCERT demand

config

anonymous@undisclosed.example.com (Anonymous) — Sat, 06 Apr 2024 16:56:19 +0000

Postfix smtpd (smtp + daemon) = server = Postfix receives mail from a client smtp = client = Postfix sends mail to another mailserver Edit /etc/postfix/main.cf queue_directory = /var/spool/postfix command_directory = /usr/sbin daemon_directory = /usr/libexec/postfix mail_owner = postfix smtpd_banner = mail.example.org myhostname = mail.example.org myorigin = example.org mydestination = mail.example.org mynetworks = 127.0.0.0/8, 10.0.0.0/8 alias_maps = hash:/etc/aliases, ldap:virtualaliases…

spamassassin

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:58:39 +0000

SpamAssassin SA-config-genarator: /etc/mail/spamassassin/local.cf: # SpamAssassin config file for version 3.x # NOTE: NOT COMPATIBLE WITH VERSIONS 2.5 or 2.6 # See http://www.yrex.com/spam/spamconfig25.php for earlier versions # Generated by http://www.yrex.com/spam/spamconfig.php (version 1.50) # How many hits before a message is considered spam. required_score 5.0 # Encapsulate spam in an attachment (0=no, 1=yes, 2=safe) report_safe …

config

anonymous@undisclosed.example.com (Anonymous) — Mon, 27 Dec 2010 16:20:41 +0000

Apache SSL (https) A special thing for getting Apache2 starting withaut user-interaction is also to store a decrypted key, since without Apache will ask at every start for the password... mv /etc/ssl/private/station7_key.pem /etc/ssl/apache2/private/station7_secure-key.pem openssl rsa -in /etc/ssl/private/station7_secure-key.pem -out /etc/ssl/apache2/private/station7_decrypted-key.pem

config_test

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:55:27 +0000

Postfix-Konfiguration testen Die Postfix-Konfigurtation sollte auf alle fälle vor der Produktivnahme ausgiebig getestet und das Verhalten beobachtet werden! Test von main.cf und master.cf Test der Datei- und Verzeichnisrechte, sowie die Syntax von main.cf und master.cf von Postfix:

temper1

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:59:45 +0000

Temperaturmessungen mit dem TEMPer1 USB sensor Vor einiger Zeit begann ich zuhause mir einen kleinen Serverraum einzurichten - mein Datenklo ;-). In diesem Serverraum sollte natürlich auch die Raumtemperatur mit Icinga oder Nagios überwacht werden. - Natürlich gibt es verschiedene quasi out-of-the-box Lösungen, wie z.B.

fully_encrypted_debian

anonymous@undisclosed.example.com (Anonymous) — Sat, 23 Sep 2017 22:25:30 +0000

Full disk encryption with LUKS (inklusive /boot) Referenzen: * * * * * *

postgrey

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 16:02:27 +0000

Greylisting For a overview what greylisting does, have a look at www.greylisting.org/ There are several greylisting daemons for Postfix available. I stick to David Schweikert's Postgrey or to Lionel Bouton's SQLgrey in combination with it's web-interface http://www.vanheusden.com/sgwi/ Postgrey Postgrey greylisting daemon

config

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:52:33 +0000

Cyrus imapd / popd Modify /etc/cyrus.conf to: START { recover cmd="ctl_cyrusdb -r" deliver cmd="ctl_deliver -r" } SERVICES { imap cmd="imapd" listen="imap" prefork=0 # imaps cmd="imapd -s" listen="imaps" prefork=0 pop3 cmd="pop3d" listen="pop3" prefork=0 # pop3s cmd="pop3d -s" listen="pop3s" prefork=0 sieve cmd="timsieved" listen="sieve" prefork=2 # entry must be the same as in th…

postfix_secure

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:56:23 +0000

Postfix with TLS and SSL (smtps) Use a portscanner like „nmap“: station7:/etc/init.d # nmap localhost | grep smtp 25/tcp open smtp -> smtp is only running at port 25! TLS Modify the TLS-settings in /etc/postfix/main.cf #--- SSL/TLS setting ---# smtpd_client_restrictions= permit_tls_clientcerts, permit_sasl_authenticated smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, permit_tls_clientcerts, reject_unauth_destination, check_sender_access hash:/etc/…

sasl

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:56:42 +0000

SASL A very conveniant way of configuring the Simple Authentication and Security Layer (SASL) is to use the Pluggable Authentication Modules (PAM), since it can use diffrent authentication sources like ldap or /etc/passwd - thus SASL is everything but simple

