Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:mail_c6:mta_13 [23.03.2014 21:25. ] – [dbCollecting script anlegen] django | centos:mail_c6:mta_13 [20.05.2021 12:41. ] (aktuell) – Externe Bearbeitung 127.0.0.1 | ||
|---|---|---|---|
| Zeile 2: | Zeile 2: | ||
| {{: | {{: | ||
| - | **DMARC**((**D**omain-based **M**essage **A**uthentication, | + | **DMARC**((**D**omain-based **M**essage **A**uthentication, |
| Hinweise zu DMARC findet man bei auch auf der Webseite von [[http:// | Hinweise zu DMARC findet man bei auch auf der Webseite von [[http:// | ||
| Zeile 18: | Zeile 18: | ||
| Das nachfolgende Schaubild zeigt den Bearbeitungsverlauf einer eMail mit Berücksichtigung auf DMARC auf. | Das nachfolgende Schaubild zeigt den Bearbeitungsverlauf einer eMail mit Berücksichtigung auf DMARC auf. | ||
| - | < | + | < |
| + | skinparam defaultFontName Courier | ||
| state " | state " | ||
| sender : ------------------------------------------- | sender : ------------------------------------------- | ||
| Zeile 43: | Zeile 43: | ||
| state " | state " | ||
| smtp_a : Versand der eMail | smtp_a : Versand der eMail | ||
| - | smtp_a : zum eMail-Server | + | smtp_a : zum eMail-Server |
| smtp_a : des Empfängers | smtp_a : des Empfängers | ||
| } | } | ||
| Zeile 178: | Zeile 178: | ||
| </ | </ | ||
| + | ===== Zusammenspiel von DKIM, SPF und DMARC ===== | ||
| + | |||
| + | <WRAP round important> | ||
| + | </ | ||
| + | |||
| + | Wir setzen daher bei unserer Installation jeweils folgende Pakete ein: | ||
| + | * **SPF** **smf-spf** aus [[http:// | ||
| + | * **DKIM** **opendkim** aus dem [[centos: | ||
| + | * **DMARC** **opendmarc** aus [[http:// | ||
| + | |||
| + | Die Installation von **SPF-Milter** ist im Kapitel [[centos: | ||
| + | |||
| + | |||
| + | |||
| + | |||
| ===== DMARC-Record ===== | ===== DMARC-Record ===== | ||
| ==== Beschreibung des Datensatzes ==== | ==== Beschreibung des Datensatzes ==== | ||
| Zeile 283: | Zeile 298: | ||
| Im Falle der x86_64-Pakete sind dies dann entsprechend folgende Pakete: | Im Falle der x86_64-Pakete sind dies dann entsprechend folgende Pakete: | ||
| - | # wget http:// | + | # wget http:// |
| - | # wget http:// | + | # wget http:// |
| ===== Installation ===== | ===== Installation ===== | ||
| - | # yum localinstall libopendmarc-1.2.0-1.el6.x86_64.rpm opendmarc-1.2.0-1.el6.x86_64.rpm | + | # yum localinstall libopendmarc-1.3.0-beta0.el6.x86_64.rpm opendmarc-1.3.0-beta0.el6.x86_64.rpm |
| # rpm -qil opendmarc | # rpm -qil opendmarc | ||
| - | < | + | < |
| - | Version | + | Release |
| - | Release | + | Install Date: Mon 28 Apr 2014 05:50:47 PM CEST Build Host: vml010039.intra.nausch.org |
| - | Install Date: Tue 18 Mar 2014 11:18:08 PM CET Build Host: vml010039.intra.nausch.org | + | Group : System Environment/ |
| - | Group : System Environment/ | + | Size : 175607 |
| - | Size : 173606 | + | Signature |
| - | Signature | + | |
| Packager | Packager | ||
| URL : http:// | URL : http:// | ||
| Zeile 321: | Zeile 335: | ||
| / | / | ||
| / | / | ||
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| / | / | ||
| / | / | ||
| Zeile 339: | Zeile 353: | ||
| </ | </ | ||
| + | # rpm -qil libopendmarc | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Install Date: Mon 28 Apr 2014 05:50:46 PM CEST Build Host: vml010039.intra.nausch.org | ||
| + | Group : System Environment/ | ||
| + | Size : 69016 License: BSD and Sendmail | ||
| + | Signature | ||
| + | Packager | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | This package contains the library files required for running services built | ||
| + | using libopendmarc. | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| - | ===== Konfiguration | + | ===== Konfigurations-Dokumentation |
| - | ==== Konfigurations-Dokumentation | + | ==== README |
| Viele hilfreiche Informationen zur Konfiguration von OpenDMARC finden sich in den nachfolgenden Dateien. | Viele hilfreiche Informationen zur Konfiguration von OpenDMARC finden sich in den nachfolgenden Dateien. | ||
