<?xml version="1.0" encoding="UTF-8"?> <chapter version="5.0" xml:id="sdiMail" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xi="http://www.w3.org/2001/XInclude" xmlns:svg="http://www.w3.org/2000/svg" xmlns:m="http://www.w3.org/1998/Math/MathML" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:db="http://docbook.org/ns/docbook"> <title>Mail</title> <section xml:id="sdiMailPrepare"> <title>Recommended Preparations</title> <itemizedlist> <listitem> <para>Good starting point and Installguide (in German) but for CentoOS <link xlink:href="http://dokuwiki.nausch.org/doku.php/centos:mailserver:grundinstallation_von_postfix">dokuwiki.nausch.org</link>.</para> </listitem> <listitem> <para><link xlink:href="https://wiki.debian.org/Postfix">Installguide on Debian</link></para> </listitem> <listitem> <para xml:lang="de"><link xlink:href="???">Postfix Dokumentation</link></para> </listitem> <listitem> <para xml:lang="de">Das Postfix-Buch : sichere Mailserver mit Linux von Peer Heinlein</para> </listitem> <listitem> <para xml:lang="de"><link xlink:href="http://www.admin-magazin.de/Das-Heft/2012/02/Eigener-Mailserver-mit-Postfix-und-Dovecot">Eigener Mailserver mit Postfix und Dovecot</link></para> </listitem> <listitem> <para xml:lang="de"><link xlink:href="???">Postfix einrichten und absichern</link></para> </listitem> <listitem> <para><orgname>Wikipedia</orgname>: <link xlink:href="https://de.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol">SMTP</link>, mail server, <acronym>IMAP</acronym>, <acronym>Maildir</acronym></para> </listitem> </itemizedlist> <para>The following questions might arise when starting practical work:</para> <itemizedlist> <listitem> <para>What are:<itemizedlist> <listitem> <para><acronym>MTA</acronym></para> </listitem> <listitem> <para><acronym>MDA</acronym></para> </listitem> <listitem> <para><acronym>MUA</acronym></para> </listitem> </itemizedlist></para> </listitem> <listitem> <para>The difference between <acronym>MBOX</acronym> and <acronym>Maildir</acronym></para> </listitem> <listitem> <para>What is <acronym>SASL</acronym> and where do we use it?</para> </listitem> <listitem> <para>What advantages and disadvantage are to be considered when running Postfix in a <command xlink:href="http://linux.die.net/man/1/chroot">chroot</command> environment?</para> </listitem> <listitem> <para>Which purposes are being addressed by the configuration files <filename>master.cf</filename> and <filename>main.cf</filename>?</para> </listitem> <listitem> <para>What are local and virtual domains?</para> </listitem> <listitem> <para>What do smtpd_*_restrictions account for?</para> </listitem> <listitem> <para>What is an open relay?</para> </listitem> </itemizedlist> </section> <section xml:id="sdiMailExercises"> <title>Exercises</title> <para>Our aim is to install and configure the <acronym>MTA</acronym> Postfix with many features used in production today.</para> <section xml:id="sdiMailInstallSendLocalUsers"> <title>Install and send to local Users</title> <para>Install postfix. If asked use "No Configuration". Later it is maybe needed to install extra postfix-* packages.</para> <programlisting language="none">apt-get install postfix</programlisting> <itemizedlist> <listitem> <para>check that postfix is running; try to connect via telnet</para> </listitem> <listitem> <para>add a local <productname>Linux</productname> user (<command xlink:href="http://linux.die.net/man/8/useradd">useradd</command> is your friend!)</para> </listitem> <listitem> <para>send an email via telnet to that user</para> <itemizedlist> <listitem> <para>emails will be stored in <filename>/var/mail/username</filename></para> </listitem> </itemizedlist> </listitem> <listitem> <para>add an alias to <filename>/etc/aliases</filename> and try to send an email to this newly defined alias</para> </listitem> <listitem> <para>add <acronym>mx</acronym> records on both VMs to your <xref linkend="glo_DNS"/> Setup</para> </listitem> <listitem> <para>try to send an email via your second host (sdiXb) to the user being defined on your first host (sdXa).</para> <itemizedlist> <listitem> <para>meaning use telnet on your local host system to sdiXb and send a mail to a user on sdXa</para> </listitem> <listitem> <para>why does that fail?</para> </listitem> </itemizedlist> </listitem> </itemizedlist> </section> <section xml:id="sdiSectAuthenticationSetupVirtualUsers"> <title>Authentication Setup and Virtual Users</title> <itemizedlist> <listitem> <para>add authentication to your setup</para> </listitem> <listitem> <para>install a <acronym>sasl</acronym> implementation (<command>cyrus</command> or <command>dovecot</command>)</para> <itemizedlist> <listitem> <para>first use your already added local users</para> </listitem> <listitem> <para>then bind your <acronym>sasl</acronym> authentication to your existing <xref linkend="glo_LDAP"/>.