Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- centos:mail_c6:mta_14 [18.03.2014 16:31. ] – django
+++ centos:mail_c6:mta_14 [28.03.2014 10:27. ] – django
@@ Zeile 281: / Zeile 281: @@
    # chmod +x /usr/local/sbin/postsrsd
+Nun benötigen wir noch ein passendes Shell-Script für unseren **PostSRSd**.
+   # vim /etc/init.d/postsrsd
+<file bash /etc/init.d/postsrsd>#!/bin/bash
+#
+# postsrsd	     Sender Rewriting Scheme (SRS) for Postfix
+#
+# chkconfig:         2345 75 35
+# description:	     PostSRSd provides Sender Rewriting Scheme (SRS) for \
+#                    the popular and secure Postfix Mail Transport Agent
+# processname:	     postsrsd
+# pidfile:	     /var/run/postsrsd.pid
+# config:	     /etc/default/postsrsd
+# sec-key:	     /etc/postsrsd.secret
+### BEGIN INIT INFO
+# Provides:          postsrsd
+# Required-Start:    $local_fs $network $remote_fs
+# Required-Stop:     $local_fs $network $remote_fs
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: start and stop postsrsd
+# Description:       PostSRSd provides Sender Rewriting Scheme (SRS) for
+#                    the popular and secure Postfix Mail Transport Agent
+### END INIT INFO
+# Source function library.
+. /etc/rc.d/init.d/functions
+# Source networking configuration.
+. /etc/sysconfig/network
+RETVAL=0
+POSTSRSD_CONFIG="/etc/default/postsrsd"
+NAME="postsrsd"
+DAEMON="/usr/local/sbin/postsrsd"
+PID_FILE="/var/run/$NAME.pid"
+SCRIPTNAME="/etc/init.d/$NAME"
+DESC="Postfix Sender Rewriting Scheme Daemon"
+if [ -f $POSTSRSD_CONFIG ]; then
+  . $POSTSRSD_CONFIG
+else
+  exit 0
+fi
+test -x $DAEMON || exit 0
+# Read config file if it is present.
+if [ -r /etc/default/$NAME ]
+then
+    . /etc/default/$NAME
+fi
+do_start()
+{
+	echo -n "Starting $DESC: "
+	daemon $DAEMON -4 -f"$SRS_FORWARD_PORT" -r"$SRS_REVERSE_PORT" -d"$SRS_DOMAIN" -s"$SRS_SECRET" \
+	               -u"$RUN_AS" -p"$PIDFILE" -c"$CHROOT" -X"$SRS_EXCLUDE_DOMAINS" -D
+	RETVAL=$?
+	echo
+    	[ $RETVAL -eq 0 ] && touch /var/lock/subsys/$NAME
+    	return $RETVAL
+}
+do_stop()
+{
+	echo -n "Stopping $DESC: "
+	killproc $NAME
+        RETVAL=$?
+        echo
+        [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$NAME
+        return $RETVAL
+}
+case "$1" in
+  start)
+	do_start
+	;;
+  stop)
+	do_stop
+	;;
+  status)
+	status $NAME
+	;;
+  restart|force-reload)
+	do_stop
+	do_start
+	;;
+  reload)
+	;;
+  condrestart|try-restart)
+	if [ -f /var/lock/subsys/$NAME ]; then
+		do_stop
+		do_start
+	fi
+	;;
+  *)
+	echo "Usage: $NAME {start|stop|restart|condrestart|try-restart|reload|force-reload|status|usage}"
+	[ "$1" = "usage" ] && exit 0
+	exit 2
+	;;
+esac
+exit $?
+</file>
 ===== Konfiguration =====
 ==== SRS-Deamon ====
+Auf unserem Entwicklungsrechner finden wir eine README-Datei mit weiteren Informationen.
+   # less /usr/local/src/postsrsd-master/README.md
+<file bash README.md>
+About
+=====
+PostSRSd provides the Sender Rewriting Scheme (SRS) via TCP-based
+lookup tables for Postfix. SRS is needed if your mail server acts
+as forwarder.
+Imagine your server receives a mail from alice@example.com
+that is to be forwarded. If example.com uses the Sender Policy Framework
+to indicate that all legit mails originate from their server, your
+forwarded mail might be bounced, because you have no permission to send
+on behalf of example.com. The solution is that you map the address to
+your own domain, e.g.
+SRS0+xxxx=yy=example.com=alice@yourdomain.org (forward SRS). If the
+mail is bounced later and a notification arrives, you can extract the
+original address from the rewritten one (revere SRS) and return the
+notification to the sender. You might notice that the reverse SRS can
+be abused to turn your server into an open relay. For this reason, xxxx
+and yy are a cryptographic signature and a time stamp. If the signature
+does not match, the address is forged and the mail can be discarded.
+Building
+========
+PostSRSd requires a POSIX compatible system and CMake to build.
+Optionally, help2man is used to create a manual page.
+For convenience, a Makefile fragment is provided which calls CMake with
+the recommended command line options. Just run `make`.
+Installing
+==========
+Run `make install` as root to install the daemon and the configuration
+files.