| # less / | # less / | ||
| Zeile 504: | Zeile 535: | ||
| </ | </ | ||
| + | ==== README.schema ==== | ||
| # less / | # less / | ||
| <file / | <file / | ||
| Zeile 546: | Zeile 578: | ||
| </ | </ | ||
| + | ==== opendmarc.conf ==== | ||
| # man opendmarc.conf | # man opendmarc.conf | ||
| < | < | ||
| Zeile 780: | Zeile 813: | ||
| </ | </ | ||
| + | ==== opendmarc ==== | ||
| # man 8 opendmarc | # man 8 opendmarc | ||
| < | < | ||
| Zeile 887: | Zeile 921: | ||
| </ | </ | ||
| + | ==== reports-README ==== | ||
| # elinks http:// | # elinks http:// | ||
| < | < | ||
| Zeile 950: | Zeile 985: | ||
| </ | </ | ||
| + | ==== opendmarc.import ==== | ||
| # man opendmarc-import | # man opendmarc-import | ||
| Zeile 1008: | Zeile 1043: | ||
| </ | </ | ||
| + | ==== opendmarc-reports ==== | ||
| # man opendmarc-reports | # man opendmarc-reports | ||
| < | < | ||
| Zeile 1084: | Zeile 1120: | ||
| The Trusted Domain Project | The Trusted Domain Project | ||
| </ | </ | ||
| + | ===== Konfiguration ===== | ||
| ==== opendmarc Konfiguration ==== | ==== opendmarc Konfiguration ==== | ||
| Die Konfiguration von OpenDMARC erfolgt über die Konfigurationsdatei **opendmarc.conf** im Verzeichnis **/etc**. | Die Konfiguration von OpenDMARC erfolgt über die Konfigurationsdatei **opendmarc.conf** im Verzeichnis **/etc**. | ||
| Zeile 1096: | Zeile 1133: | ||
| ## AuthservID (string) | ## AuthservID (string) | ||
| - | ## defaults to MTA name | + | ## defaults to MTA name |
| ## | ## | ||
| ## Sets the " | ## Sets the " | ||
| Zeile 1108: | Zeile 1145: | ||
| ## AuthservIDWithJobID { true | false } | ## AuthservIDWithJobID { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## If " | ## If " | ||
| Zeile 1119: | Zeile 1156: | ||
| ## AutoRestart { true | false } | ## AutoRestart { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Automatically re-start on failures. Use with caution; if the filter fails | ## Automatically re-start on failures. Use with caution; if the filter fails | ||
| Zeile 1127: | Zeile 1164: | ||
| ## AutoRestartCount n | ## AutoRestartCount n | ||
| - | ## default 0 | + | ## default 0 |
| ## | ## | ||
| ## Sets the maximum automatic restart count. | ## Sets the maximum automatic restart count. | ||
| Zeile 1136: | Zeile 1173: | ||
| ## AutoRestartRate n/t[u] | ## AutoRestartRate n/t[u] | ||
| - | ## default (no limit) | + | ## default (no limit) |
| ## | ## | ||
| ## Sets the maximum automatic restart rate. If the filter begins restarting | ## Sets the maximum automatic restart rate. If the filter begins restarting | ||
| Zeile 1151: | Zeile 1188: | ||
| ## Background { true | false } | ## Background { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Causes opendmarc to fork and exits immediately, | ## Causes opendmarc to fork and exits immediately, | ||
| Zeile 1159: | Zeile 1196: | ||
| ## BaseDirectory (string) | ## BaseDirectory (string) | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## If set, instructs the filter to change to the specified directory using | ## If set, instructs the filter to change to the specified directory using | ||
| Zeile 1168: | Zeile 1205: | ||
| # | # | ||
| # BaseDirectory / | # BaseDirectory / | ||
| - | # Django : 2014-03-18 | ||
| - | BaseDirectory / | ||
| ## ChangeRootDirectory (string) | ## ChangeRootDirectory (string) | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Requests that the operating system change the effective root directory of | ## Requests that the operating system change the effective root directory of | ||
| Zeile 1182: | Zeile 1217: | ||
| ## CopyFailuresTo (string) | ## CopyFailuresTo (string) | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Requests addition of the specified email address to the envelope of | ## Requests addition of the specified email address to the envelope of | ||
| Zeile 1188: | Zeile 1223: | ||
| # | # | ||
| # CopyFailuresTo postmaster@localhost | # CopyFailuresTo postmaster@localhost | ||
