Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:mail_c7:spam_12 [17.12.2014 20:32. ] – [Testen der DMARC Definitionen] django | centos:mail_c7:spam_12 [18.11.2024 19:13. ] (aktuell) – Externe Bearbeitung 127.0.0.1 | ||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| - | <WRAP center round info 60%> | + | <WRAP center round info 60%> |
| Artikel befindet sich gerade in der Bearbeitung! | Artikel befindet sich gerade in der Bearbeitung! | ||
| </ | </ | ||
| Zeile 21: | Zeile 21: | ||
| Das nachfolgende Schaubild zeigt den Bearbeitungsverlauf einer eMail mit Berücksichtigung auf DMARC auf. | Das nachfolgende Schaubild zeigt den Bearbeitungsverlauf einer eMail mit Berücksichtigung auf DMARC auf. | ||
| - | < | + | <uml> |
| skinparam defaultFontName Courier | skinparam defaultFontName Courier | ||
| state " | state " | ||
| Zeile 54: | Zeile 54: | ||
| smtpd_b : Bewertung der eMail | smtpd_b : Bewertung der eMail | ||
| smtpd_b : mit Hilfe von Blacklists | smtpd_b : mit Hilfe von Blacklists | ||
| - | smtpd_b : und greylisting | + | smtpd_b : und postscreen |
| state "SPAM- und Virenüberprüfung" | state "SPAM- und Virenüberprüfung" | ||
| Zeile 174: | Zeile 174: | ||
| regelmäßiger forensischer | regelmäßiger forensischer | ||
| Bericht an den im DMARC-Record | Bericht an den im DMARC-Record | ||
| - | hinterlegten "ruaf=mailto" | + | hinterlegten "rua=mailto" |
| Adresse des Mailserver- | Adresse des Mailserver- | ||
| betreibers des Absender- | betreibers des Absender- | ||
| Zeile 289: | Zeile 289: | ||
| ===== Installation ===== | ===== Installation ===== | ||
| + | Die einfachste und schnellste Variante bei der Installation ist die aus dem Repository **[[centos: | ||
| + | # yum install opendmarc | ||
| + | |||
| + | Will oder kann man nicht auf das Repository **[[centos: | ||
| + | # yum localinstall http:// | ||
| + | http:// | ||
| + | |||
| + | Was das RPM alle mitbrachte zeigt ein Blick in die RPM-Datenbank. | ||
| + | # rpm -qil opendmarc | ||
| + | |||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Wed 17 Dec 2014 08:58:08 PM CET | ||
| + | Group : System Environment/ | ||
| + | Size : 517881 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : opendmarc-1.3.0-1.el7.centos.src.rpm | ||
| + | Build Date : Wed 17 Dec 2014 08:38:11 PM CET | ||
| + | Build Host : vml000200.dmz.nausch.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | OpenDMARC (Domain-based Message Authentication, | ||
| + | provides an open source library that implements the DMARC verification | ||
| + | service plus a milter-based filter application that can plug in to any | ||
| + | milter-aware MTA, including sendmail, Postfix, or any other MTA that supports | ||
| + | the milter protocol. | ||
| + | |||
| + | The DMARC sender authentication system is still a draft standard, working | ||
| + | towards RFC status. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | # rpm -qil libopendmarc | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Wed 17 Dec 2014 08:40:49 PM CET | ||
| + | Group : System Environment/ | ||
| + | Size : 48888 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : opendmarc-1.3.0-1.el7.centos.src.rpm | ||
| + | Build Date : Wed 17 Dec 2014 08:38:11 PM CET | ||
| + | Build Host : vml000200.dmz.nausch.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | This package contains the library files required for running services built | ||
| + | using libopendmarc. | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | ===== Konfigurations-Dokumentation ===== | ||
| + | ==== README ==== | ||
| + | Viele hilfreiche Informationen zur Konfiguration von OpenDMARC finden sich in den nachfolgenden Dateien. | ||
| + | # less / | ||
| + | |||
| + | < | ||
| + | ================ | ||
| + | |||
| + | This directory has the latest open source DMARC software from The Trusted | ||
