Overview Postfix Is a Mail Transport Agent Written by Security Researcher
Total Page:16
File Type:pdf, Size:1020Kb
Internet Mail Local Mail Web Based smtpd Anti - Spam Control Panel on port 25 pickup (Apache - PHP) with Anti UCE MySQL smtpd Interface cleanup on port 1025 Postfix LMTP Queue qmgr Perl DBI Amavisd-new on port 1024 smtp local Unix Socket mailbox Perl Module Cal Clamav LMTP=Local Mail Transfer Protocol SMTP=Simple Mail Transfer Protocol smtpd=Simple Mail Transfer Protocol Daemon qmgr=Queue Manager Overview Postfix is a mail transport agent written by security researcher Wietse Venema. Not surprisingly, Postfix is designed from the ground up to be a highly secure system. It consists of several components, each of which runs with least privilege and none of which trust data from the other without validating it themselves. Despite the extensive security emphasis in the system's architecture, Postfix is capable of very good performance in normal conditions; because of architectural decisions, it is also fault tolerant and capable of good performance under adverse conditions such as resource starvation. Postfix supports three content inspection methods, ranging from light - weight one-line-at-a-time scanning before mail is queued, to heavy duty machinery that does sophisticated content analysis after mail is queued. Each approach serves a different purpose. The method shown in this article inspects mail AFTER it is stored in the queue, and uses standard protocols such as SMTP. After-queue inspection allows you to use content filters of arbitrary complexity without causing timeouts while receiving mail, and without running out of memory resources under a peak load. The SpamAssassin system is software for analyzing email messages, determining how likely they are to be spam, and reporting its conclusions. It is a rule-based system that compares different parts of email messages with a large set of rules. Each rule adds or removes points from a message's Spam score. A message with a high enough score is reported to be spam. Amavisd-New is a high-performance and reliable interface between mailer (MTA) and one or more content checkers: virus scanners, and SpamAssassin. It is written in Perl, assuring high reliability, portability and maintainability. It talks to MTA via (E)SMTP or LMTP, or by using helper programs. No timing gaps exist in the design, which could cause a mail loss. It is normally positioned at or near a central mailer, not necessarily where user's mailboxes and final delivery takes place. When calling of Mail::SpamAssassin (SA) is enabled, it calls SA only once per message (regardless of the number of recipients), and tries very hard to correctly honors per-recipient preferences, such as pass/reject, and inserting spam-related mail header fields. Document assumes a fresh Linux install with at least 'Editors' and 'Base'. Use your favorite editor if you don't want to use vim. A few commands in this document will wrap - be sure you place the entire command on one line. This document does not cover a lot thing like configuring the firewall or disabling unnecessary daemons. Its focus is getting you to the point you can log on to Maia. This document is not a tutorial for any of the programs listed here. You can edit this document to customize it. The host name I use is 'ahost'. The domain name used is 'example.com' and the administrator's email name is 'admin' # Root's MySQL password is 'roots_password' # Do a search and replace on those four items. # Optional yum update # Note however that if you don't run 'yum update' you will need to at least update perl: yum update perl # see https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218916 vi /etc/sysconfig/i18n # and change to a non UTF8 Lang. e.g. "en_US.UTF-8" is changed to "en_US" # a mail server should keep accurate time yum -y install ntp ntpdate clock.fmt.he.net ntpdate ntp1.tummy.com chkconfig --level 235 ntpd on hwclock --systohc service ntpd start adduser -r -d /var/amavisd -c "amavis user" -s /bin/sh amavis # add yourself (as the maia administrator) adduser admin passwd admin vi /etc/hosts # in the /etc/hosts file. I do it more like this, adding the actual IP and moving our host name there (this assumes you are using a static IP address): 127.0.0.1 localhost.localdomain localhost 192.168.1.222 ahost.example.com ahost # In this test setup, we don't have DNS MX records set up but we want to be able to locally send test mail to [email protected], so we are going to temporarily add the domain to the interface: 127.0.0.1 localhost.localdomain localhost 192.168.1.222 