Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:mail_c6:mta_13 [27.03.2014 15:58. ] – [Zusammenspiel von DKIM, SPF und DMARC] django | centos:mail_c6:mta_13 [20.05.2021 12:41. ] (aktuell) – Externe Bearbeitung 127.0.0.1 | ||
|---|---|---|---|
| Zeile 2: | Zeile 2: | ||
| {{: | {{: | ||
| - | <WRAP round important> | + | **DMARC**((**D**omain-based **M**essage **A**uthentication, |
| - | </ | + | |
| - | + | ||
| - | **DMARC**((**D**omain-based **M**essage **A**uthentication, | + | |
| Hinweise zu DMARC findet man bei auch auf der Webseite von [[http:// | Hinweise zu DMARC findet man bei auch auf der Webseite von [[http:// | ||
| Zeile 21: | Zeile 18: | ||
| Das nachfolgende Schaubild zeigt den Bearbeitungsverlauf einer eMail mit Berücksichtigung auf DMARC auf. | Das nachfolgende Schaubild zeigt den Bearbeitungsverlauf einer eMail mit Berücksichtigung auf DMARC auf. | ||
| - | < | + | < |
| + | skinparam defaultFontName Courier | ||
| state " | state " | ||
| sender : ------------------------------------------- | sender : ------------------------------------------- | ||
| Zeile 46: | Zeile 43: | ||
| state " | state " | ||
| smtp_a : Versand der eMail | smtp_a : Versand der eMail | ||
| - | smtp_a : zum eMail-Server | + | smtp_a : zum eMail-Server |
| smtp_a : des Empfängers | smtp_a : des Empfängers | ||
| } | } | ||
| Zeile 183: | Zeile 180: | ||
| ===== Zusammenspiel von DKIM, SPF und DMARC ===== | ===== Zusammenspiel von DKIM, SPF und DMARC ===== | ||
| - | <WRAP round tip> \\ Möchten wir DMARC bei unserem Mailserver einsetzen, ist es wichtig, dass alle drei Komponenten via **Milter**((**M**ail-F**ilter**)) an unseren Postfix-Mailserver angebunden werden. Nur so stehen dem **DMARC**-Daemon alle relevanten Headerinformationen zur Bewertung zur Verfügung. \\ | + | <WRAP round important> \\ Möchten wir DMARC bei unserem Mailserver einsetzen, ist es wichtig, dass alle drei Komponenten via **Milter**((**M**ail-F**ilter**)) an unseren Postfix-Mailserver angebunden werden. Nur so stehen dem **DMARC**-Daemon alle relevanten Headerinformationen zur Bewertung zur Verfügung. \\ |
| </ | </ | ||
| Zeile 301: | Zeile 298: | ||
| Im Falle der x86_64-Pakete sind dies dann entsprechend folgende Pakete: | Im Falle der x86_64-Pakete sind dies dann entsprechend folgende Pakete: | ||
| - | # wget http:// | + | # wget http:// |
| - | # wget http:// | + | # wget http:// |
| ===== Installation ===== | ===== Installation ===== | ||
| - | # yum localinstall libopendmarc-1.2.0-1.el6.x86_64.rpm opendmarc-1.2.0-1.el6.x86_64.rpm | + | # yum localinstall libopendmarc-1.3.0-beta0.el6.x86_64.rpm opendmarc-1.3.0-beta0.el6.x86_64.rpm |
| # rpm -qil opendmarc | # rpm -qil opendmarc | ||
| - | < | + | < |
| - | Version | + | Release |
| - | Release | + | Install Date: Mon 28 Apr 2014 05:50:47 PM CEST Build Host: vml010039.intra.nausch.org |
| - | Install Date: Tue 18 Mar 2014 11:18:08 PM CET Build Host: vml010039.intra.nausch.org | + | Group : System Environment/ |
| - | Group : System Environment/ | + | Size : 175607 |
| - | Size : 173606 | + | Signature |
| - | Signature | + | |
| Packager | Packager | ||
| URL : http:// | URL : http:// | ||
| Zeile 339: | Zeile 335: | ||
| / | / | ||
| / | / | ||
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| - | / | + | / |
| / | / | ||
| / | / | ||
| Zeile 357: | Zeile 353: | ||
| </ | </ | ||
| + | # rpm -qil libopendmarc | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Install Date: Mon 28 Apr 2014 05:50:46 PM CEST Build Host: vml010039.intra.nausch.org | ||
| + | Group : System Environment/ | ||