| + | Domain Project. | ||
| + | |||
| + | There is a web site at http:// | ||
| + | the latest updates. | ||
| + | |||
| + | |||
| + | +--------------+ | ||
| + | | INTRODUCTION | | ||
| + | +--------------+ | ||
| + | |||
| + | The OpenDMARC project is a community effort to develop and maintain an open | ||
| + | source package for providing DMARC report generation and policy enforcement | ||
| + | services. | ||
| + | a database schema and tools for aggregating and processing transaction | ||
| + | history to produce DMARC reports, and a filter that ties it all together | ||
| + | with an MTA using the milter protocol. | ||
| + | |||
| + | " | ||
| + | for communicating mail traffic information between MTAs and mail filtering | ||
| + | plug-in applications. | ||
| + | has also been adapted to other MTAs. | ||
| + | |||
| + | +--------------+ | ||
| + | | DEPENDENCIES | | ||
| + | +--------------+ | ||
| + | |||
| + | To compile and operate, this package requires the following: | ||
| + | |||
| + | o OpenDBX (http:// | ||
| + | acts as a middleware layer between OpenDMARC and your SQL backend | ||
| + | of choice | ||
| + | |||
| + | o sendmail v8.13.0 (or later), or Postfix 2.3, (or later) and libmilter. | ||
| + | (These are only required if you are building the filter.) | ||
| + | |||
| + | o Access to a working nameserver (required only for signature verification). | ||
| + | |||
| + | o If you are interested in tinkering with the build and packaging structure, | ||
| + | you may need to upgrade to these versions of GNU's " | ||
| + | autoconf (GNU Autoconf) 2.61 | ||
| + | automake (GNU automake) 1.7 (or 1.9 to avoid warnings) | ||
| + | ltmain.sh (GNU libtool) 2.2.6 (or 1.5.26 after make maintainer-clean) | ||
| + | |||
| + | |||
| + | +-----------------------+ | ||
| + | | RELATED DOCUMENTATION | | ||
| + | +-----------------------+ | ||
| + | |||
| + | The man page for opendmarc (the actual filter program) is present in the | ||
| + | opendmarc directory of this source distribution. | ||
| + | information in the INSTALL and FEATURES files, and in the README file in the | ||
| + | opendmarc directory. | ||
| + | |||
| + | HTML-style documentation for libopendmarc is available in libopendmarc/ | ||
| + | this source distribution. | ||
| + | |||
| + | General information about DMARC can be found at http:// | ||
| + | |||
| + | Mailing lists discussing and supporting the DMARC software found in this | ||
| + | package are maintained via a list server at trusteddomain.org. | ||
| + | http:// | ||
| + | lists are: | ||
| + | |||
| + | opendmarc-announce | ||
| + | |||
| + | opendmarc-users | ||
| + | |||
| + | opendmarc-dev | ||
| + | |||
| + | opendmarc-code | ||
| + | |||
| + | Bug tracking is done via the trackers on SourceForge at | ||
| + | http:// | ||
| + | reports there, but please check first for older bugs already open, | ||
| + | or even already closed, before opening a new issue. | ||
| + | |||
| + | |||
| + | +---------------------+ | ||
| + | | DIRECTORY STRUCTURE | | ||
| + | +---------------------+ | ||
| + | |||
| + | contrib | ||
| + | |||
| + | db Database schema and tools for generating DMARC reports based | ||
| + | upon accumulated data. | ||
| + | |||
| + | docs A collection of RFCs and drafts related to opendmarc. | ||
| + | |||
| + | libopendmarc | ||
| + | |||
| + | libopendmarc/ | ||
| + | HTML documentation describing the API provided by libopendmarc. | ||
| + | |||
| + | opendmarc | ||
| + | optionally libar) to provide DMARC service via an MTA using | ||
| + | the milter protocol. | ||
| + | |||
| + | |||
| + | +----------------+ | ||
| + | | RUNTIME ISSUES | | ||
| + | +----------------+ | ||
| + | |||
| + | WARNING: symbol ' | ||
| + | |||
| + | The filter attempted to get some information from the MTA that the MTA | ||
