dovecot | Записки системного администратора

Записи с меткой ‘dovecot’

Полезные команды Dovecot

Февраль 18th, 2017

Evgeniy Kamenev

Просмотр всех настроек Dovecot

# dovecot -a

1	# dovecot -a

Просмотр настроек отличных от дефолтных

# dovecot -n

1	# dovecot -n

Просмотр активных подключений

# doveadm who

1	# doveadm who

Размещение LOG-файлов Dovecot

# doveadm log find

1	# doveadm log find

Просмотр последних 1000 ошибок и предупреждений с момента последнего запуска Dovecot

# doveadm log errors

1	# doveadm log errors

Переоткрытие всех логов Dovecot(полезно выполнять после ручной ротации логов)

# doveadm log reopen

1	# doveadm log reopen

Тестирование аутентификации для пользователя(где rip-remote ip)

# doveadm auth test -x service=imap -x rip=10.10.1.4 username@example.com

1	# doveadm auth test -x service=imap -x rip=10.10.1.4 username@example.com

# doveadm auth test -x service=pop3 -x rip=10.10.1.4 username@example.com

1	# doveadm auth test -x service=pop3 -x rip=10.10.1.4 username@example.com

# doveadm auth test -x service=smtp -x rip=10.10.1.4 username@example.com

1	# doveadm auth test -x service=smtp -x rip=10.10.1.4 username@example.com

performs a passdb lookup (without […]

Опубликовано в рубрике Linux/Unix General, Mail

Метки: doveadm, dovecot

Комментарии отключены

Настройка пользовательский почтовых квот на связке Postfix+Dovecot+PostfxAdmin

Февраль 9th, 2017

Evgeniy Kamenev

Статья в продолжении статьи Установка и настройка почтовой связки на основе Postfix+Dovecot+MySQL+PostfixAdmin+Roundcube на Debian 7/ Ubuntu 14.04 Настройка PostfixAdmin

# nano /usr/share/postfixadmin/config.inc.php

1	# nano /usr/share/postfixadmin/config.inc.php

$CONF['maxquota'] = '0';
$CONF['domain_quota_default'] = '0';
$CONF['quota'] = 'YES';
$CONF['domain_quota'] = 'NO';
$CONF['quota_multiplier'] = '1024000';
$CONF['used_quotas'] = 'YES';
$CONF['new_quota_table'] = 'YES';

$CONF['maxquota'] = '0';

$CONF['domain_quota_default'] = '0';

$CONF['quota'] = 'YES';

$CONF['domain_quota'] = 'NO';

$CONF['quota_multiplier'] = '1024000';

$CONF['used_quotas'] = 'YES';

$CONF['new_quota_table'] = 'YES';

Перезапуск Nginx/Apache сервера Настройка Dovecot

# nano /etc/dovecot/conf.d/10-mail.conf

1	# nano /etc/dovecot/conf.d/10-mail.conf

mail_plugins = $mail_plugins quota

1	mail_plugins = $mail_plugins quota

# nano /etc/dovecot/conf.d/20-imap.conf

1	# nano /etc/dovecot/conf.d/20-imap.conf

protocol imap {
mail_plugins = $mail_plugins imap_quota
}

protocol imap {

mail_plugins = $mail_plugins imap_quota

}

# nano /etc/dovecot/conf.d/10-master.conf

1	# nano /etc/dovecot/conf.d/10-master.conf

service dict {
    unix_listener dict {
    mode = 0660
    user = vmail
    group = mail
  }

service dict {

unix_listener dict {

mode = 0660

user = vmail

group = mail

}

# nano /etc/dovecot/conf.d/90-quota.conf

1	# nano /etc/dovecot/conf.d/90-quota.conf

plugin {
  quota = dict:User quota::proxy::quota
  }

plugin {

quota = dict:User quota::proxy::quota

}

# nano /etc/dovecot/dovecot.conf

1	# nano /etc/dovecot/dovecot.conf

dict {
  quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
}

dict {

quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext

}

# nano /etc/dovecot/dovecot-dict-sql.conf.ext

1	# nano /etc/dovecot/dovecot-dict-sql.conf.ext

connect = host=localhost dbname=postfix user=postfixuser password=postfixpassword
map {
  pattern = priv/quota/storage
  table = quota2
  username_field = username
  value_field = bytes
}
map {
  pattern = priv/quota/messages
  table = quota2
  username_field = username
  value_field = messages
}

connect = host=localhost dbname=postfix user=postfixuser password=postfixpassword

map {

pattern = priv/quota/storage

table = quota2

username_field = username

value_field = bytes

}

map {

pattern = priv/quota/messages

table = quota2

username_field = username

value_field = messages

}

Для Dovecot версии 1.2 и выше используется таблица quota2 вместо таблицы quota

# nano /etc/dovecot/dovecot-sql.conf.ext

1	# nano /etc/dovecot/dovecot-sql.conf.ext

driver = mysql
connect = host=localhost dbname=postfix user=postfixuser password=postfixapassword
default_pass_scheme = MD5-CRYPT

user_query = \
SELECT '/var/vmail/%d/%n' as home, \
'maildir:/var/vmail/%d/%n' as mail, \
1150 AS uid, 8 AS gid, concat('*:bytes=', quota) AS quota_rule \
FROM mailbox WHERE username = '%u' AND active = '1'

password_query = \
SELECT username as user, password, '/var/vmail/%d/%n' as userdb_home, \
'maildir:/var/vmail/%d/%n' as userdb_mail, 1150 as userdb_uid, 8 as userdb_gid \
FROM mailbox WHERE username = '%u' AND active = '1'

driver = mysql

connect = host=localhost dbname=postfix user=postfixuser password=postfixapassword

default_pass_scheme = MD5-CRYPT

user_query = \

SELECT '/var/vmail/%d/%n' as home, \

'maildir:/var/vmail/%d/%n' as mail, \

1150 AS uid, 8 AS gid, concat('*:bytes=', quota) AS quota_rule \

FROM mailbox WHERE username = '%u' AND active = '1'

password_query = \

SELECT username as user, password, '/var/vmail/%d/%n' as userdb_home, \

'maildir:/var/vmail/%d/%n' as userdb_mail, 1150 as userdb_uid, 8 as userdb_gid \

FROM mailbox WHERE username = '%u' AND active = '1'