+Configuration
+=============
+The configuration is located in `/etc/default/postsrsd`. You must store
+at least one secret key in `/etc/postsrsd.secret`. The installer tries to generate
+one from `/dev/urandom`. Be careful that no one can guess your secret,
+because anyone who knows it can use your mail server as open relay!
+Each line of `/etc/postsrsd.secret` is used as secret. The first secret is
+used for signing and verification, the others for verification only.
+PostSRSd exposes its functionality via two TCP lookup tables. The
+recommended Postfix configuration is to add the following fragment to
+your main.cf:
+    sender_canonical_maps = tcp:127.0.0.1:10001
+    sender_canonical_classes = envelope_sender
+    recipient_canonical_maps = tcp:127.0.0.1:10002
+    recipient_canonical_classes= envelope_recipient
+This will transparently rewrite incoming and outgoing envelope addresses.
+Run `service postsrsd start` and `postfix reload` as root, or reboot.
+</file>
+Wir legen uns nun im ersten Schritt für unsere Konfigurationsdatei im entsprechende Verzeichnis an.
+   # vim /etc/default/postsrsd
+<file bash /etc/default/postsrsd># Default settings for postsrsd
+# Local domain name.
+# Addresses are rewritten to originate from this domain. The default value
+# is taken from `postconf -h mydomain` and probably okay.
+#
+# Django : 2014-03-17
+# default: #SRS_DOMAIN=example.com
+SRS_DOMAIN=nausch.org
+# Exclude additional domains.
+# You may list domains which shall not be subjected to address rewriting.
+# If a domain name starts with a dot, it matches all subdomains, but not
+# the domain itself. Separate multiple domains by space or comma.
+#
+#SRS_EXCLUDE_DOMAINS=.example.com,example.org
+# Secret key to sign rewritten addresses.
+# When postsrsd is installed for the first time, a random secret is generated
+# and stored in /etc/postsrsd.secret. For most installations, that's just fine.
+#
+SRS_SECRET=/etc/postsrsd.secret
+# Local ports for TCP list.
+# These ports are used to bind the TCP list for postfix. If you change
+# these, you have to modify the postfix settings accordingly. The ports
+# are bound to the loopback interface, and should never be exposed on
+# the internet.
+#
+SRS_FORWARD_PORT=10001
+SRS_REVERSE_PORT=10002
+# Drop root privileges and run as another user after initialization.
+# This is highly recommended as postsrsd handles untrusted input.
+#
+RUN_AS=nobody
+</file>
+Zum Signieren der umgeschriebenen Adressen benötigen wir noch einen secret-key, den wir nun anlegen.
+   # dd if=/dev/urandom bs=18 count=1 | base64  > /etc/postsrsd.secret
+Anschließend setzen wir die Dateirechte unseres privat-keys, damit diese nicht von unpreviligierten Usern ausgelesen werden kann. Der **PostSRSd** hat damit keine Probleme, da er den Schlüssel einliest, bevor diese seine Rechte abtritt/dropped.
+   # chmod 400 /etc/postsrsd.secret
 ==== Postfix ====
-FIXME //... coming soon...// FIXME
+In der Postfix-Konfigurationsdatei //**/etc/postfix/main.cf**// tragen wir nun noch die Erweiterungen für die TCP Lookup Tabellen nach.
+<file bash /etc/postfix/main.cf>...
+# Django : 2014-03-18
+# Lookup-Tabelle zum Umschreibungen von Absender eMail-Adressen im SMTP-Envelop und im Header der eMail
+sender_canonical_maps = btree:/etc/postfix/sender_canonical_maps, tcp:127.0.0.1:10001
+#
+# Definition welche Adressen umgeschrieben werden sollen
+sender_canonical_classes = envelope_sender
+#
+# Lookup-Tabelle zum Umschreibungen von Empfänger eMail-Adressen im SMTP-Envelop und im Header der eMail
+recipient_canonical_maps = btree:/etc/postfix/recipient_canonical_maps, tcp:127.0.0.1:10002
+#
+# Definition welche Adressen umgeschrieben werden sollen
+recipient_canonical_classes = envelope_recipient
+...</file>
+===== Programmstart =====
+==== erster manueller Start des Daemon ====
+Nun können wir das erste mal **PostSRSd** anstarten.
+   # service postsrsd start
+  Starting Postfix Sender Rewriting Scheme Daemon:           [  OK  ]
+In der Prozessliste finden wir mindestens einen neuen Prozess, der gestartet wurde:
+   # ps aux | grep postsrsd
+  nobody    5185  0.0  0.0   6184   344 ?        S    20:46   0:00 /usr/local/sbin/postsrsd -4 -f10001 -r10002 -dnausch.org -s/etc/postsrsd.secret -unobody -p -c -X -D
+Mittels **netstat** können wir überpfüfen, ob die beiden Ports **10001** und **10002** geöffnet wurden.
