1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
|
<!-- UbuntuMailServerSetup, Version: 2, Modified: 2019/06/11, Author: feurig -->
# Ubuntu LTS Email Server Setup
This document assumes that you have set up a debian 9 or ubuntu LTS server(/container) set up and that postfix/email has been set up using tasksel.
## Dovecot (imap server) and Postfix (mail server)
configure dovecot to use self signed ssl cert created by postfix.
root@naomi:/etc/postfix# cd ../dovecot/conf.d/
root@naomi:/etc/dovecot/conf.d# nano 10-ssl.conf
##
## SSL settings
##
# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
ssl = yes
# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem
ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key
#ssl_cert = </etc/dovecot/dovecot.pem
#ssl_key = </etc/dovecot/private/dovecot.pem
Also set mailbox format to Maildir or all of your legacy data will be hosed.
root@naomi:/etc/dovecot/conf.d# nano 10-mail.conf
mail_location = maildir:~/Maildir
...
Notice issues with sending mail using ssl/tls
don@bob2:~$ openssl s_client -connect mail.suspectdevices.com:465 -starttls smtp
connect: Connection refused
connect:errno=111
Add ssl/tls to postfix for outgoing mail
root@naomi:/etc/postfix# nano master.cf
...
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (no) (never) (100)
# ==========================================================================
smtp inet n - y - - smtpd
#smtp inet n - y - 1 postscreen
#smtpd pass - - y - - smtpd
#dnsblog unix - - y - 0 dnsblog
#tlsproxy unix - - y - 0 tlsproxy
submission inet n - y - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
# -o smtpd_reject_unlisted_recipient=no
# -o smtpd_client_restrictions=$mua_client_restrictions
# -o smtpd_helo_restrictions=$mua_helo_restrictions
# -o smtpd_sender_restrictions=$mua_sender_restrictions
# -o smtpd_recipient_restrictions=
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
root@naomi:/etc/postfix# service postfix check
postfix/postfix-script: warning: group or other writable: /usr/lib/postfix/./sbin/lmtp
postfix/postfix-script: warning: group or other writable: /usr/lib/postfix/./libpostfix-tls.so.1
postfix/postfix-script: warning: group or other writable: /usr/lib/postfix/./libpostfix-global.so.1
postfix/postfix-script: warning: group or other writable: /usr/lib/postfix/./libpostfix-master.so.1
postfix/postfix-script: warning: group or other writable: /usr/lib/postfix/./libpostfix-dns.so.1
postfix/postfix-script: warning: group or other writable: /usr/lib/postfix/./libpostfix-util.so.1
postfix/postfix-script: warning: group or other writable: /usr/lib/postfix/sbin/./lmtp
root@naomi:/etc/postfix# service postfix reload
Link authentication to dovecot and enable auth server in dovecot. '' apparently this can be avoided by installing a single package buried in ubuntu's documentation (g: Mail-Stack Delivery).
root@naomi:/etc/postfix# nano /etc/dovecot/conf.d/10-master.conf
...
#Postfix smtp-auth
unix_listener /var/spool/postfix/private/auth {
mode = 0666
}
# Auth process is run as this user.
#user = $default_internal_user
}
service auth-worker {
# Auth worker process is run as root by default, so that it can access
# /etc/shadow. If this isn't necessary, the user should be changed to
# $default_internal_user.
user = root
}
...
root@naomi:/etc/postfix# nano main.cf
# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_auth_only = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks reject_unauth_destination
Follow up on above errors
NOTE: the above errors are related to symlinks and not the files. Both debian and canonical aren't concerned about it and may or may not fix it at some point. https://bugs.launchpad.net/ubuntu/+source/postfix/+bug/1728723
eliminate pop3 as it isn't needed
mv /usr/share/dovecot/protocols.d/pop3d.protocol /usr/share/dovecot/pop3d.protocol.disabled
service dovecot reload
netstat -ta
## SPF and openDKIM
Gmail currently requires that any email you send that isn't controlled by them use both SPF and DKIM.