Применяем сделанные настройки […]

Опубликовано в рубрике Debian/Ubuntu, Mail

Метки: dovecot, postfix, postfixadmin, quota

Комментарии отключены

Установка и настройка связки Exim+Dovecot+MySQL+PostixAdmin+Roundcube на Centos 7

Октябрь 25th, 2015

Evgeniy Kamenev

1.Установка имени хоста

# hostnamectl set-hostname mail.example.com

1	# hostnamectl set-hostname mail.example.com

# nano /etc/hostname

1	# nano /etc/hostname

mail.example.com

1	mail.example.com

# nano /etc/hosts

1	# nano /etc/hosts

192.168.1.102 mail.example.com mail

1	192.168.1.102 mail.example.com mail

# systemctl restart systemd-hostnamed

1	# systemctl restart systemd-hostnamed

# hostname

1	# hostname

mail.example.com

1	mail.example.com

2.Установка и настройка Nginx

# nano /etc/yum.repos.d/nginx.repo

1	# nano /etc/yum.repos.d/nginx.repo

[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1

[nginx]

name=nginx repo

baseurl=http://nginx.org/packages/centos/7/$basearch/

gpgcheck=0

enabled=1

# yum update

1	# yum update

# yum install nginx

1	# yum install nginx

# nano nginx.conf

1	# nano nginx.conf

user nginx;
worker_processes 1;
worker_rlimit_nofile 1024;
worker_priority -5;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
worker_connections 1024;
use epoll;
multi_accept on;
}


http {
include       /etc/nginx/mime.types;
default_type application/octet-stream;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/nginx/access.log main;

sendfile       on;
tcp_nopush     on;
tcp_nodelay     on;
server_tokens   off;
keepalive_timeout 65;
types_hash_max_size 2048;

gzip on;
gzip_static     on;
gzip_comp_level 5;
gzip_min_length 1024;
gzip_proxied     any;
gzip_vary       on;
gzip_types     text/plain text/xml application/xml application/x-javascript text/javascript text/css text/json font/ttf font/opentype application/vnd.ms-fontobject image/svg+xml;
gzip_disable "msie6";

open_file_cache   max=5000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors   on;

fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;

fastcgi_connect_timeout 90;
fastcgi_send_timeout 90;
fastcgi_read_timeout 90;

client_max_body_size 100m;
client_body_buffer_size 8K;

include /etc/nginx/conf.d/*.conf;
}

user nginx;

worker_processes 1;

worker_rlimit_nofile 1024;

worker_priority -5;

error_log /var/log/nginx/error.log warn;

pid /var/run/nginx.pid;

events {

worker_connections 1024;

use epoll;

multi_accept on;

}

http {

include /etc/nginx/mime.types;

default_type application/octet-stream;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '

'$status $body_bytes_sent "$http_referer" '

'"$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/nginx/access.log main;

sendfile on;

tcp_nopush on;

tcp_nodelay on;

server_tokens off;

keepalive_timeout 65;

types_hash_max_size 2048;

gzip on;

gzip_static on;

gzip_comp_level 5;

gzip_min_length 1024;

gzip_proxied any;

gzip_vary on;

gzip_types text/plain text/xml application/xml application/x-javascript text/javascript text/css text/json font/ttf font/opentype application/vnd.ms-fontobject image/svg+xml;

gzip_disable "msie6";

open_file_cache max=5000 inactive=20s;

open_file_cache_valid 30s;

open_file_cache_min_uses 2;

open_file_cache_errors on;

fastcgi_buffer_size 128k;

fastcgi_buffers 4 256k;

fastcgi_busy_buffers_size 256k;

fastcgi_temp_file_write_size 256k;

fastcgi_connect_timeout 90;

fastcgi_send_timeout 90;

fastcgi_read_timeout 90;

client_max_body_size 100m;

client_body_buffer_size 8K;

include /etc/nginx/conf.d/*.conf;

}

Настройка виртуального хоста по умолчанию

# nano /etc/nginx/conf.d/default.conf

1	# nano /etc/nginx/conf.d/default.conf

server {
listen       192.168.1.102:80 default_server;
server_name localhost;
root         /usr/share/nginx/html;

#charset koi8-r;
access_log /var/log/nginx/default-access.log main;
error_log /var/log/nginx/default-error.log warn;

location / {
try_files $uri $uri/ /index.php?$args;
index index.php index.html index.htm ;
}

#include common/postfixadmin.conf;
#include common/roundcube.conf;

location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+?\.php)(/.*)?$;
fastcgi_pass   unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include       fastcgi_params;

}
error_page   500 502 503 504 /50x.html;
location = /50x.html {
root   /usr/share/nginx/html;
}

location ~ /\.ht {
deny all;
  }
}

server {

listen 192.168.1.102:80 default_server;

server_name localhost;

root /usr/share/nginx/html;

#charset koi8-r;

access_log /var/log/nginx/default-access.log main;

error_log /var/log/nginx/default-error.log warn;

location / {

try_files $uri $uri/ /index.php?$args;

index index.php index.html index.htm ;

}

#include common/postfixadmin.conf;

#include common/roundcube.conf;

location ~ \.php$ {

try_files $uri =404;

fastcgi_split_path_info ^(.+?\.php)(/.*)?$;

fastcgi_pass unix:/var/run/php5-fpm.sock;

fastcgi_index index.php;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

include fastcgi_params;

}

error_page 500 502 503 504 /50x.html;

location = /50x.html {

root /usr/share/nginx/html;

}

location ~ /\.ht {

deny all;

}

# systemctl restart nginx

1	# systemctl restart nginx

# systemctl enable nginx

1	# systemctl enable nginx

3.Установка и настройка PHP-FPM

# yum install php php-fpm php-mysql php-imap php-mbstring php-common php-pdo php-xml

1	# yum install php php-fpm php-mysql php-imap php-mbstring php-common php-pdo php-xml

