hackerbruecke.net

relayhost

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:56:33 +0000

Postfix configuration for a relayhost (MX) / Anti-SPAM-/UCE-settings smtpd (smtp + daemon) = server = Postfix receives mail from a client smtp = client = Postfix sends mail to another mailserver used Ports: 10023/tcp: postgrey 10024/tcp: amavisd-new 10025/tcp: policyd-weight

sasl

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:56:42 +0000

SASL A very conveniant way of configuring the Simple Authentication and Security Layer (SASL) is to use the Pluggable Authentication Modules (PAM), since it can use diffrent authentication sources like ldap or /etc/passwd - thus SASL is everything but simple

cyrus_secure

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:52:44 +0000

TLS, IMAP over SSL (imaps) and pop3 over SSL (pop3s) TLS Modify / append the TLS-settings in /etc/imap.conf: #--- SSL/TLS setting ---# tls_ca_path: /etc/ssl/certs tls_ca_file: /etc/ssl/certs/ca_cert.pem tls_cert_file: /etc/ssl/certs/station7_cert.pem tls_key_file: /etc/ssl/private/station7_key.pem

postfix_secure

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:56:23 +0000

Postfix with TLS and SSL (smtps) Use a portscanner like „nmap“: station7:/etc/init.d # nmap localhost | grep smtp 25/tcp open smtp -> smtp is only running at port 25! TLS Modify the TLS-settings in /etc/postfix/main.cf #--- SSL/TLS setting ---# smtpd_client_restrictions= permit_tls_clientcerts, permit_sasl_authenticated smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, permit_tls_clientcerts, reject_unauth_destination, check_sender_access hash:/etc/…

postgrey

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 16:02:27 +0000

Greylisting For a overview what greylisting does, have a look at www.greylisting.org/ There are several greylisting daemons for Postfix available. I stick to David Schweikert's Postgrey or to Lionel Bouton's SQLgrey in combination with it's web-interface http://www.vanheusden.com/sgwi/ Postgrey Postgrey greylisting daemon

config

anonymous@undisclosed.example.com (Anonymous) — Sat, 06 Apr 2024 16:56:19 +0000

Postfix smtpd (smtp + daemon) = server = Postfix receives mail from a client smtp = client = Postfix sends mail to another mailserver Edit /etc/postfix/main.cf queue_directory = /var/spool/postfix command_directory = /usr/sbin daemon_directory = /usr/libexec/postfix mail_owner = postfix smtpd_banner = mail.example.org myhostname = mail.example.org myorigin = example.org mydestination = mail.example.org mynetworks = 127.0.0.0/8, 10.0.0.0/8 alias_maps = hash:/etc/aliases, ldap:virtualaliases…

monitoring

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:58:04 +0000

Monitoring email-monitoring * create „/var/lib/rrd“ Mailgraph mailgraph is a very simple mail statistics RRDtool frontend for Postfix that produces daily, weekly, monthly and yearly graphs of received/sent and bounced/rejected mail (SMTP traffic).

sign

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:53:39 +0000

Domain Key Identified Mail outbound - ORIGINATING - signieren DKIM basiert auf asymetrischer Verschlüsselung mit public- und private-Key. Das Key-Paar wird mit folgender Syntax erzeugt: amavisd genrsa [Anzahl der Bits für den Schlüssel]

smtp-authentication

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:56:50 +0000

SMTPd- / SMTP-authentication SMTPd-authentication SASL must be configured! in /etc/postfix/main.cf: smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous broken_sasl_auth_clients = yes smtpd_recipient_restrictions = ... permit_sasl_authenticated

ldap

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:55:50 +0000

using LDAP /etc/postfix/ldap-aliases.cf: server_host= ldaps://localhost:636 server_port= 636 start_tls = no tls_ca_cert_file = /etc/ssl/postfix/certs/ca_cert.pem tls_ca_cert_dir = /etc/ssl/postfix/certs/ tls_cert = /etc/ssl/postfix/certs/station7_cert.pem tls_key = /etc/ssl/postfix/private/station7_key.pem #tls_random_file = dev:/dev/urandom tls_cipher_suite = ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP version= 3 bind= no timeout= 120 search_base= dc=example,dc=com query_filter = (&(object…

amavisd

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:57:55 +0000

AmaVisd-new /etc/amavis/amavisd.conf: use strict; # a minimalistic configuration file for amavisd-new with all necessary settings # # see amavisd.conf-default for a list of all variables with their defaults; # see amavisd.conf-sample for a traditional-style commented file; # for more details see documentation in INSTALL, README_FILES/* # and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html # COMMONLY ADJUSTED SETTINGS: # @bypass_virus_checks_maps = (1); # uncomment to DI…

config

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:52:33 +0000

Cyrus imapd / popd Modify /etc/cyrus.conf to: START { recover cmd="ctl_cyrusdb -r" deliver cmd="ctl_deliver -r" } SERVICES { imap cmd="imapd" listen="imap" prefork=0 # imaps cmd="imapd -s" listen="imaps" prefork=0 pop3 cmd="pop3d" listen="pop3" prefork=0 # pop3s cmd="pop3d -s" listen="pop3s" prefork=0 sieve cmd="timsieved" listen="sieve" prefork=2 # entry must be the same as in th…