hardware

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:46:57 +0000

2014-06-17 zuerst „Debian OS-Basis-Installation auf Blech“ durchfuehren!!! zusaetzlich „auf dem Blech“: ### Proxy der UKBW fuer die Installations-Shellsitzung setzen: export http_proxy="http://proxy01.ukbw.de:3128/" ### LiHAS GPG-Key importieren:

spf

anonymous@undisclosed.example.com (Anonymous) — Tue, 16 Apr 2024 03:02:52 +0000

SPF Standards für das „Sender Policy Framework (SPF)“: RFC 7208 und RFC 7372 v SPF-Version Kennzeichen das einen TXT-Eintrag als SPF-Eintrag identifiziert. z.B. v=spf1 Mechanismen (immer am Ende des Eintrags aufführen!) a: DNS-A-Eintrag z.B. a:example.com ptr: DNS-PTR-Eintrag (reverse Zone) z.B. ptr:example.com all alle zur Domain gehörigen Hostst z.B. -all mx: abweichender Mailexchanger z.B. mx:mail.example-abc.com ip4: Angabe einer oder mehrerer IPv4-Adressen z.B. ip4:192.100.1…

smtp-authentication

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:56:50 +0000

SMTPd- / SMTP-authentication SMTPd-authentication SASL must be configured! in /etc/postfix/main.cf: smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous broken_sasl_auth_clients = yes smtpd_recipient_restrictions = ... permit_sasl_authenticated

commserv

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 15:00:45 +0000

This documentation is work in progress, no liability for correctness can be given! Communications-Server Motivation Because I had to look for a log time around the Internet, asking a lot of questions on mailing-lists, reading books and talking to friends for configuring my commserv, thus having quite a bit of hassle getting things working, I'd like give my experiences back to the comunity.

dmarc

anonymous@undisclosed.example.com (Anonymous) — Tue, 16 Apr 2024 03:04:34 +0000

DMARC Standards für „Domain-based Message Authentication, Reporting and Conformance (DMARC)“: RFC 7489 DMARC dient dem Reporting von E-Mail-Kommunikation und ist eine ergänzende Maßnahme zu den Verfahren DKIM und SPF. Im Folgenden sind die gängigen Tags aufgeführt, die in DMARC (TXT)-Records verwendet werden:

gosa_secure

anonymous@undisclosed.example.com (Anonymous) — Mon, 27 Dec 2010 16:20:43 +0000

force GOsa using ldaps Change the server-configuration in the „location“-section of /etc/gosa.conf from: server="ldap://localhost:389" to: server="ldaps://localhost:636" tls="true"

pam

anonymous@undisclosed.example.com (Anonymous) — Mon, 27 Dec 2010 16:20:43 +0000

/etc/ldap.conf (for PAM) # # This is the configuration file for the LDAP nameservice # switch library, the LDAP PAM module and the shadow package. # # Your LDAP server. Must be resolvable without using LDAP. host 127.0.0.1 # The distinguished name of the search base. base dc=example,dc=com # The LDAP version to use (defaults to 3 # if supported by client library) ldap_version 3 # Hash password locally; required for University of # Michigan LDAP server, and works with Netscape # Directory Ser…

cyrus_secure

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:52:44 +0000

TLS, IMAP over SSL (imaps) and pop3 over SSL (pop3s) TLS Modify / append the TLS-settings in /etc/imap.conf: #--- SSL/TLS setting ---# tls_ca_path: /etc/ssl/certs tls_ca_file: /etc/ssl/certs/ca_cert.pem tls_cert_file: /etc/ssl/certs/station7_cert.pem tls_key_file: /etc/ssl/private/station7_key.pem

ssh-smtp-tunnel

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:57:08 +0000

SMTP-over-SSH-Tunnel Um zwei SMTP-Server (z.B. Mailserver im Heim-Netz zu Mailgateway bei Provider/Hoster) sicher miteinander zu verbinden, gibt es verschiedene Möglichkeiten. OpenVPN-Tunnel Eine Möglichkeit ist, ein OpenVPN-Tunnel zwischen beiden Servern.