# nano /etc/php.ini

1	# nano /etc/php.ini

expose_php = Off
max_execution_time = 300
max_input_time = 600
memory_limit = 256M
post_max_size = 100M
cgi.fix_pathinfo=0
upload_max_filesize = 100M
date.timezone = Europe/Kiev

expose_php = Off

max_execution_time = 300

max_input_time = 600

memory_limit = 256M

post_max_size = 100M

cgi.fix_pathinfo=0

upload_max_filesize = 100M

date.timezone = Europe/Kiev

# nano php-fpm.conf

1	# nano php-fpm.conf

emergency_restart_threshold = 10
emergency_restart_interval = 1m
process_control_timeout = 10s
daemonize = yes

emergency_restart_threshold = 10

emergency_restart_interval = 1m

process_control_timeout = 10s

daemonize = yes

# nano /etc/php-fpm.d/www.conf

1	# nano /etc/php-fpm.d/www.conf

listen.owner = nginx
listen.group = nginx
listen.mode = 0660
user = nginx
group = nginx
pm = dynamic
pm.max_children = 50
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 35
request_terminate_timeout = 350
request_slowlog_timeout = 3s
slowlog = /var/log/php-fpm/www-slow.log
catch_workers_output = yes
security.limit_extensions = .php .php3 .php4 .php5
php_admin_value[error_log] = /var/log/php-fpm/www-error.log
php_admin_flag[log_errors] = on
php_admin_value[memory_limit] = 256M
php_value[session.save_handler] = files
php_value[session.save_path] = /var/lib/php/session

listen.owner = nginx

listen.group = nginx

listen.mode = 0660

user = nginx

group = nginx

pm = dynamic

pm.max_children = 50

pm.start_servers = 5

pm.min_spare_servers = 5

pm.max_spare_servers = 35

request_terminate_timeout = 350

request_slowlog_timeout = 3s

slowlog = /var/log/php-fpm/www-slow.log

catch_workers_output = yes

security.limit_extensions = .php .php3 .php4 .php5

php_admin_value[error_log] = /var/log/php-fpm/www-error.log

php_admin_flag[log_errors] = on

php_admin_value[memory_limit] = 256M

php_value[session.save_handler] = files

php_value[session.save_path] = /var/lib/php/session

# chgrp -R nginx /var/lib/php/session/

1	# chgrp -R nginx /var/lib/php/session/

# php-fpm -t

1	# php-fpm -t

# systemctl restart php-fpm

1	# systemctl restart php-fpm

# systemctl enable php-fpm

1	# systemctl enable php-fpm

4.Установка и настройка […]

Опубликовано в рубрике Centos, Mail

Метки: dovecot, Exim, postfixadmin, roundcube

Комментарии отключены

Установка и настройка почтовой связки на основе Postfix+Dovecot+MySQL+PostfixAdmin+Roundcube на Debian 7/ Ubuntu 14.04

Май 19th, 2015

Evgeniy Kamenev

В /etc/hostname – имя сервера БЕЗ имени домена

# cat /etc/hostname

1	# cat /etc/hostname

app02

app02

В /etc/mailname – полное доменное имя(FQDN)

# cat /etc/mailname

1	# cat /etc/mailname

app02.example.com

1	app02.example.com

1.Установка необходимого программного обеспечения Ubuntu

# apt-get install mail-server^

1	# apt-get install mail-server^

Postfix->Internet site->FQDN

1	Postfix->Internet site->FQDN

Dovecot –>Yes(создаем SSL-сертификат)->FQDN

1	Dovecot –>Yes(создаем SSL-сертификат)->FQDN

Устанавливаем поддержку MySQL для Postfix и Dovecot. Пакет php5-imap нужен для PostfixAdmin. Пакет php5-mcrypt – для Roundcube.

# apt-get install postfix-mysql dovecot-mysql php5-imap php5-mcrypt

1	# apt-get install postfix-mysql dovecot-mysql php5-imap php5-mcrypt

Debian

# apt-get install postfix postfix-mysql libsasl2-modules libsasl2-modules-sql

1	# apt-get install postfix postfix-mysql libsasl2-modules libsasl2-modules-sql

# apt-get install dovecot-mysql dovecot-pop3d dovecot-imapd

1	# apt-get install dovecot-mysql dovecot-pop3d dovecot-imapd

# apt-get install php5-imap php5-mcrypt

1	# apt-get install php5-imap php5-mcrypt

[…]