| + | did not provide. | ||
| + | |||
| + | At various points in the interaction between the MTA and the filter, certain | ||
| + | | ||
| + | being handled are passed from the MTA to the filter. | ||
| + | |||
| + | In the case of sendmail, the names of the macros the MTA should pass to the | ||
| + | | ||
| + | " | ||
| + | | ||
| + | was not passed down from the MTA. | ||
| + | |||
| + | | ||
| + | | ||
| + | those options defined in your sendmail.cf, | ||
| + | files are current and rebuild your sendmail.cf to get appropriate lines | ||
| + | added to your sendmail.cf, | ||
| + | |||
| + | MTA timeouts | ||
| + | |||
| + | By default, the MTA is configured to wait up to ten seconds for a response | ||
| + | from a filter before giving up. When querying remote nameservers | ||
| + | for key and policy data, the DMARC filter may not get a response from the | ||
| + | | ||
| + | This can cause messages to be rejected, temp-failed or delivered without | ||
| + | | ||
| + | |||
| + | When using the standard resolver library provided with your system, the | ||
| + | DNS timeout cannot be adjusted. | ||
| + | | ||
| + | the sendmail open source distribution (libmilter/ | ||
| + | for instructions on changing these timeouts. | ||
| + | |||
| + | When using the provided asynchronous resolver library, you can use the | ||
| + | " | ||
| + | the MTA timeout. | ||
| + | |||
| + | Other OpenDMARC issues: | ||
| + | |||
| + | | ||
| + | the SourceForge issue tracker accessible at: | ||
| + | |||
| + | | ||
| + | |||
| + | |||
| + | -- | ||
| + | Copyright (c) 2012, The Trusted Domain Project. | ||
| + | |||
| + | $Id: README,v 1.13 2010/10/25 20:41:55 cm-msk Exp $ | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== README.schema ==== | ||
| + | # less / | ||
| + | <file / | ||
| + | |||
| + | The tables in this schema are populated by the opendmarc filter as it processes | ||
| + | messages and downloads policies. | ||
| + | in the " | ||
| + | |||
| + | The tables are summarized here: | ||
| + | |||
| + | domains | ||
| + | Automatically tracks a "first seen" timestamp, and includes | ||
| + | a column to record when the last report was sent. | ||
| + | |||
| + | reporters | ||
| + | Intended for use by multi-MX systems so it's possible to tell | ||
| + | where an inbound message landed. | ||
| + | |||
| + | ipaddr | ||
| + | Also tracks the "first seen" timestamp for each. | ||
| + | |||
| + | messages | ||
| + | A messages is uniquely identified by a {date, jobid, reporter} | ||
| + | tuple. | ||
| + | the RFC5321.MailFrom domain, the RFC5322.From domain. | ||
| + | Also records the count of DKIM signatures, the SPF result, | ||
| + | and whether or not the SPF result was aligned with the | ||
| + | RFC5322.From domain. | ||
| + | |||
| + | signatures | ||
| + | a rown in the " | ||
| + | whether the signature passed, whether there was a verification | ||
| + | error other than a broken signature, and whether or not the | ||
| + | signing domain aligned with the RFC5322.From domain. | ||
| + | |||
| + | requests | ||
| + | For each domain, the destination reporting URI for aggregate | ||
| + | reports is recorded along with a "last report sent" timestamp. | ||
| + | |||
| + | -- | ||
| + | Copyright (c) 2012, The Trusted Domain Project. | ||
| + | </ | ||
| + | |||
| + | ==== README.rddmarc ==== | ||
| + | # less / | ||
| + | <file / | ||
| + | |||
| + | The first, rddmarc, is a perl script that take an incoming DMARC | ||
| + | summary report email, extracts and unpacks the gzip or ZIP file, | ||
| + | parses the XML, and puts the parts about received mail into a MySQL | ||
| + | database. | ||
| + | domains from multiple reporters. It's handling reports from Google, | ||
| + | Yahoo, xs4all and Netease. | ||
| + | |||