</para> </listitem> </itemizedlist> </listitem> </itemizedlist> <itemizedlist> <listitem> <para>try again sending an email via your second host to a user on the first host using authentication</para> </listitem> <listitem> <para>use an email client (<acronym>MUA</acronym>) like <productname>thunderbird</productname> for sending emails</para> </listitem> <listitem> <para>add an fantasy domain to your <xref linkend="glo_DNS"/> Setup and let its <acronym>mx</acronym> record point to your mail server</para> </listitem> <listitem> <para>add that domain to your mail setup</para> </listitem> <listitem> <para>now configure email addresses within this domain</para> <itemizedlist> <listitem> <para>define these virtual email addresses in <filename>/etc/postfix/virtual</filename></para> </listitem> <listitem> <para>configure a virtual email address pointing to your local user</para> </listitem> <listitem> <para>configure a virtual email address pointing to your own <orgname>HdM</orgname> mail account.</para> <tip> <para>Read about <command xlink:href="http://linux.die.net/man/1/postmap">postmap</command> and set your local resolver to your own DNS</para> </tip> </listitem> </itemizedlist> </listitem> </itemizedlist> </section> <section xml:id="sdiSectTls"> <title><xref linkend="glo_TLS"/></title> <para>You already got a CA in place. Use your CA to generate a new certificate for your mail server. Add that certificate and your Root CA to your mail server setup.</para> <itemizedlist> <listitem> <para>Use <command>openssl</command> <option>s_client</option> to connect to your mail server</para> </listitem> <listitem> <para>verify that you set the certificate for incoming and outgoing connections</para> <itemizedlist> <listitem> <para>send an email with <command>starttls</command> using a <acronym>MUA</acronym>.</para> </listitem> <listitem> <para>Use a <acronym>MUA</acronym> to send an email to your HdM Account using your mail server system as a relay.</para> </listitem> </itemizedlist> </listitem> <listitem> <para>both connections should be secured via <xref linkend="glo_TLS"/>.</para> </listitem> </itemizedlist> </section> <section xml:id="sdiSectSpamVirusDefense"> <title>Spam and Virus defense</title> <para><itemizedlist> <listitem> <para>Now we will use the smtpd_*_restrictions in the <filename>main.cf</filename>. This are one key element to make your mailserver block spam and other unwanted mails.</para> </listitem> </itemizedlist></para> <section xml:id="sdiSectBlackGreyListing"> <title>blacklisting and greylisting</title> <itemizedlist> <listitem> <para>install the <code>postgrey</code> package and add it to smtpd_recipient_restrictions</para> <itemizedlist> <listitem> <para>test sending emails using telnet or a <acronym>MUA</acronym> to your virtual email address</para> <tip> <para>this needs to be done without authentication</para> </tip> </listitem> <listitem> <para>see how messages get blocked</para> </listitem> <listitem> <para>try again in 10 min</para> </listitem> <listitem> <para>send an email via your second mail server to an email account on your first system and watch the logs. Your mail server will try again until the mail is send to the intended mail account</para> </listitem> <listitem> <para>Use either of <command>postfix</command> <option>restart</option>, <command>postfix</command> <option>flush</option> or <command>postsuper</command> <option>-r QUEUEID</option> to force resending</para> </listitem> </itemizedlist> </listitem> <listitem> <para>add some blacklists to your <code>smtpd_recipient_restrictions</code></para> <itemizedlist> <listitem> <para>this can't be tested very well expect building your own blacklist server (beyond scope of current exercise)</para> </listitem> <listitem> <para>Supply some common blacklist entries and pretend these will work.</para> </listitem> </itemizedlist> </listitem> </itemizedlist> </section> <section xml:id="sdiSectAmavisClamavSpamassassin"> <title><productname>Amavis</productname>, <productname>Clamav</productname> and <productname>Spamassasin</productname></title> <itemizedlist> <listitem> <para/> </listitem> <listitem> <para/> </listitem> </itemizedlist> <itemizedlist> <listitem> <para/> </listitem> <listitem> <para>send an <filename>EICAR-TEST-FILE.txt</filename></para> </listitem> <listitem> <para/> </listitem> <listitem> <para/> </listitem> <listitem> <para/> </listitem> </itemizedlist> </section> <section xml:id="sdiSectSpf"> <title><acronym>SPF</acronym> (optional)</title> <para>more Spam prevention techniques like <acronym>DMARC</acronym>, <acronym>DKIM</acronym> and <acronym>DANE</acronym>.</para> </section> </section> </section> </chapter>