Опубликовано в рубрике Debian/Ubuntu, Mail

Метки: dovecot, mysql, postfix, postfixadmin, roundcube

Комментарии отключены

Установка и настройка Sendmail+Dovecot+TLS/SSL на Centos 7

Февраль 23rd, 2015

Evgeniy Kamenev

1.Установка Sendmail+Cyrus-sasl

# yum install sendmail sendmail-cf sendmail-doc cyrus-sasl-{lib,plain}

1	# yum install sendmail sendmail-cf sendmail-doc cyrus-sasl-{lib,plain}

2.Настройка Sendmail

# cd /etc/mail/

1	# cd /etc/mail/

# cp sendmail.mc{,.orig}

1	# cp sendmail.mc{,.orig}

# nano /etc/mail/sendmail.mc

1	# nano /etc/mail/sendmail.mc

divert(-1)dnl
include(`/usr/share/sendmail-cf/m4/cf.m4')dnl
VERSIONID(`setup for linux')dnl
OSTYPE(`linux')dnl
define(`confDEF_USER_ID', ``8:12'')dnl
dnl define(`confAUTO_REBUILD')dnl
define(`confTO_CONNECT', `1m')dnl
define(`confTRY_NULL_MX_LIST', `True')dnl
define(`confDONT_PROBE_INTERFACES', `True')dnl
define(`PROCMAIL_MAILER_PATH', `/usr/bin/procmail')dnl
define(`ALIAS_FILE', `/etc/aliases')dnl
define(`STATUS_FILE', `/var/log/mail/statistics')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl
define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
define(`confAUTH_OPTIONS', `A y')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confTO_IDENT', `0')dnl
FEATURE(`no_default_msa', `dnl')dnl
FEATURE(`smrsh', `/usr/sbin/smrsh')dnl
FEATURE(`mailertable', `hash -o /etc/mail/mailertable.db')dnl
FEATURE(`virtusertable', `hash -o /etc/mail/virtusertable.db')dnl
FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
FEATURE(local_procmail, `', `procmail -t -Y -a $h -d $u')dnl
FEATURE(`access_db', `hash -T&lt;TMPF&gt; -o /etc/mail/access.db')dnl
FEATURE(`blacklist_recipients')dnl
EXPOSED_USER(`root')dnl
DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, Name=MTA')dnl
DAEMON_OPTIONS(`Port=submission, Name=MSA, M=Ea')dnl
FEATURE(`accept_unresolvable_domains')dnl
LOCAL_DOMAIN(`localhost.localdomain')dnl
MAILER(smtp)dnl
MAILER(procmail)dnl

divert(-1)dnl

include(`/usr/share/sendmail-cf/m4/cf.m4')dnl

VERSIONID(`setup for linux')dnl

OSTYPE(`linux')dnl

define(`confDEF_USER_ID', ``8:12'')dnl

dnl define(`confAUTO_REBUILD')dnl

define(`confTO_CONNECT', `1m')dnl

define(`confTRY_NULL_MX_LIST', `True')dnl

define(`confDONT_PROBE_INTERFACES', `True')dnl

define(`PROCMAIL_MAILER_PATH', `/usr/bin/procmail')dnl

define(`ALIAS_FILE', `/etc/aliases')dnl

define(`STATUS_FILE', `/var/log/mail/statistics')dnl

define(`UUCP_MAILER_MAX', `2000000')dnl

define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl

define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl

define(`confAUTH_OPTIONS', `A y')dnl

TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

define(`confTO_IDENT', `0')dnl

FEATURE(`no_default_msa', `dnl')dnl

FEATURE(`smrsh', `/usr/sbin/smrsh')dnl

FEATURE(`mailertable', `hash -o /etc/mail/mailertable.db')dnl

FEATURE(`virtusertable', `hash -o /etc/mail/virtusertable.db')dnl

FEATURE(redirect)dnl

FEATURE(always_add_domain)dnl

FEATURE(use_cw_file)dnl

FEATURE(use_ct_file)dnl

FEATURE(local_procmail, `', `procmail -t -Y -a $h -d $u')dnl

FEATURE(`access_db', `hash -T<TMPF> -o /etc/mail/access.db')dnl

FEATURE(`blacklist_recipients')dnl

EXPOSED_USER(`root')dnl

DAEMON_OPTIONS(`Port=smtp,Addr=0.0.0.0, Name=MTA')dnl

DAEMON_OPTIONS(`Port=submission, Name=MSA, M=Ea')dnl

FEATURE(`accept_unresolvable_domains')dnl

LOCAL_DOMAIN(`localhost.localdomain')dnl

MAILER(smtp)dnl

MAILER(procmail)dnl

# make all

1	# make all

# systemctl restart  sendmail

1	# systemctl restart sendmail

# systemctl enable sendmail

1	# systemctl enable sendmail

3.Настройка Sendmail на поддержку TLS/SSL

# cd /etc/pki/tls/certs

1	# cd /etc/pki/tls/certs

# make sendmail.pem

1	# make sendmail.pem

# cd /etc/mail

1	# cd /etc/mail

# nano sendmail.mc

1	# nano sendmail.mc

define(`CERT_DIR', `/etc/pki/tls/certs')dnl
define(`confCACERT_PATH', `CERT_DIR')dnl
define(`confCACERT', `CERT_DIR/sendmail.pem')dnl
define(`confSERVER_CERT', `CERT_DIR/sendmail.pem')dnl
define(`confSERVER_KEY', `CERT_DIR/sendmail.pem')dnl
define(`confCLIENT_CERT', `CERT_DIR/sendmail.pem')dnl
define(`confCLIENT_KEY', `CERT_DIR/sendmail.pem')dnl
DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl

define(`CERT_DIR', `/etc/pki/tls/certs')dnl

define(`confCACERT_PATH', `CERT_DIR')dnl

define(`confCACERT', `CERT_DIR/sendmail.pem')dnl

define(`confSERVER_CERT', `CERT_DIR/sendmail.pem')dnl

define(`confSERVER_KEY', `CERT_DIR/sendmail.pem')dnl

define(`confCLIENT_CERT', `CERT_DIR/sendmail.pem')dnl

define(`confCLIENT_KEY', `CERT_DIR/sendmail.pem')dnl

DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl

# make all

1	# make all

# systemctl restart sendmail

1	# systemctl restart sendmail

Тестируем TLS-поддержку

# openssl s_client -starttls smtp -crlf -connect 127.0.0.1:25

1	# openssl s_client -starttls smtp -crlf -connect 127.0.0.1:25

4.Запуск и добавление в автозагрузку демона аутентификации Cyrus—sasl – saslauthd

# nano /etc/sysconfig/saslauthd

1	# nano /etc/sysconfig/saslauthd

SOCKETDIR=/run/saslauthd
MECH=pam
FLAGS=

SOCKETDIR=/run/saslauthd

MECH=pam

FLAGS=

# systemctl restart saslatuhd

1	# systemctl restart saslatuhd

# systemctl enable saslatuhd

1	# systemctl enable saslatuhd

5.Установка и настройка Dovecot

# yum install dovecot

1	# yum install dovecot

# cd /etc/dovecot

1	# cd /etc/dovecot

# cp -rp conf.d conf.d~

1	# cp -rp conf.d conf.d~

# cp dovecot.conf dovecot.conf~

1	# cp dovecot.conf dovecot.conf~

# nano conf.d/10-mail.conf

1	# nano conf.d/10-mail.conf

mail_location = maildir:~/Maildir

1	mail_location = maildir:~/Maildir

[…]