ahost.example.com ahost example.com reboot mkdir /var/virusmails chown amavis:amavis /var/virusmails mkdir /var/amavisd mkdir /var/amavisd/db mkdir /var/amavisd/var mkdir /var/amavisd/tmp mkdir /var/amavisd/maia mkdir /var/amavisd/maia/scripts chown -R amavis:amavis /var/amavisd chmod -R 750 /var/amavisd yum -y install mysql mysql-server perl-DBD-MySQL perl-DBI subversion patch db4 db4-devel db4-utils yum -y install perl-Crypt-Blowfish perl-Crypt-CBC uuid-perl perl-Template-Toolkit perl-libwww-perl perl-Digest-SHA1 yum -y install perl-HTML-Parser perl-Unix-Syslog perl-IO-stringy perl-Net-Server yum -y install perl-MailTools perl-Convert-UUlib perl-Convert-TNEF perl- Compress-Zlib perl-MIME-tools yum -y install perl-Archive-Zip perl-Archive-Tar perl-BerkeleyDB perl-Digest- SHA1 perl-Digest-HMAC perl-Net-DNS yum -y install php php-pear php-mysql php-gd php-Smarty pax cabextract cpio lha lzop freeze tmpwatch bzip2 yum -y install nomarch binutils gzip spamassassin php-bcmath pyzor gcc bison zlib zlib-devel gmp-devel yum -y install perl-Authen-SASL perl-LDAP perl-URI perl-DBD-SQLite perl- Razor-Agent perl-Mail-SPF-Query # It wouldn't hurt to run those installs again to make sure we got them all. optional - depends if you want/need them for authentication or encryption or if you decide to use Postgre instead of MySQL yum install php-imap php-ldap php- mcrypt php-pgsql # I list packages to a file so I can easily grep it later yum list > 1 # read the note before you run 'svn checkout' mkdir /usr/local/src/maia cd /usr/local/src/maia svn checkout https://www.maiamailguard.com/svn/branches/1.0 # answer (p)ermanently? # please make a note of the SVN revision that you get # if you need to download again, first move or remove /usr/local/src/maia then start over # I got 1160 (which I believe is the bundled version of Maia 1.0.2) # note that you can specify particular revision: # svn -r 1160 checkout https://www.maiamailguard.com/svn/branches/1.0 # If you picked a version less than 1184, you need to apply a security patch: cd 1.0/php cp xlogin.php xlogin.php~ cp login.php login.php~ cp internal-init.php internal-init.php~ wget http://www200.pair.com/mecham/spam/maiasecuritypatch1184.txt patch -p0 < maiasecuritypatch1184.txt # If the patch was applied successfully: rm -f xlogin.php~ rm -f login.php~ rm -f internal-init.php~ # I don't use sendmail yum -y install postfix cyrus-sasl rpm -e sendmail alternatives --config mta # then select /usr/sbin/sendmail.postfix # set up pyzor and razor chmod -R a+rX /usr/share/doc/pyzor-0.4.0 /usr/bin/pyzor /usr/bin/pyzord chmod -R a+rX /usr/lib/python2.4/site-packages/pyzor su amavis -c 'pyzor discover' echo "82.94.255.100:24441" > /var/amavisd/.pyzor/servers su amavis -c 'razor-admin -create' su amavis -c 'razor-admin -create' su amavis -c 'razor-admin -register' # (may have to run that one twice) # disable razor logging (debuglevel = 0) cp /var/amavisd/.razor/razor-agent.conf /tmp/8 sed 's/= 3/= 0/g' /tmp/8 > /var/amavisd/.razor/razor-agent.conf cat /var/amavisd/.razor/razor-agent.conf # create initial bayes database su amavis -c 'sa-learn --sync' ls -l /var/amavisd/.spamassassin/ ###################### # install DCC cd /usr/local/src wget http://www.dcc-servers.net/dcc/source/dcc-dccproc.tar.Z tar xzf dcc-dccproc.tar.Z # adjust for current version: cd dcc-dccproc-1.3.59 ./configure --with-uid=amavis && make && make install chown -R amavis:amavis /var/dcc ln -s /var/dcc/libexec/cron-dccd /usr/bin/cron-dccd crontab -e # and insert (at the top): 43 11 * * * /usr/bin/cron-dccd ###################### # enable DCC in v310.pre (if you abide by the license) cp /etc/mail/spamassassin/v310.pre /etc/mail/spamassassin/v310.pre-mybackup cp /etc/mail/spamassassin/v310.pre /tmp/7 sed 's/#loadplugin Mail::SpamAssassin::Plugin::DCC/loadplugin Mail::SpamAssassin::Plugin::DCC/g' /tmp/7 > /etc/mail/spamassassin/v310.pre head -30 /etc/mail/spamassassin/v310.pre # test - look for pyzor, razor, dcc wget http://www200.pair.com/mecham/spam/sample-spam.txt su amavis -c 'spamassassin -D <sample-spam.txt' cd pear channel-update pear.php.net pear install Mail_Mime-1.3.1 pear install Log-1.9.9 pear install Pager-2.4.2 pear install Image_Color-1.0.2 pear install Image_Canvas-0.3.0 pear install Image_Graph-0.7.2 pear install Numbers_Roman-0.2.0 pear install Numbers_Words-0.15.0 pear install Auth_SASL-1.0.2 pear install Net_Socket-1.0.6 pear install Net_IMAP-1.0.3 pear install Net_POP3-1.3.6 pear install DB-1.7.6 pear install Net_SMTP-1.2.8 # May want to run those again to make sure you got them all. There is a bug in Pie.php provided with Image_Graph-0.7.2.