| + | It expects filenames on the command line, each of which contains a | ||
| + | mail message, but it'd easy enough to adjust it to read stdin or | ||
| + | anywhere else. | ||
| + | |||
| + | It works great on FreeBSD, can probably be made to work on linux with | ||
| + | modest effort, no clue about other systems. | ||
| + | MIME:: | ||
| + | program to extract stuff from the gzip or ZIP file. | ||
| + | |||
| + | It now handles both IPv4 and IPv6 addresses. | ||
| + | running the ipv4 version, see mkdmarc for instructions on how | ||
| + | to update your database. | ||
| + | mysql server to add some IPv6 formatting functions that can be | ||
| + | handy when analyzing the reports. | ||
| + | |||
| + | The second is a python script to parse failure reports. | ||
| + | file names on the command line, or if no arguments, it reads stdin. It | ||
| + | needs the usual MySQLdb module. | ||
| + | which are currently the only ones I'm getting. | ||
| + | |||
| + | mkdmarc - SQL to create the tables | ||
| + | |||
| + | rddmarc - the script to parse summary reports (Perl) | ||
| + | |||
| + | dmarcfail.py - the script to parse failure reports (python) | ||
| + | |||
| + | mysql_ip6.c - C language source for MySQL plugin for IPv6 | ||
| + | formatting functions | ||
| + | </ | ||
| + | |||
| + | ===== man-pages ===== | ||
| + | ==== opendmarc ==== | ||
| + | # man opendmarc | ||
| + | < | ||
| + | |||
| + | NAME | ||
| + | | ||
| + | |||
| + | SYNOPSIS | ||
| + | | ||
| + | | ||
| + | |||
| + | DESCRIPTION | ||
| + | | ||
| + | and reporting of observed traffic. | ||
| + | |||
| + | | ||
| + | of sendmail(8), | ||
| + | aware MTA. | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | | ||
| + | SPF evaluation. | ||
| + | |||
| + | OPTIONS | ||
| + | | ||
| + | instantly | ||
| + | mitigated using some values in the configuration | ||
| + | See opendmarc.conf(5). | ||
| + | |||
| + | -c configfile | ||
| + | Read the named configuration | ||
| + | details. | ||
| + | lents are provided | ||
| + | The OPERATION section describes how reloads are triggered. | ||
| + | read a configuration file from / | ||
| + | to apply defaults to all values. | ||
| + | |||
| + | | ||
| + | the background. | ||
| + | foreground. | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | found, | ||
| + | without complaint, or non-zero otherwise. | ||
| + | |||
| + | -p socketspec | ||
| + | Specifies the socket that should be established by the filter to receive | ||
| + | nections | ||
| + | of two forms: local:path which creates a UNIX domain socket at the specified | ||
| + | path, or inet: | ||
| + | the specified port within the specified protocol family. | ||
| + | given as either a hostname or an IP address, the socket will be listening on | ||
| + | all interfaces. | ||
| + | ing the parameter is interpreted as a path at which the socket should be cre‐ | ||
| + | ated. If an IP address is used, it must be enclosed in square brackets. | ||
| + | parameter is mandatory. | ||
| + | |||
| + | -P pidfile | ||
| + | Specifies a file into which the filter should write its process ID at startup. | ||
| + | |||
| + | -t file[, | ||
| + | Reads email messages from the named files and processes them as if they were | ||
| + | received by the filter. | ||
| + | back to the MTA will instead be printed on standard output. | ||
| + | |||
| + | -u userid[: | ||
| + | Attempts | ||
| + | process will be assigned all of the groups and primary group ID of the named | ||
| + | userid | ||
| + | tion for more information. | ||
| + | |||
| + | | ||
| + | more than once to request increasing amounts of output. | ||
| + | |||
| + | | ||
| + | rithms, and then exit without doing anything else. | ||
| + | |||
| + | SIGNALS | ||
| + | Upon receiving SIGUSR1, if the filter was started with a configuration file, it will | ||