| + | Size : 69016 License: BSD and Sendmail | ||
| + | Signature | ||
| + | Packager | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | This package contains the library files required for running services built | ||
| + | using libopendmarc. | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| - | ===== Konfiguration | + | ===== Konfigurations-Dokumentation |
| - | ==== Konfigurations-Dokumentation | + | ==== README |
| Viele hilfreiche Informationen zur Konfiguration von OpenDMARC finden sich in den nachfolgenden Dateien. | Viele hilfreiche Informationen zur Konfiguration von OpenDMARC finden sich in den nachfolgenden Dateien. | ||
| # less / | # less / | ||
| Zeile 522: | Zeile 535: | ||
| </ | </ | ||
| + | ==== README.schema ==== | ||
| # less / | # less / | ||
| <file / | <file / | ||
| Zeile 564: | Zeile 578: | ||
| </ | </ | ||
| + | ==== opendmarc.conf ==== | ||
| # man opendmarc.conf | # man opendmarc.conf | ||
| < | < | ||
| Zeile 798: | Zeile 813: | ||
| </ | </ | ||
| + | ==== opendmarc ==== | ||
| # man 8 opendmarc | # man 8 opendmarc | ||
| < | < | ||
| Zeile 905: | Zeile 921: | ||
| </ | </ | ||
| + | ==== reports-README ==== | ||
| # elinks http:// | # elinks http:// | ||
| < | < | ||
| Zeile 968: | Zeile 985: | ||
| </ | </ | ||
| + | ==== opendmarc.import ==== | ||
| # man opendmarc-import | # man opendmarc-import | ||
| Zeile 1026: | Zeile 1043: | ||
| </ | </ | ||
| + | ==== opendmarc-reports ==== | ||
| # man opendmarc-reports | # man opendmarc-reports | ||
| < | < | ||
| Zeile 1102: | Zeile 1120: | ||
| The Trusted Domain Project | The Trusted Domain Project | ||
| </ | </ | ||
| + | ===== Konfiguration ===== | ||
| ==== opendmarc Konfiguration ==== | ==== opendmarc Konfiguration ==== | ||
| Die Konfiguration von OpenDMARC erfolgt über die Konfigurationsdatei **opendmarc.conf** im Verzeichnis **/etc**. | Die Konfiguration von OpenDMARC erfolgt über die Konfigurationsdatei **opendmarc.conf** im Verzeichnis **/etc**. | ||
| Zeile 1114: | Zeile 1133: | ||
| ## AuthservID (string) | ## AuthservID (string) | ||
| - | ## defaults to MTA name | + | ## defaults to MTA name |
| ## | ## | ||
| ## Sets the " | ## Sets the " | ||
| Zeile 1126: | Zeile 1145: | ||
| ## AuthservIDWithJobID { true | false } | ## AuthservIDWithJobID { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## If " | ## If " | ||
| Zeile 1137: | Zeile 1156: | ||
| ## AutoRestart { true | false } | ## AutoRestart { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Automatically re-start on failures. Use with caution; if the filter fails | ## Automatically re-start on failures. Use with caution; if the filter fails | ||
| Zeile 1145: | Zeile 1164: | ||
| ## AutoRestartCount n | ## AutoRestartCount n | ||
| - | ## default 0 | + | ## default 0 |
| ## | ## | ||
| ## Sets the maximum automatic restart count. | ## Sets the maximum automatic restart count. | ||
| Zeile 1154: | Zeile 1173: | ||
| ## AutoRestartRate n/t[u] | ## AutoRestartRate n/t[u] | ||
| - | ## default (no limit) | + | ## default (no limit) |
| ## | ## | ||
| ## Sets the maximum automatic restart rate. If the filter begins restarting | ## Sets the maximum automatic restart rate. If the filter begins restarting | ||
| Zeile 1169: | Zeile 1188: | ||
| ## Background { true | false } | ## Background { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Causes opendmarc to fork and exits immediately, | ## Causes opendmarc to fork and exits immediately, | ||
| Zeile 1177: | Zeile 1196: | ||