| - | # Django : 2014-03-19 | ||
| - | CopyFailuresTo postmaster@nausch.org | ||
| ## DNSTimeout (integer) | ## DNSTimeout (integer) | ||
| - | ## default 5 | + | ## default 5 |
| ## | ## | ||
| ## Sets the DNS timeout in seconds. | ## Sets the DNS timeout in seconds. | ||
| Zeile 1200: | Zeile 1233: | ||
| ## EnableCoredumps { true | false } | ## EnableCoredumps { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## On systems that have such support, make an explicit request to the kernel | ## On systems that have such support, make an explicit request to the kernel | ||
| Zeile 1211: | Zeile 1244: | ||
| ## ForensicReports { true | false } | ## ForensicReports { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Enables generation of forensic reports when the DMARC test fails and the | ## Enables generation of forensic reports when the DMARC test fails and the | ||
| Zeile 1222: | Zeile 1255: | ||
| ## ForensicReportsBcc (string) | ## ForensicReportsBcc (string) | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## When forensic reports are enabled and one is to be generated, always | ## When forensic reports are enabled and one is to be generated, always | ||
| Zeile 1235: | Zeile 1268: | ||
| ## ForensicReportsOnNone { true | false } | ## ForensicReportsOnNone { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Supplements the " | ## Supplements the " | ||
| Zeile 1243: | Zeile 1276: | ||
| # | # | ||
| # ForensicReportsOnNone false | # ForensicReportsOnNone false | ||
| - | # Django : 2014-03-18 | ||
| - | ForensicReportsOnNone true | ||
| ## ForensicReportsSentBy string | ## ForensicReportsSentBy string | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Specifies the email address to use in the From: field of forensic | ## Specifies the email address to use in the From: field of forensic | ||
| Zeile 1260: | Zeile 1291: | ||
| ## HistoryFile path | ## HistoryFile path | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## If set, specifies the location of a text file to which records are written | ## If set, specifies the location of a text file to which records are written | ||
| Zeile 1271: | Zeile 1302: | ||
| # | # | ||
| HistoryFile / | HistoryFile / | ||
| + | |||
| ## IgnoreHosts path | ## IgnoreHosts path | ||
| - | ## default (internal) | + | ## default (internal) |
| ## | ## | ||
| ## Specifies the path to a file that contains a list of hostnames, IP | ## Specifies the path to a file that contains a list of hostnames, IP | ||
| Zeile 1285: | Zeile 1317: | ||
| ## IgnoreMailFrom domain[, | ## IgnoreMailFrom domain[, | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Gives a list of domain names whose mail (based on the From: domain) is to | ## Gives a list of domain names whose mail (based on the From: domain) is to | ||
| Zeile 1295: | Zeile 1327: | ||
| ## MilterDebug (integer) | ## MilterDebug (integer) | ||
| - | ## default 0 | + | ## default 0 |
| ## | ## | ||
| ## Sets the debug level to be requested from the milter library. | ## Sets the debug level to be requested from the milter library. | ||
| # | # | ||
| # MilterDebug 0 | # MilterDebug 0 | ||
| + | # Django : 2014-04-28 | ||
| + | MilterDebug 5 | ||
| ## PidFile path | ## PidFile path | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Specifies the path to a file that should be created at process start | ## Specifies the path to a file that should be created at process start | ||
| Zeile 1313: | Zeile 1347: | ||
| ## PublicSuffixList path | ## PublicSuffixList path | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Specifies the path to a file that contains top-level domains (TLDs) that | ## Specifies the path to a file that contains top-level domains (TLDs) that | ||
| Zeile 1324: | Zeile 1358: | ||
| ## RecordAllMessages { true | false } | ## RecordAllMessages { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## If set and " | ## If set and " | ||
| Zeile 1334: | Zeile 1368: | ||