Опубликовано в рубрике Centos, Mail

Метки: centos 7, dovecot, sendmail, SSL, TLS

Комментарии отключены

Установка и настройка Postfix+Dovecot+Sasl+SSL на Centos 6

Октябрь 9th, 2014

Evgeniy Kamenev

# nano /etc/hosts

1	# nano /etc/hosts

195.64.155.22 server1.kamaok.org.ua server1

1	195.64.155.22 server1.kamaok.org.ua server1

1.Настройка Postfix

# yum install postfix

1	# yum install postfix

# cat /etc/postfix/main.cf | grep -v \# | grep -v ^$

1	# cat /etc/postfix/main.cf \| grep -v \# \| grep -v ^$

queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
myhostname = server1.kamaok.org.ua
mydomain = kamaok.org.ua
myorigin = $mydomain
inet_interfaces = all
inet_protocols = ipv4
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
unknown_local_recipient_reject_code = 550 
# Указываем доверенные адреса/подсети,с которых можно отправлять почту(с остальных адресов пересылка будет запрещена на внешние почтовые ящики(в мир)(с ошибкой при отправке Relay access denied)
mynetworks = 127.0.0.0/8 WWW.XXX.YYY.ZZZ
in_flow_delay = 1s
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
home_mailbox = Maildir/
mail_spool_directory = /var/spool/mail
smtpd_banner = $myhostname ESMTP $mail_name
debug_peer_level = 2
debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.6.6/samples
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES

queue_directory = /var/spool/postfix

command_directory = /usr/sbin

daemon_directory = /usr/libexec/postfix

data_directory = /var/lib/postfix

mail_owner = postfix

myhostname = server1.kamaok.org.ua

mydomain = kamaok.org.ua

myorigin = $mydomain

inet_interfaces = all

inet_protocols = ipv4

mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

unknown_local_recipient_reject_code = 550

# Указываем доверенные адреса/подсети,с которых можно отправлять почту(с остальных адресов пересылка будет запрещена на внешние почтовые ящики(в мир)(с ошибкой при отправке Relay access denied)

mynetworks = 127.0.0.0/8 WWW.XXX.YYY.ZZZ

in_flow_delay = 1s

alias_maps = hash:/etc/aliases

alias_database = hash:/etc/aliases

home_mailbox = Maildir/

mail_spool_directory = /var/spool/mail

smtpd_banner = $myhostname ESMTP $mail_name

debug_peer_level = 2

debugger_command =

PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin

ddd $daemon_directory/$process_name $process_id & sleep 5

sendmail_path = /usr/sbin/sendmail.postfix

newaliases_path = /usr/bin/newaliases.postfix

mailq_path = /usr/bin/mailq.postfix

setgid_group = postdrop

html_directory = no

manpage_directory = /usr/share/man

sample_directory = /usr/share/doc/postfix-2.6.6/samples

readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES

2.Добавление в автозагрузку, проверка синтаксиса и запуск Postfix

# chkconfig --level 2345 postfix on

1	# chkconfig --level 2345 postfix on

# /etc/init.d/postfix check

1	# /etc/init.d/postfix check

# /etc/init.d/postfix start

1	# /etc/init.d/postfix start

3.Тестируем работоспособность Postfix Отправка письма на внешний почтовый ящик(например,на mail.ru)

# telnet localhost 25

1	# telnet localhost 25

Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 server1.kamaok.org.ua ESMTP Postfix

Trying ::1...

telnet: connect to address ::1: Connection refused

Trying 127.0.0.1...

Connected to localhost.

Escape character is '^]'.

220 server1.kamaok.org.ua ESMTP Postfix

ehlo localhost

1	ehlo localhost

250-server1.kamaok.org.ua
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

250-server1.kamaok.org.ua

250-PIPELINING

250-SIZE 10240000

250-VRFY

250-ETRN

250-ENHANCEDSTATUSCODES

250-8BITMIME

250 DSN

mail from:<username>@kamaok.org.ua

1	mail from:<username>@kamaok.org.ua

250 2.1.0 Ok

1	250 2.1.0 Ok

rcpt to:<username>@mail.ru

1	rcpt to:<username>@mail.ru

250 2.1.5 Ok

1	250 2.1.5 Ok

data

data

354 End data with <CR><LF>.<CR><LF>

1	354 End data with <CR><LF>.<CR><LF>

Welcome to my mail server
.

1 2	Welcome to my mail server .

250 2.0.0 Ok: queued as 125355E114F

1	250 2.0.0 Ok: queued as 125355E114F

# tail -f /var/log/maillog

1	# tail -f /var/log/maillog

Oct 7 22:55:13 server1 postfix/qmgr[1480]: 125355E114F: from=<<username>@kamaok.org.ua>, size=421, nrcpt=1 (queue active)
Oct 7 22:55:18 server1 postfix/smtp[1489]: 125355E114F: to=<<username>@mail.ru>;, relay=mxs.mail.ru[217.69.139.150]:25, delay=38, delays=33/0/0.4/4.3, dsn=2.0.0, status=sent (250 OK id=1Xbaqr-0008Bt-9a)
Oct 7 22:55:18 server1 postfix/qmgr[1480]: 125355E114F: removed

Oct 7 22:55:13 server1 postfix/qmgr[1480]: 125355E114F: from=<<username>@kamaok.org.ua>, size=421, nrcpt=1 (queue active)

Oct 7 22:55:18 server1 postfix/smtp[1489]: 125355E114F: to=<<username>@mail.ru>;, relay=mxs.mail.ru[217.69.139.150]:25, delay=38, delays=33/0/0.4/4.3, dsn=2.0.0, status=sent (250 OK id=1Xbaqr-0008Bt-9a)

Oct 7 22:55:18 server1 postfix/qmgr[1480]: 125355E114F: removed

Отправка письма самому себе

# telnet localhost 25

1	# telnet localhost 25

Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 server1.kamaok.org.ua ESMTP Postfix

Trying ::1...

telnet: connect to address ::1: Connection refused

Trying 127.0.0.1...