| ## BaseDirectory (string) | ## BaseDirectory (string) | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## If set, instructs the filter to change to the specified directory using | ## If set, instructs the filter to change to the specified directory using | ||
| Zeile 1188: | Zeile 1207: | ||
| ## ChangeRootDirectory (string) | ## ChangeRootDirectory (string) | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Requests that the operating system change the effective root directory of | ## Requests that the operating system change the effective root directory of | ||
| Zeile 1198: | Zeile 1217: | ||
| ## CopyFailuresTo (string) | ## CopyFailuresTo (string) | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Requests addition of the specified email address to the envelope of | ## Requests addition of the specified email address to the envelope of | ||
| Zeile 1206: | Zeile 1225: | ||
| ## DNSTimeout (integer) | ## DNSTimeout (integer) | ||
| - | ## default 5 | + | ## default 5 |
| ## | ## | ||
| ## Sets the DNS timeout in seconds. | ## Sets the DNS timeout in seconds. | ||
| Zeile 1214: | Zeile 1233: | ||
| ## EnableCoredumps { true | false } | ## EnableCoredumps { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## On systems that have such support, make an explicit request to the kernel | ## On systems that have such support, make an explicit request to the kernel | ||
| Zeile 1225: | Zeile 1244: | ||
| ## ForensicReports { true | false } | ## ForensicReports { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Enables generation of forensic reports when the DMARC test fails and the | ## Enables generation of forensic reports when the DMARC test fails and the | ||
| Zeile 1236: | Zeile 1255: | ||
| ## ForensicReportsBcc (string) | ## ForensicReportsBcc (string) | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## When forensic reports are enabled and one is to be generated, always | ## When forensic reports are enabled and one is to be generated, always | ||
| Zeile 1249: | Zeile 1268: | ||
| ## ForensicReportsOnNone { true | false } | ## ForensicReportsOnNone { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Supplements the " | ## Supplements the " | ||
| Zeile 1257: | Zeile 1276: | ||
| # | # | ||
| # ForensicReportsOnNone false | # ForensicReportsOnNone false | ||
| - | # Django : 2014-03-18 | ||
| - | ForensicReportsOnNone true | ||
| ## ForensicReportsSentBy string | ## ForensicReportsSentBy string | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Specifies the email address to use in the From: field of forensic | ## Specifies the email address to use in the From: field of forensic | ||
| Zeile 1274: | Zeile 1291: | ||
| ## HistoryFile path | ## HistoryFile path | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## If set, specifies the location of a text file to which records are written | ## If set, specifies the location of a text file to which records are written | ||
| Zeile 1285: | Zeile 1302: | ||
| # | # | ||
| HistoryFile / | HistoryFile / | ||
| + | |||
| ## IgnoreHosts path | ## IgnoreHosts path | ||
| - | ## default (internal) | + | ## default (internal) |
| ## | ## | ||
| ## Specifies the path to a file that contains a list of hostnames, IP | ## Specifies the path to a file that contains a list of hostnames, IP | ||
| Zeile 1299: | Zeile 1317: | ||
| ## IgnoreMailFrom domain[, | ## IgnoreMailFrom domain[, | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Gives a list of domain names whose mail (based on the From: domain) is to | ## Gives a list of domain names whose mail (based on the From: domain) is to | ||
| Zeile 1309: | Zeile 1327: | ||
| ## MilterDebug (integer) | ## MilterDebug (integer) | ||
| - | ## default 0 | + | ## default 0 |