pfs

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:56:15 +0000

Postfix Perfect Forwarding Secrecy (PFS) openssl gendh -out /etc/postfix/dh_512.pem -2 512 openssl gendh -out /etc/postfix/dh_1024.pem -2 1024 postconf -e "smtpd_tls_dh1024_param_file = /etc/postfix/dh_1024.pem" postconf -e "smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem" postconf -e "smtpd_tls_eecdh_grade = strong" postconf -e "tls_preempt_cipherlist = yes" postconf -e "smtpd_tls_loglevel = 1" postconf -e "smtp_tls_loglevel = 1" postfix reload

gnarwl

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:50:23 +0000

Gnarwl Download GNARWL software from and download package named gnarwl-3.3.tgz Compile GNARWL for LDAP vacations # tar xzvf gnarwl-3.3.tgz # cd gnarwl-3.3 # ./configure # make # make install # make perm Adjust File /usr/local/etc/gnarwl.conf map_sender $sender map_receiver $recepient map_subject $subject map_field $fullname cn map_field $deputy mail server localhost port 389 scope sub login cn=admin,dc=example,dc=org password IveGotASe…

operation

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:53:27 +0000

AmaViSd-new Operation emails aus der Quarantäne releasen: Wenn AMaViSd emails in die Quarantäne verschiebt, erhält man emails dieser Form: Betreff: BANNED contents (text/x-msdos-batch,.asc,bacula_after_failure.cmd) in mail FROM LOCAL [...] No viruses were found. Banned name: text/x-msdos-batch,.asc,bacula_after_failure.cmd Content type: Banned Internal reference code for the message is 11606-02/IJvAMUUAzNma [...] The message has been quarantined as: I/banned-IJvAMUUAzNma The message W…

spamassassin

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:58:39 +0000

SpamAssassin SA-config-genarator: /etc/mail/spamassassin/local.cf: # SpamAssassin config file for version 3.x # NOTE: NOT COMPATIBLE WITH VERSIONS 2.5 or 2.6 # See http://www.yrex.com/spam/spamconfig25.php for earlier versions # Generated by http://www.yrex.com/spam/spamconfig.php (version 1.50) # How many hits before a message is considered spam. required_score 5.0 # Encapsulate spam in an attachment (0=no, 1=yes, 2=safe) report_safe …

spamreport

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:54:58 +0000

Spamreport spamcheck.sh #!/bin/bash ######################################################### # UKBW-Spam-Report, 2007-05-01, chhaas, IuK / Netzwerke # ######################################################### #set -o verbose ######## # ToDo # ######## # - printvariablen bei "grep X-Spam-Status:" korrigieren # - Mail an antispam@uk-bw.de zusammenfassen: 1 Mail die alle Spammails inkl. Empfaenger beinhaltet # - Variablen fuer FROM: und RETURN-PATH einrichten # - evtl. SpamAssassin Spam-T…

verify

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:53:51 +0000

Domain Key Identified Mail inbound verifizieren vim /etc/amavis/conf.d/50-user # DKIM-Ueberpruefung: $enable_dkim_verification = 1; $allowed_added_header_fields{lc('Authentication-Results')} = 1; service amavis restart AMaViS kann nun mit Hilfe des Public-Keys der in der

email

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 16:26:57 +0000

email Mailserver, Mailgateway, Anti-Spam [AMaVISd-new, SpamAssassin, dSpam, rspamd], SPF, DKIM, PFS etc. \\}} Postfix smtpd Postfix ist ein sehr mächtiger Mail Transport Agent, entwickelt von Wietse Venema. * Postfix Konfiguration für einen Mailserver * use of LDAP lookup maps * Postfix' Postscreen Modul anstatt policyd-weight oder postfwd * Postfix Anti-SPAM/UCE settings * Postfix SASL Konfiguraton * SMTP-authentication * TLS and SSL configuration (smtps) *

sieve

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:52:56 +0000

Sieve * * * * Sieve and SSL / TLS timsieved allows for SSL on connect (like https, imaps, or pop3s), only STARTTLS. So you have to wrap it in an stunnel (www.stunnel.org), which is a another story ... Have a look at this: Testi…

pflogsum

anonymous@undisclosed.example.com (Anonymous) — Tue, 25 Apr 2017 14:56:02 +0000

Postfix-Reporting mit Pflogsum apt-get install pflogsum /usr/local/bin/postfix_report.sh #!/bin/bash /usr/sbin/pflogsumm -d yesterday --problems_first /var/log/mail.log.1 > /tmp/pflogsumm /usr/bin/mailx -s "Automatischer Postfix-Report von $(hostname)" -r postfix-admin@station7.example.de postfix-admin@station7.example.de < /tmp/pflogsumm