| ## RejectFailures { true | false } | ## RejectFailures { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## If set, messages will be rejected if they fail the DMARC evaluation, or | ## If set, messages will be rejected if they fail the DMARC evaluation, or | ||
| Zeile 1343: | Zeile 1377: | ||
| # | # | ||
| # RejectFailures false | # RejectFailures false | ||
| + | # Django : 2014-03-24 | ||
| + | RejectFailures true | ||
| ## ReportCommand string | ## ReportCommand string | ||
| - | ## default "/ | + | ## default "/ |
| ## | ## | ||
| ## Indicates the shell command to which forensic reports should be passed for | ## Indicates the shell command to which forensic reports should be passed for | ||
| Zeile 1353: | Zeile 1389: | ||
| ## RequiredHeaders { true | false } | ## RequiredHeaders { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## If set, the filter will ensure the header of the message conforms to the | ## If set, the filter will ensure the header of the message conforms to the | ||
| Zeile 1364: | Zeile 1400: | ||
| ## Socket socketspec | ## Socket socketspec | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Specifies the socket that should be established by the filter to receive | ## Specifies the socket that should be established by the filter to receive | ||
| Zeile 1378: | Zeile 1414: | ||
| # Socket inet: | # Socket inet: | ||
| # Django : 2014-03-19 | # Django : 2014-03-19 | ||
| - | Socket inet:10003@localhost | + | Socket inet:10012@localhost |
| ## SoftwareHeader { true | false } | ## SoftwareHeader { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Causes the filter to add a " | ## Causes the filter to add a " | ||
| Zeile 1391: | Zeile 1427: | ||
| # Django : 2014-03-18 | # Django : 2014-03-18 | ||
| SoftwareHeader true | SoftwareHeader true | ||
| + | |||
| + | ## SPFIgnoreResults { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## Causes the filter to ignore any SPF results in the header of the | ||
| + | ## message. | ||
| + | ## itself, or because you don't trust the arriving header. | ||
| + | # | ||
| + | # SPFIgnoreResults false | ||
| + | |||
| + | ## SPFSelfValidate { true | false } | ||
| + | ## default false | ||
| + | ## | ||
| + | ## Causes the filter to perform a fallback SPF check itself when | ||
| + | ## it can find no SPF results in the message header. | ||
| + | ## is also set, it never looks for SPF results in headers and | ||
| + | ## always performs the SPF check itself when this is set. | ||
| + | # | ||
| + | # SPFSelfValidate false | ||
| + | # Django : 2014-04-28 | ||
| + | SPFSelfValidate true | ||
| ## Syslog { true | false } | ## Syslog { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Log via calls to syslog(3) any interesting activity. | ## Log via calls to syslog(3) any interesting activity. | ||
| Zeile 1402: | Zeile 1459: | ||
| ## SyslogFacility facility-name | ## SyslogFacility facility-name | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Log via calls to syslog(3) using the named facility. | ## Log via calls to syslog(3) using the named facility. | ||
| ## are the same as the ones allowed in syslog.conf(5). | ## are the same as the ones allowed in syslog.conf(5). | ||
| # | # | ||
| + | # SyslogFacility mail | ||
| ## TemporaryDirectory path | ## TemporaryDirectory path | ||
| - | ## default /var/tmp | + | ## default /var/tmp |
| ## | ## | ||
| ## Specifies the directory in which temporary files should be written. | ## Specifies the directory in which temporary files should be written. | ||
| Zeile 1416: | Zeile 1474: | ||
| ## TrustedAuthservIDs string | ## TrustedAuthservIDs string | ||
| - | ## default HOSTNAME | + | ## default HOSTNAME |
| ## | ## | ||
| ## Specifies one or more " | ## Specifies one or more " | ||
| Zeile 1428: | Zeile 1486: | ||
| ## UMask mask | ## UMask mask | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Requests a specific permissions mask to be used for file creation. | ## Requests a specific permissions mask to be used for file creation. | ||
| Zeile 1438: | Zeile 1496: | ||