Connected to localhost.

Escape character is '^]'.

220 server1.kamaok.org.ua ESMTP Postfix

ehlo localhost

1	ehlo localhost

[…]

Опубликовано в рубрике Centos, Mail

Метки: dovecot, postfix, sasl, SSL

Комментарии отключены

Установка и настройка Postfix+Dovecot+Clamav+Spamassassin на FreeBSD 9

Ноябрь 10th, 2013

Evgeniy Kamenev

1.Установка и начальная настройка Postfix cd /usr/ports/mail/postfix make install clean nano /etc/rc.conf sendmail_enable=»NONE» postfix_enable=»YES» #sendmail_enable=»NO» #sendmail_submit_enable=»NO» #sendmail_outbound_enable=»NO» #sendmail_msp_queue_enable=»NO» nano /etc/periodic.conf daily_clean_hoststat_enable=»NO» daily_status_mail_rejects_enable=»NO» daily_status_include_submit_mailq=»NO» daily_submit_queuerun=»NO» cat /etc/group | grep mail mail:*:6:postfix ………………….. cd /usr/local/etc/postfix/ cp main.cf main.cf~ cp master.cf master.cf~ nano main.cf nano /etc/aliases newaliases tail -f /var/log/maillog /etc/rc.d/sendmail stop /usr/local/etc/rc.d/postfix […]

Опубликовано в рубрике FreeBSD, Mail

Метки: Clamav, dovecot, postfix, Spamassassin

Комментарии отключены

Установка и настройка Postfix+Dovecot+Clamav+Spamassassin+Amavis на Centos 5

Ноябрь 6th, 2013

Evgeniy Kamenev

Установка и настройка Postfix+Dovecot+Clamav+Spamassassin+Amavis на Centos 5 1.Установка и настройка Postfix и Dovecot

<b>yum install postfix dovecot </b>

1	<b>yum install postfix dovecot </b>

<b>yum remove sendmail</b>

1	<b>yum remove sendmail</b>

[root@guk5 ~]# rpm -qa | grep «postfix\|dovecot» postfix-2.3.3-6.el5 dovecot-1.0.7-7.el5_7.1

Как вариант можно установить system-switch-mail

1	Как вариант можно установить system-switch-mail

Через  <b>yum install system-switch-mail</b>

1	Через <b>yum install system-switch-mail</b>

И после этого запустить этот инструмент и выбрать Postfix как MTA по умолчанию Включение Sasl и TLS здесь описывать не буду(хотя конфиг уже включает их поддержку) Приводим /etc/postfix/main.cf к виду […]

Опубликовано в рубрике Centos, Mail

Метки: Amavis, Clamav, dovecot, postfix, Spamassassin

Комментарии отключены

Настройка fail2ban для защиты ssh,proftpd,exim,postfix,dovecot на Centos.

Ноябрь 6th, 2013

Evgeniy Kamenev

Установка fail2ban

# yum install fail2ban

1	# yum install fail2ban

1.Настройка конфигурационного файла fail2ban

# grep -v -E '(\#|^$)' /etc/fail2ban/fail2ban.conf

1	# grep -v -E '(\#\|^$)' /etc/fail2ban/fail2ban.conf

[Definition]
loglevel = INFO
logtarget = /var/log/fail2ban.log
syslogsocket = auto
socket = /var/run/fail2ban/fail2ban.sock
pidfile = /var/run/fail2ban/fail2ban.pid
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
dbpurgeage = 86400

[Definition]

loglevel = INFO

logtarget = /var/log/fail2ban.log

syslogsocket = auto

socket = /var/run/fail2ban/fail2ban.sock

pidfile = /var/run/fail2ban/fail2ban.pid

dbfile = /var/lib/fail2ban/fail2ban.sqlite3

dbpurgeage = 86400

2.Настройка Fail2ban для мониторинга логов

# grep -v -E '(\#|^$)' /etc/fail2ban/jail.conf

1	# grep -v -E '(\#\|^$)' /etc/fail2ban/jail.conf

[INCLUDES]
before = paths-fedora.conf
[DEFAULT]
ignoreip = 127.0.0.1/8 159.224.XXX.YYY
ignorecommand =
bantime  = 86400
findtime  = 7200
maxretry = 5
backend = auto
usedns = warn
logencoding = auto
enabled = false
filter = %(__name__)s
destemail = myuser@mydomain.com
sender = root@mydomain.com
mta = sendmail
protocol = tcp
chain = INPUT
port = 0:65535
banaction = iptables-multiport
action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
            %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
             %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
             xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]
action_blocklist_de  = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s"]
action_badips = badips.py[category="%(name)s", banaction="%(banaction)s"]
action = %(action_)s

### SSH
[sshd - iptables]
port = 2200
logpath  = /var/log/secure
maxretry = 3
enabled  = true
filter   = sshd
action = %(action_mwl)s
bantime  = 86400
findtime  = 3600
maxretry = 3

### ProFTPD
[proftpd-iptables]
port     = ftp,ftp-data,ftps,ftps-data
enabled  = true
filter   = proftpd
action = %(action_mwl)s
#action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
#          sendmail-whois[name=ProFTPD, dest=myname@mydomain.com, sender=root@mydomain.com]
logpath  = /var/log/proftpd/proftpd.log
bantime  = 86400
findtime  = 3600
maxretry = 3

###  Exim
[exim-iptables]
port   = smtp,465,submission
enabled  = true
filter   = exim
action = %(action_mwl)s
# action   =  iptables-multiport[name=Exim, port="smtp,smtps,submission", protocol=tcp]
#           sendmail-whois[name=Exim, dest= myname@mydomain.com, sender=root@mydomain.com]
logpath  = /var/log/exim/mainlog
bantime  = 86400
#bantime  = -1 # блокировка навсегда
findtime  = 3600
maxretry = 3

### Dovecot
[dovecot-iptables]
port   = pop3,pop3s,imap,imaps
enabled  = true
filter   = dovecot
action = %(action_mwl)s
# Необходимо указать файл,в котором логируются попытки аутентификации для Dovecot
logpath  = /var/log/secure
#logpath  = /var/log/maillog
#logpath  = /var/log/dovecot.log
bantime  = 86400
findtime  = 3600
maxretry = 3