| ## | ## | ||
| ## Sets the debug level to be requested from the milter library. | ## Sets the debug level to be requested from the milter library. | ||
| # | # | ||
| # MilterDebug 0 | # MilterDebug 0 | ||
| + | # Django : 2014-04-28 | ||
| + | MilterDebug 5 | ||
| ## PidFile path | ## PidFile path | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Specifies the path to a file that should be created at process start | ## Specifies the path to a file that should be created at process start | ||
| Zeile 1327: | Zeile 1347: | ||
| ## PublicSuffixList path | ## PublicSuffixList path | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Specifies the path to a file that contains top-level domains (TLDs) that | ## Specifies the path to a file that contains top-level domains (TLDs) that | ||
| Zeile 1338: | Zeile 1358: | ||
| ## RecordAllMessages { true | false } | ## RecordAllMessages { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## If set and " | ## If set and " | ||
| Zeile 1348: | Zeile 1368: | ||
| ## RejectFailures { true | false } | ## RejectFailures { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## If set, messages will be rejected if they fail the DMARC evaluation, or | ## If set, messages will be rejected if they fail the DMARC evaluation, or | ||
| Zeile 1357: | Zeile 1377: | ||
| # | # | ||
| # RejectFailures false | # RejectFailures false | ||
| + | # Django : 2014-03-24 | ||
| + | RejectFailures true | ||
| ## ReportCommand string | ## ReportCommand string | ||
| - | ## default "/ | + | ## default "/ |
| ## | ## | ||
| ## Indicates the shell command to which forensic reports should be passed for | ## Indicates the shell command to which forensic reports should be passed for | ||
| Zeile 1367: | Zeile 1389: | ||
| ## RequiredHeaders { true | false } | ## RequiredHeaders { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## If set, the filter will ensure the header of the message conforms to the | ## If set, the filter will ensure the header of the message conforms to the | ||
| Zeile 1378: | Zeile 1400: | ||
| ## Socket socketspec | ## Socket socketspec | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Specifies the socket that should be established by the filter to receive | ## Specifies the socket that should be established by the filter to receive | ||
| Zeile 1392: | Zeile 1414: | ||
| # Socket inet: | # Socket inet: | ||
| # Django : 2014-03-19 | # Django : 2014-03-19 | ||
| - | Socket inet:10003@localhost | + | Socket inet:10012@localhost |
| ## SoftwareHeader { true | false } | ## SoftwareHeader { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Causes the filter to add a " | ## Causes the filter to add a " | ||
| Zeile 1405: | Zeile 1427: | ||
| # Django : 2014-03-18 | # Django : 2014-03-18 | ||
| SoftwareHeader true | SoftwareHeader true | ||
| + | |||
| + | ## SPFIgnoreResults { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## Causes the filter to ignore any SPF results in the header of the | ||
| + | ## message. | ||
| + | ## itself, or because you don't trust the arriving header. | ||
| + | # | ||
| + | # SPFIgnoreResults false | ||
| + | |||
| + | ## SPFSelfValidate { true | false } | ||
| + | ## default false | ||
| + | ## | ||
| + | ## Causes the filter to perform a fallback SPF check itself when | ||
| + | ## it can find no SPF results in the message header. | ||
| + | ## is also set, it never looks for SPF results in headers and | ||
| + | ## always performs the SPF check itself when this is set. | ||
| + | # | ||
| + | # SPFSelfValidate false | ||
| + | # Django : 2014-04-28 | ||