### What the hell is it?
According to linuxbabe https://www.linuxbabe.com/mail-server/setting-up-dkim-and-spf
_SPF and DKIM are two types of TXT records in DNS that can help prevent email spoofing and ensure legitimate emails are delivered into the recipient’s inbox instead of spam folder. If your domain is abused by email spoofing, then your emails are likely to landed in recipient’s spam folder if they didn’t add you in address book._
_SPF (Sender Policy Framework) record specifies which hosts or IP addresses are allowed to send emails on behalf of a domain. You should allow only your own email server or your ISP’s server to send emails for your domain._
_DKIM (DomainKeys Identified Mail) uses a private key to add a signature to emails sent from your domain. Receiving SMTP servers verify the signature by using the corresponding public key, which is published in your DNS manager. _
### SPF
We only want to send email through a single server which is accomplished with the following record. Which needs to be added for each domain using the email server.
root@naomi:~# nano /etc/bind/zones/fromhell.hosts
... add the following ...
@ TXT "v=spf1 ip4:198.202.31.141 -all"
### openDKIM
#### gotchas
* convoluted and complex configuration involving 3 major services (dns,postfix,opendkim).
* postfix is chrooted and milter version is currently 6
* sample output from current opendkim-tools is wrong and requires manual correction.
* Relaying requires masquerading.
#### installation
Install opendkim and edit configuration file
root@naomi:~# apt-get install opendkim opendkim-tools
root@naomi:~# nano /etc/opendkim.conf
... add/correct the following ...
Socket local:/var/spool/postfix/var/run/opendkim/opendkim.sock
PidFile /var/run/opendkim/opendkim.pid
Syslog yes
UMask 002
UserID opendkim
KeyTable refile:/etc/opendkim/key.table
SigningTable refile:/etc/opendkim/signing.table
ExternalIgnoreList refile:/etc/opendkim/trusted.hosts
InternalHosts refile:/etc/opendkim/trusted.hosts
For each domain being handled create a signing key and add to dns zone files.
root@naomi:~# cd /etc/opendkim/keys/
root@naomi:/etc/opendkim/keys# opendkim-genkey -b 2048 -h rsa-sha256 -r -s 201807 -d suspectdevices.com -v
root@naomi:/etc/opendkim/keys# mv 201807.private suspectdevices.private
root@naomi:/etc/opendkim/keys# cat 201807.txt >>/etc/bind/zones/suspectdevices.hosts
Fix the error in dns entry and increment the zones serial number
root@naomi:/etc/opendkim/keys# nano /etc/bind/zones/suspectdevices.hosts
@ IN SOA dns1.digithink.com. don.digithink.com (
2018072200 10800 3600 3600000 86400 )
...change.this. YYYYMMDDxx ....
...
... and change h=rsa-sha256 to h=sha256 ... ...as below...
201807._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; s=email; "
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6ymvRll+pEDThA6fMersYbr6dB5HKIFl4SMSF3ORxkFmrYC//wm6/vrqWNft3AWy4zC7AQNiKyQGg7$
"BUpxeL2bSGUhMrcZ+OheWWzw7aF746IOYO0IR4oMTFNP9a6hrmwBrLmnA8ploFYUWCa2ETq/VYP6i14LU7P/yi8JhDMu4ZVI6ytlynBcLU42orcNWjWNLHqy/F3L$
Reload bind and check key
root@naomi:/etc/opendkim/keys# service bind9 reload
root@naomi:/etc/opendkim/keys# service bind9 status
● bind9.service - BIND Domain Name Server
Loaded: loaded (/lib/systemd/system/bind9.service; enabled; vendor preset: enabled)
....
Jul 25 22:35:15 naomi named[28512]: reloading zones succeeded
....
root@naomi:/etc/opendkim/keys# opendkim-testkey -d suspectdevices.com -s 201807 -vvv
opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key '201807._domainkey.suspectdevices.com'
opendkim-testkey: key not secure .... ignore this ....
opendkim-testkey: key OK
Add entries to key.table signing.table and trusted hosts.