+   # netstat -tulpen | grep 1000
+  tcp        0      0 127.0.0.1:10001             0.0.0.0:*                   LISTEN      0          40632      5185/postsrsd
+  tcp        0      0 127.0.0.1:10002             0.0.0.0:*                   LISTEN      0          40634      5185/postsrsd
+Läuft unser Daemon kann mit Hilfe von **lsof** sehen wir nicht nur den geöffneten port, sondern auch die Verbindungen die dort anliegen.
+   # lsof -i :10002
+<code>COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
+postsrsd 5185  nobody    6u  IPv4  40634      0t0  TCP localhost:documentum (LISTEN)
+smtpd    5364 postfix   39u  IPv4  43230      0t0  TCP localhost:48910->localhost:documentum (ESTABLISHED)
+postsrsd 5367  nobody    0u  IPv4  43231      0t0  TCP localhost:documentum->localhost:48910 (ESTABLISHED)
+postsrsd 5367  nobody    6u  IPv4  40634      0t0  TCP localhost:documentum (LISTEN)
+cleanup  5369 postfix   23u  IPv4  43281      0t0  TCP localhost:48917->localhost:documentum (ESTABLISHED)
+postsrsd 5370  nobody    6u  IPv4  40634      0t0  TCP localhost:documentum (LISTEN)
+postsrsd 5371  nobody    0u  IPv4  43282      0t0  TCP localhost:documentum->localhost:48917 (ESTABLISHED)
+postsrsd 5371  nobody    6u  IPv4  40634      0t0  TCP localhost:documentum (LISTEN)
+</code>
+   # lsof -i :10001
+<code>COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
+postsrsd 5185  nobody    5u  IPv4  40632      0t0  TCP localhost:scp-config (LISTEN)
+postsrsd 5367  nobody    5u  IPv4  40632      0t0  TCP localhost:scp-config (LISTEN)
+cleanup  5369 postfix   22u  IPv4  43278      0t0  TCP localhost:56006->localhost:scp-config (ESTABLISHED)
+postsrsd 5370  nobody    0u  IPv4  43279      0t0  TCP localhost:scp-config->localhost:56006 (ESTABLISHED)
+postsrsd 5370  nobody    5u  IPv4  40632      0t0  TCP localhost:scp-config (LISTEN)
+postsrsd 5371  nobody    5u  IPv4  40632      0t0  TCP localhost:scp-config (LISTEN)
+</code>
+==== automatisches Starten des Dienste beim Systemstart  ====
+Damit der Deamon **PostSRSd** automatisch bei jedem Systemstart startet, denn ohne laufenden **postsrsd** verweigert nun unser **postfix** die Annahme der Nachrichten, kann die Einrichtung des Start-Scripte über folgenden Befehle erreicht werden:
+   # chkconfig postsrsd on
+Die Überprüfungung ob postsrsd wirklich bei jedem Systemstart automatisch mit gestartet werden, kann durch folgenden Befehle erreicht werden:
+   # chkconfig --list | grep postsrsd
+   postsrsd       	0:off	1:off	2:on	3:on	4:on	5:on	6:off
+Wichtig sind jeweils die Schalter **on** bei den Runleveln - **2 3 4 5**.
+===== Umschreibungen / Logging =====
+Im Maillog unseres Mailservers werden die Umschreibungen entsprechend dokumentiert.
+   # less /var/log/maillog
+  Mar 18 21:01:59 vml000080 postsrsd[5806]: srs_forward: <honeypot_for_spam@web.de> rewritten as <SRS0+BaCI=YT=web.de=honeypot_for_spam@nausch.org>
+Im Header zugestellten eMail beim Empfänger wird dies auch im **Return-Path**hinterlegt.
+  Return-Path: <SRS0+BaCI=YT=web.de=honeypot_for_spam@nausch.org>
+Bounced das Zielsystem die Nachricht, weil dieses z.B. die Nachricht wegen einer vollen Mailbox nicht zustellen kann, kann das relayende System nun problemlos den eigentlichen Absender informieren, da der **PostSRSd** die Zieladresse wieder ermitteln und umschreiben (**srs_reverse**) kann.
+  Mar 13 21:27:25 vml000080 postsrsd[6883]: srs_reverse: <SRS0+bCev=YT=web.de=honeypot_for_spam@nausch.org> rewritten as <honeypot_for_spam@web.de>
+  ...
+  ...
+  Mar 18 21:27:26 vml000080 postfix/smtp[6884]: 8413383: to=<honeypot_for_spam@web.de>, orig_to=<SRS0+bCev=YT=web.de=honeypot_for_spam@nausch.org>, relay=mx-ha03.web.de[213.165.67.104]:25, delay=0.75, delays=0.06/0/0.41/0.29, dsn=2.0.0, status=sent (250 Requested mail action okay, completed: id=0LtrOf-1X9H7q3CS5-011BDN)
+====== Links ======
+  * **[[centos:mail_c6:start|Zurück zum Kapitel >>Mailserverinstallation unter CentOS 6<<]]**
+  * **[[wiki:start|Zurück zu >>Projekte und Themenkapitel<<]]**
+  * **[[http://dokuwiki.nausch.org/doku.php/|Zurück zur Startseite]]**
+~~DISCUSSION~~