| + | SPFSelfValidate true | ||
| ## Syslog { true | false } | ## Syslog { true | false } | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Log via calls to syslog(3) any interesting activity. | ## Log via calls to syslog(3) any interesting activity. | ||
| Zeile 1416: | Zeile 1459: | ||
| ## SyslogFacility facility-name | ## SyslogFacility facility-name | ||
| - | ## default " | + | ## default " |
| ## | ## | ||
| ## Log via calls to syslog(3) using the named facility. | ## Log via calls to syslog(3) using the named facility. | ||
| ## are the same as the ones allowed in syslog.conf(5). | ## are the same as the ones allowed in syslog.conf(5). | ||
| # | # | ||
| + | # SyslogFacility mail | ||
| ## TemporaryDirectory path | ## TemporaryDirectory path | ||
| - | ## default /var/tmp | + | ## default /var/tmp |
| ## | ## | ||
| ## Specifies the directory in which temporary files should be written. | ## Specifies the directory in which temporary files should be written. | ||
| Zeile 1430: | Zeile 1474: | ||
| ## TrustedAuthservIDs string | ## TrustedAuthservIDs string | ||
| - | ## default HOSTNAME | + | ## default HOSTNAME |
| ## | ## | ||
| ## Specifies one or more " | ## Specifies one or more " | ||
| Zeile 1442: | Zeile 1486: | ||
| ## UMask mask | ## UMask mask | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Requests a specific permissions mask to be used for file creation. | ## Requests a specific permissions mask to be used for file creation. | ||
| Zeile 1452: | Zeile 1496: | ||
| # | # | ||
| # UMask 077 | # UMask 077 | ||
| + | # Django : 2014-03-23 | ||
| + | UMask 007 | ||
| ## UserID user[: | ## UserID user[: | ||
| - | ## default (none) | + | ## default (none) |
| ## | ## | ||
| ## Attempts to become the specified userid before starting operations. | ## Attempts to become the specified userid before starting operations. | ||
| Zeile 1491: | Zeile 1537: | ||
| IgnoreHosts / | IgnoreHosts / | ||
| PidFile / | PidFile / | ||
| - | Socket inet:10003@localhost | + | Socket inet:10012@localhost |
| SoftwareHeader true | SoftwareHeader true | ||
| Syslog true | Syslog true | ||
| Zeile 1731: | Zeile 1777: | ||
| # Django : 2014-03-19 | # Django : 2014-03-19 | ||
| - | # DMARC Test | + | # SPF-Check und DKIM-Signaturüberprüfung via SMF-SPF- und DKIM-Milter einbinden. |
| - | smtpd_milters = inet: | + | smtpd_milters = |
| + | # SMF-SPF-Milter | ||
| + | | ||
| + | # DKIM-Milter: | ||
| + | | ||
| + | # DMARC-Milter | ||
| + | inet: | ||
| ... | ... | ||
| Zeile 1741: | Zeile 1793: | ||
| # service opendmarc start | # service opendmarc start | ||
| Im / | Im / | ||
| - | | + | |
| - | | + | Apr 28 19:32:24 vml000080 opendmarc[28729]: OpenDMARC Filter v1.3.0 starting (args: -c / |
| + | | ||
| - | Über den Port 10003 sollte nun unser daemon ansprechbar sein. Was wir auch sehr einfach mittels **lsof** überprüfen können: | + | Über den Port 10012 sollte nun unser daemon ansprechbar sein. Was wir auch sehr einfach mittels **lsof** überprüfen können: |
| # lsof -i :10003 | # lsof -i :10003 | ||
| Zeile 1751: | Zeile 1805: | ||
| Auch mit Hilfe von **netstat** können wir abfragen, ob der Port **1003** in Verwendung ist. | Auch mit Hilfe von **netstat** können wir abfragen, ob der Port **1003** in Verwendung ist. | ||
| - | # netstat -tulpen | grep 10003 | + | # netstat -tulpen | grep 10012 |
| - | tcp 0 0 127.0.0.1:10003 0.0.0.0: | + | tcp 0 0 127.0.0.1:10012 0.0.0.0: |
| Anschließend können wir nun auch unseren Postfix-Mailserver durchstarten, | Anschließend können wir nun auch unseren Postfix-Mailserver durchstarten, | ||
django