```
root@naomi:/etc/opendkim# nano key.table
fromhell fromhell.com:201807:/etc/opendkim/keys/fromhell.private
suspectdevices suspectdevices.com:201807:/etc/opendkim/keys/suspectdevices.private
root@naomi:/etc/opendkim# nano signing.table
*@fromhell.com fromhell
*@suspectdevices.com suspectdevices
root@naomi:/etc/opendkim# nano trusted.hosts
127.0.0.1
::1
198.202.31.221
198.202.31.242
localhost
*.fromhell.com
*.suspectdevices.com
```
Configure socket file to communicate with postfix and add postfix to opendkim group.
root@naomi:~# mkdir -p /var/spool/postfix/var/run/opendkim
root@naomi:~# chown -R opendkim:opendkim /var/spool/postfix/var/run/opendkim
root@naomi:~# touch /var/spool/postfix/var/run/opendkim/opendkim.sock
root@naomi:~# chmod 775 /var/spool/postfix/var/run/opendkim/opendkim.sock
root@naomi:~# usermod -a -G opendkim postfix
root@naomi:~# nano /etc/default/opendkim
...
DAEMON_OPTS="-vvvv"
SOCKET="local:/var/spool/postfix/var/run/opendkim/opendkim.sock"
RUNDIR=/var/spool/postfix/var/run/opendkim
USER=opendkim
GROUP=opendkim
PIDFILE=$RUNDIR/$NAME.pid
EXTRAAFTER=
...
Add filter to postfix and restart both services.
root@naomi:~# nano /etc/postfix/main.cf
...
milter_protocol = 6
milter_default_action = accept
smtpd_milters = unix:/var/run/opendkim/opendkim.sock
non_smtpd_milters = unix:/var/run/opendkim/opendkim.sock
...
root@naomi:~# service opendkim reload
root@naomi:~# service postfix reload
Send test mail
root@naomi:~# echo "dkim test" |mail -testopendkim check-auth@verifier.port25.com
#### adding signatures to relayed hosts
To relay mail from other hosts on the local networks requires the following additions to postfix's main.cf
root@naomi:~# nano /etc/postfix/main.cf
...
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128, 198.202.31.128/25
...
masquerade_domains = suspectdevices.com, fromhell.com
#### openDKIM/SPF links
* https://www.cioby.ro/2013/11/14/configuring-opendkim-to-sign-postfix-emails/
* https://linuxaria.com/howto/using-opendkim-to-sign-postfix-mails-on-debian
* http://www.openspf.org/SPF_Record_Syntax
* https://blog.whabash.com/posts/send-outbound-email-postfix-dkim-spf-ubuntu-16-04
* https://www.linode.com/docs/email/postfix/configure-spf-and-dkim-in-postfix-on-debian-8/
* https://www.linuxbabe.com/mail-server/setting-up-dkim-and-spf
* https://tools.ietf.org/html/rfc6376
* https://tweenpath.net/opendkim-postfix-smtp-relay-server-on-debian-7/
* https://qureshi.me/how-to-setup-postfixdkimspfdmarc-on-ubuntu-plesk-onyx/
## Configure root/notification mail from other systems (esp bs2020)
Systems need to be able send email to notify us of issues such as security updates (apticron) etc.
In order for email to be signed by opendkim and validated by spf the email needs to strip the hostname from mail sent from it before being relayed through the mail server.
root@bs2020:~# apt-get install mailutils apticron
... select satellite server when asked ...
root@bs2020:~# nano /etc/postfix/main.cf
... add the following ...
relayhost = naomi.suspectdevices.com
compatibility_level=2
masquerade_domains = suspectdevices.com
Since all systems will be striped of their machine names insure the full name of common accounts is made to be uniq
root@bs2020:~# chfn -f "Root at BS2020"
* http://www.postfix.org/STANDARD_CONFIGURATION_README.html
* https://www.tecmint.com/setup-postfix-mail-server-smtp-using-null-client-on-centos/
_Todo:_
* I think postfix is a little heavy handed to run a null client. Investigate simpler secure solution.
* add amivis,and other filters linked in at https://help.ubuntu.com/community/MailServer
* make procmail do some work since its enabled by default
* make damned sure that it wont accept mail from the entire c-block
|