### Postfix
[postfix-sasl]
enabled = true
port     = smtp,465,submission
logpath  = /var/log/maillog
filter   = postfix-sasl
action = %(action_mwl)s
#action   = iptables[name=postfix-sasl, port=smtp,smtps,submission protocol=tcp]
#           sendmail-whois[name=postfix-sasl, dest=myname@mydomain.com, sender=root@mydomain.com]
bantime  = 604800
findtime  = 3600
maxretry = 3

[postfix-iptables]
enabled = true
port     = smtp,465,submission
logpath = /var/log/maillog
filter = postfix
action = %(action_mwl)s
#action = iptables[name=Postfix-smtp, port=smtp, protocol=tcp]
#        sendmail[name=Postfix-smtp, dest=myname@mydomain.com, sender=root@mydomain.com]
logpath = /var/log/maillog
bantime = 604800
maxretry = 3
findtime = 3600

100

101

102

103

104

105

106

107

108

109

[INCLUDES]

before = paths-fedora.conf

[DEFAULT]

ignoreip = 127.0.0.1/8 159.224.XXX.YYY

ignorecommand =

bantime = 86400

findtime = 7200

maxretry = 5

backend = auto

usedns = warn

logencoding = auto

enabled = false

filter = %(__name__)s

destemail = myuser@mydomain.com

sender = root@mydomain.com

mta = sendmail

protocol = tcp

chain = INPUT

port = 0:65535

banaction = iptables-multiport

action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

%(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]

action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

%(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]

action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]

action_blocklist_de = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s"]

action_badips = badips.py[category="%(name)s", banaction="%(banaction)s"]

action = %(action_)s

### SSH

[sshd - iptables]

port = 2200

logpath = /var/log/secure

maxretry = 3

enabled = true

filter = sshd

action = %(action_mwl)s

bantime = 86400

findtime = 3600

maxretry = 3

### ProFTPD

[proftpd-iptables]

port = ftp,ftp-data,ftps,ftps-data

enabled = true

filter = proftpd

action = %(action_mwl)s

#action = iptables[name=ProFTPD, port=ftp, protocol=tcp]

# sendmail-whois[name=ProFTPD, dest=myname@mydomain.com, sender=root@mydomain.com]

logpath = /var/log/proftpd/proftpd.log

bantime = 86400

findtime = 3600

maxretry = 3

### Exim

[exim-iptables]

port = smtp,465,submission

enabled = true

filter = exim

action = %(action_mwl)s

# action = iptables-multiport[name=Exim, port="smtp,smtps,submission", protocol=tcp]

# sendmail-whois[name=Exim, dest= myname@mydomain.com, sender=root@mydomain.com]

logpath = /var/log/exim/mainlog

bantime = 86400

#bantime = -1 # блокировка навсегда

findtime = 3600

maxretry = 3

### Dovecot

[dovecot-iptables]

port = pop3,pop3s,imap,imaps

enabled = true

filter = dovecot

action = %(action_mwl)s

# Необходимо указать файл,в котором логируются попытки аутентификации для Dovecot

logpath = /var/log/secure

#logpath = /var/log/maillog

#logpath = /var/log/dovecot.log

bantime = 86400

findtime = 3600

maxretry = 3

### Postfix

[postfix-sasl]

enabled = true

port = smtp,465,submission

logpath = /var/log/maillog

filter = postfix-sasl

action = %(action_mwl)s

#action = iptables[name=postfix-sasl, port=smtp,smtps,submission protocol=tcp]

# sendmail-whois[name=postfix-sasl, dest=myname@mydomain.com, sender=root@mydomain.com]

bantime = 604800

findtime = 3600

maxretry = 3

[postfix-iptables]

enabled = true

port = smtp,465,submission

logpath = /var/log/maillog

filter = postfix

action = %(action_mwl)s

#action = iptables[name=Postfix-smtp, port=smtp, protocol=tcp]

# sendmail[name=Postfix-smtp, dest=myname@mydomain.com, sender=root@mydomain.com]

logpath = /var/log/maillog

bantime = 604800

maxretry = 3

findtime = 3600

3.Настройка Fail2ban фильтров для мониторинга логов Будем использовать все штатные фильтры, которые поставляются в комплекте с fail2ban SSH

# nano /etc/fail2ban/filter.d/sshd.conf

1	# nano /etc/fail2ban/filter.d/sshd.conf

[Definition]
_daemon = sshd
failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error) for .* from <HOST>( via \S+)?\s*$
            ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
            ^%(__prefix_line)sFailed \S+ for .*? from <HOST>(?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$
            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
            ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
            ^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
            ^%(__prefix_line)sUser .+ from <HOST> not allowed because not in any group\s*$
            ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
            ^%(__prefix_line)sReceived disconnect from <HOST>: 3: \S+: Auth fail$
            ^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*$
            ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
            ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \[preauth\]$
            ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \[preauth\]$
            ^(?P<__prefix>%(__prefix_line)s)Connection from <HOST> port \d+(?: on \S+ port \d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$
            ^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=<HOST>\s.*$
ignoreregex =

[Definition]

_daemon = sshd

failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error) for .* from <HOST>( via \S+)?\s*$

^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$

^%(__prefix_line)sFailed \S+ for .*? from <HOST>(?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ $serial \d+$ CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$

^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$

^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$

^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$

^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$

^%(__prefix_line)sUser .+ from <HOST> not allowed because not in any group\s*$

^%(__prefix_line)srefused connect from \S+ $<HOST>$\s*$

^%(__prefix_line)sReceived disconnect from <HOST>: 3: \S+: Auth fail$

^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*$

^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$

^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \[preauth\]$

^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \[preauth\]$

^(?P<__prefix>%(__prefix_line)s)Connection from <HOST> port \d+(?: on \S+ port \d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$