| # | # | ||
| # UMask 077 | # UMask 077 | ||
| + | # Django : 2014-03-23 | ||
| + | UMask 007 | ||
| ## UserID user[: | ## UserID user[: | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Attempts to become the specified userid before starting operations. | ## Attempts to become the specified userid before starting operations. | ||
| Zeile 1448: | Zeile 1508: | ||
| # UserID opendmarc | # UserID opendmarc | ||
| # Django : 2014-03-23 | # Django : 2014-03-23 | ||
| - | UserID opendmarc:opendmarc | + | UserID opendmarc:dmarc |
| </ | </ | ||
| Zeile 1470: | Zeile 1530: | ||
| < | < | ||
| AuthservIDWithJobID true | AuthservIDWithJobID true | ||
| - | BaseDirectory / | ||
| - | CopyFailuresTo postmaster@nausch.org | ||
| ForensicReports true | ForensicReports true | ||
| ForensicReportsBcc postmaster@nausch.org | ForensicReportsBcc postmaster@nausch.org | ||
| Zeile 1479: | Zeile 1537: | ||
| IgnoreHosts / | IgnoreHosts / | ||
| PidFile / | PidFile / | ||
| - | Socket inet:10003@localhost | + | Socket inet:10012@localhost |
| SoftwareHeader true | SoftwareHeader true | ||
| Syslog true | Syslog true | ||
| - | UserID opendmarc:opendmarc | + | UserID opendmarc:dmarc |
| </ | </ | ||
| Zeile 1711: | Zeile 1769: | ||
| ... | ... | ||
| </ | </ | ||
| - | ===== Programmstart ===== | ||
| - | # service opendmarc start | + | ==== Postfix ==== |
| + | Die Konfiguration auf Seiten unseres Postfix-Mailserver gestaltet sich relativ einfach, muss doch nur ein zusätzlicher [[http:// | ||
| + | # vim / | ||
| - | | + | <file bash / |
| - | | + | |
| + | # Django : 2014-03-19 | ||
| + | # SPF-Check und DKIM-Signaturüberprüfung via SMF-SPF- und DKIM-Milter einbinden. | ||
| + | smtpd_milters = | ||
| + | # SMF-SPF-Milter | ||
| + | | ||
| + | # DKIM-Milter: | ||
| + | | ||
| + | # DMARC-Milter | ||
| + | | ||
| + | |||
| + | ... | ||
| + | </ | ||
| + | |||
| + | ===== erster manueller Programmstart ===== | ||
| + | Nun ist es an der Zeit unseren DMARC-Daemon das erste mal zu starten. | ||
| + | # service opendmarc start | ||
| + | Im / | ||
| + | Apr 28 19:32:24 vml000080 opendmarc[28728]: | ||
| + | Apr 28 19:32:24 vml000080 opendmarc[28729]: OpenDMARC Filter v1.3.0 starting (args: -c / | ||
| + | | ||
| + | Über den Port 10012 sollte nun unser daemon ansprechbar sein. Was wir auch sehr einfach mittels **lsof** überprüfen können: | ||
| # lsof -i :10003 | # lsof -i :10003 | ||
| Zeile 1724: | Zeile 1804: | ||
| opendmarc 13533 root 3u IPv4 115489 | opendmarc 13533 root 3u IPv4 115489 | ||
| + | Auch mit Hilfe von **netstat** können wir abfragen, ob der Port **1003** in Verwendung ist. | ||
| + | # netstat -tulpen | grep 10012 | ||
| - | # netstat | + | tcp 0 0 127.0.0.1: |
| + | |||
| + | Anschließend können wir nun auch unseren Postfix-Mailserver durchstarten, | ||
| + | |||
| + | ===== automatisches Starten des Dienste beim Systemstart ===== | ||
| + | Damit nun unser DMARC-Daemon beim Booten unseres Servers automatisch gestartet wird, nehmen wir noch folgende Konfigurationsschritte vor. | ||
| + | # chkconfig opendmarc on | ||
| + | |||
| + | Anschließend überprüfen wir noch unsere Änderung: | ||
| + | # chkconfig --list | grep opendmarc | ||
| + | |||
| + | opendmarc | ||
| - | tcp 0 0 127.0.0.1: | ||
| ===== Logging / Mailheader ===== | ===== Logging / Mailheader ===== | ||
| + | Im Maillog werden entsprechend unserer zuvor festgelegten Konfiguration, | ||
| + | Folgender Logeintrag zeigt einen erfolgreiche DMARC-Überprüfung. | ||
| + | Mar 23 22:46:01 vml000080 opendmarc[25914]: | ||
| - | | + | Im Mailheader der Nachricht, wird dies auch entsprechend vermerkt. |
| - | Authentication-Results: | + | |
| + | Authentication-Results: | ||
| + | Hat der Domainbetreiber keinen DMARC-Eintrag im DNS hinterlegt, sieht die betreffende Zeile im Maillog entsprechend so aus. | ||
| + | Mar 19 00:22:36 vml000080 opendmarc[14508]: | ||
| + | Auch dies wird im Mailheader entsprechend vermerkt. | ||
| + | DMARC-Filter: | ||
| + | Authentication-Results: | ||
django