tipps

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:57:25 +0000

Postfix Tipps und Tricks Mails aus Mailqueue löschen alle Mails des Benutzers station7@example.com aus der Mailqueue löschen: mail:~# mailq | tail -n +2 | grep -v '^ *(' | awk 'BEGIN { RS = "" } { if ($7 == "station7@example.com") print $1 }' | tr -d '*!' | postsuper -d -

dnssec

anonymous@undisclosed.example.com (Anonymous) — Tue, 16 Apr 2024 03:00:36 +0000

DNSsec mit Bind9 Standards für die „Domain Name System Security Extensions (DNSSEC)“: RFC 4033, RFC 4034, RFC 4035, RFC 5011 und RFC 5155. Entropie zur Schlüsselgenerierung Um genügend Entropie für die Erzeugung der Schlüssel zur Verfügung zu haben, sollte z.B.

desktop

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:46:23 +0000

2013-12-27 fuer Desktops zusaetzlich: kde-full lightdm-kde-greeter alsamixergui amarok audacity audacity-data bc chromium-browser / chromium chromium-browser-l10n / chromium-l10n chromium-codecs-ffmpeg-extra cifs-utils clusterssh cryptsetup cryptsetup-bin cups cups-browsed cups-bsd cups-client cups-common cups-daemon cups-filters cups-ppdc dnsmasq duplicity ethtool fuse gnupg gnupg-agent gnupg2 gpgsm gpgv hplip hplip-data hplip-gui htop ifupdown / ifupdown-scripts-zg2 keepassx kgpg libre…

tipps

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 15:00:06 +0000

SED-Tipps Kommentare mit # und Leerzeilen herausfiltern: sed -e '/^#/d' -e '/^$/d' Kommentar entfernen, bei dem ausschliesslich Leerzeichen oder Tabulatoren vor der Raute stehen: sed -e '/^*#/d' -e '/^$/d' Eingabe-Datei > Ausgabedatei Löschen aller Zeilen, die höchstens Leerzeichen beinhalten:

ldap_conf

anonymous@undisclosed.example.com (Anonymous) — Mon, 27 Dec 2010 16:20:43 +0000

/etc/openldap/ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. # 21.07.2006, chhaas BASE dc=example,dc=com URI ldap://127.0.0.1 ### #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never #--- SSL/TLS setting ---# TLSCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+SSLv2:+EXP #TLSCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP TLS_CACERT /etc/ssl/certs/ca_cert.pem TLS_CERT /etc/ssl/certs/station7_cert.pem TLS_KEY /e…

lightsquid

anonymous@undisclosed.example.com (Anonymous) — Fri, 15 Aug 2014 20:45:40 +0000

Lightsquid-Tool your access.log look slightly different from standart. may be you use CUSTOM log record. at and of standart record in you log you has addition field look like: [User-Agent: TMhtload/1.32.00.1008\r\nAccept: */*\r\nHost: cm-t.activeupdate.trendmi

sarg

anonymous@undisclosed.example.com (Anonymous) — Fri, 15 Aug 2014 20:46:20 +0000

SARG /etc/crontab: ### SQUID-Monitoring via Sarg: 00 06-19/1 * * * root /usr/local/chhaas-skripts/sarg-reports.sh today > /dev/nul 00 00 * * * root /usr/local/chhaas-skripts/sarg-reports.sh daily > /dev/nul 00 01 * * 1 root /usr/local/chhaas-skripts/sarg-reports.sh weekly > /dev/nul 30 02 1 * * root /usr/local/chhaas-skripts/sarg-reports.sh monthly > /dev/nul

spf

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:56:59 +0000

Postfix und das Sender Policy Framework (SPF) Das Sender Policy Framework - früher auch Sender Permitted From genannt -, soll das Fälschen des email-Absenders in einer E-Mail auf SMTP-Ebene erschweren. Mithilfe eines SPF-Generators, z.B. oder

monitoring

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:58:04 +0000

Monitoring email-monitoring * create „/var/lib/rrd“ Mailgraph mailgraph is a very simple mail statistics RRDtool frontend for Postfix that produces daily, weekly, monthly and yearly graphs of received/sent and bounced/rejected mail (SMTP traffic).

ldap

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:55:50 +0000

using LDAP /etc/postfix/ldap-aliases.cf: server_host= ldaps://localhost:636 server_port= 636 start_tls = no tls_ca_cert_file = /etc/ssl/postfix/certs/ca_cert.pem tls_ca_cert_dir = /etc/ssl/postfix/certs/ tls_cert = /etc/ssl/postfix/certs/station7_cert.pem tls_key = /etc/ssl/postfix/private/station7_key.pem #tls_random_file = dev:/dev/urandom tls_cipher_suite = ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP version= 3 bind= no timeout= 120 search_base= dc=example,dc=com query_filter = (&(object…