^%(__prefix_line)spam_unix$sshd:auth$:\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=<HOST>\s.*$

ignoreregex =

ProFTPD

# nano /etc/fail2ban/filter.d/proftpd.conf

1	# nano /etc/fail2ban/filter.d/proftpd.conf

[Definition]
_daemon = proftpd
__suffix_failed_login = (User not authorized for login|No such user found|Incorrect password|Password expired|Account disabled|Invalid shell: '\S+'|User in \S+|Limit ($

failregex = ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .*: no such user found from \S+ \[\S+\] to \S+:\S+ *$
            ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .* \(Login failed\): %(__suffix_failed_login)s\s*$
            ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: .* login attempted\. *$
            ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$
ignoreregex =

[Definition]

_daemon = proftpd

failregex = ^%(__prefix_line)s%(__hostname)s $\S+\[<HOST>\]$[: -]+ USER .*: no such user found from \S+ \[\S+\] to \S+:\S+ *$

^%(__prefix_line)s%(__hostname)s $\S+\[<HOST>\]$[: -]+ USER .* $Login failed$: %(__suffix_failed_login)s\s*$

^%(__prefix_line)s%(__hostname)s $\S+\[<HOST>\]$[: -]+ SECURITY VIOLATION: .* login attempted\. *$

^%(__prefix_line)s%(__hostname)s $\S+\[<HOST>\]$[: -]+ Maximum login attempts $\d+$ exceeded *$

ignoreregex =

Exim

# nano /etc/fail2ban/filter.d/exim.conf

1	# nano /etc/fail2ban/filter.d/exim.conf

[Definition]
failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
             ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s$
             ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
             ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
             ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
ignoreregex =

[Definition]

failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$

^%(pid)s \w+ authenticator failed for (\S+ )?$\S+$ \[<HOST>\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( $set_id=.*$|: \d+ Time\(s$

^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$

^%(pid)s SMTP protocol synchronization error $[^)]*$: rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$

^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands $last was "\S+"$\s*$

ignoreregex =

Dovecot

# nano /etc/fail2ban/filter.d/dovecot.conf

1	# nano /etc/fail2ban/filter.d/dovecot.conf

 [Definition]
_daemon = (auth|dovecot(-auth)?|auth-worker)
failregex = ^%(__prefix_line)s(%(__pam_auth)s(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\$
            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disab$
            ^%(__prefix_line)s(Info|dovecot: auth\(default\)|auth-worker\(\d+\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying aut$
            ^%(__prefix_line)s(auth|auth-worker\(\d+\)): (pam|passwd-file)\(\S+,<HOST>\): unknown user\s*$
ignoreregex =

[Definition]

_daemon = (auth|dovecot(-auth)?|auth-worker)

failregex = ^%(__prefix_line)s(%(__pam_auth)s($dovecot:auth$)?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\$

^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disab$

^%(__prefix_line)s(Info|dovecot: auth$default$|auth-worker$\d+$): pam$\S+,<HOST>$: pam_authenticate failed: (User not known to the underlying aut$

^%(__prefix_line)s(auth|auth-worker$\d+$): (pam|passwd-file)$\S+,<HOST>$: unknown user\s*$

ignoreregex =

Postfix

# nano /etc/fail2ban/filter.d/postfix-sasl.conf

1	# nano /etc/fail2ban/filter.d/postfix-sasl.conf

[Definition]
_daemon = postfix/(submission/)?smtp(d|s)
failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$
ignoreregex =

[Definition]

_daemon = postfix/(submission/)?smtp(d|s)

failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$

ignoreregex =

# nano /etc/fail2ban/filter.d/postfix.conf

1	# nano /etc/fail2ban/filter.d/postfix.conf

[Definition]
_daemon = postfix/(submission/)?smtp(d|s)
failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
            ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
            ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
            ^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$
            ^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[<HOST>\]:?$
ignoreregex =

[Definition]

_daemon = postfix/(submission/)?smtp(d|s)

failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$

^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$

^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$

^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$

^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[<HOST>\]:?$

ignoreregex =

4.Проверка работы фильтра […]

Опубликовано в рубрике Centos, Security

Метки: dovecot, Exim, fail2ban, postfix, Proftpd, security, ssh

Комментарии отключены

Тестирование Postfix-Dovecot+Привязка SSL к Dovecot

Ноябрь 6th, 2013

Evgeniy Kamenev

Тестирование Postfix-Dovecot+Привязка SSL к Dovecot Postfix(25 порт) freebsd9# telnet localhost 25 Trying 127.0.0.1… Connected to localhost. Escape character is ‘^]’. 220 freebds9.kamaok.org.ua ESMTP Postfix (2.9.5) helo localhost 250 freebds9.kamaok.org.ua mail from:<test@kamaok.org.ua> 250 2.1.0 Ok rcpt to:<test@kamaok.org.ua> 250 2.1.5 Ok data 354 End data with . hi thi is test message . 250 2.0.0 Ok: queued […]

Опубликовано в рубрике Centos, Linux/Unix General, Mail

Метки: dovecot, postfix, SSL

Комментарии отключены

Записи с меткой ‘dovecot’

Полезные команды Dovecot

Настройка пользовательский почтовых квот на связке Postfix+Dovecot+PostfxAdmin

Установка и настройка связки Exim+Dovecot+MySQL+PostixAdmin+Roundcube на Centos 7

Установка и настройка почтовой связки на основе Postfix+Dovecot+MySQL+PostfixAdmin+Roundcube на Debian 7/ Ubuntu 14.04

Установка и настройка Sendmail+Dovecot+TLS/SSL на Centos 7

Установка и настройка Postfix+Dovecot+Sasl+SSL на Centos 6

Установка и настройка Postfix+Dovecot+Clamav+Spamassassin на FreeBSD 9

Установка и настройка Postfix+Dovecot+Clamav+Spamassassin+Amavis на Centos 5

Настройка fail2ban для защиты ssh,proftpd,exim,postfix,dovecot на Centos.

Тестирование Postfix-Dovecot+Привязка SSL к Dovecot

Страницы

Свежие записи

Архивы

Рубрики

Админ-панель