| + | be re-read and the new values used. Note that any command line overrides provided at | ||
| + | | ||
| + | | ||
| + | this process: AutoRestart (-A), AutoRestartCount, | ||
| + | | ||
| + | | ||
| + | |||
| + | VERSION | ||
| + | This man page covers version 1.3.0 of opendmarc. | ||
| + | |||
| + | COPYRIGHT | ||
| + | | ||
| + | |||
| + | SEE ALSO | ||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | The Trusted Domain Project | ||
| + | </ | ||
| + | |||
| + | ==== opendmarc.conf ==== | ||
| + | # man opendmarc.conf | ||
| + | < | ||
| + | |||
| + | NAME | ||
| + | | ||
| + | |||
| + | LOCATION | ||
| + | / | ||
| + | |||
| + | DESCRIPTION | ||
| + | | ||
| + | | ||
| + | |||
| + | Blank lines are ignored. | ||
| + | the hash character to allow for comments in the file. | ||
| + | |||
| + | Other content should be the name of a parameter, followed by white space, followed by | ||
| + | the value of that parameter, each on a separate line. | ||
| + | |||
| + | For parameters that are Boolean in nature, only the first byte of the value is pro‐ | ||
| + | | ||
| + | For negative values, the following are accepted: " | ||
| + | |||
| + | Some, but not all, of these parameters are also available as command line options | ||
| + | | ||
| + | | ||
| + | | ||
| + | line options is likely to get trimmed. | ||
| + | |||
| + | See the opendmarc(8) man page for details about how and when the configuration | ||
| + | | ||
| + | |||
| + | | ||
| + | 0, and string and dataset values default to being undefined. | ||
| + | |||
| + | PARAMETERS | ||
| + | | ||
| + | Sets the " | ||
| + | header field after verifying a message. | ||
| + | MTA processing the message. | ||
| + | the host running the filter (as returned by the gethostname(3) function) will | ||
| + | be used. | ||
| + | |||
| + | | ||
| + | If " | ||
| + | Results: header fields contain the job ID of the message being evaluated. | ||
| + | |||
| + | | ||
| + | Automatically | ||
| + | instantly after it starts, this can cause a tight fork(2) loop. | ||
| + | |||
| + | | ||
| + | Sets the maximum automatic restart count. | ||
| + | restarts, | ||
| + | limit; this is the default. | ||
| + | |||
| + | | ||
| + | Sets the maximum automatic restart rate. | ||
| + | faster | ||
| + | string of the form n/t[u] where n is an integer limiting the count of restarts | ||
| + | in the given interval | ||
| + | rate is calculated; t is an integer and u defines the units thus represented | ||
| + | (" | ||
| + | hours; " | ||
| + | restarts | ||
| + | limited. | ||
| + | |||
| + | | ||
| + | Causes opendmarc to fork and exits immediately, | ||
| + | the background. | ||
| + | |||
| + | | ||
| + | If set, instructs | ||
| + | chdir(2) before doing anything else. This means any files referenced | ||
| + | where in the configuration file can be specified relative to this directory. | ||
| + | It's also useful for arranging that any crash dumps will be saved to a spe‐ | ||
| + | cific location. | ||
| + | |||
| + | | ||
| + | Requests | ||
| + | process to the one specified here prior to beginning | ||
| + | requires | ||
| + | set. | ||
| + | |||
| + | | ||
| + | Adds the specified recipient to the message' | ||
| + | evaluation. | ||
| + | |||
| + | | ||
| + | Sets the DNS timeout in seconds. | ||
| + | default is 5. Ignored if not using an asynchronous resolver package. | ||
| + | |||
| + | | ||
| + | On systems that have such support, make an explicit request to the kernel | ||
| + | dump cores when the filter crashes for some reason. | ||
| + | suppress core dumps during crashes for security reasons if the user ID has | ||
| + | changed | ||
| + | Linux. | ||
| + | |||
| + | | ||
| + | Enables generation of failure reports when the DMARC test fails and the pur‐ | ||
| + | ported | ||
| + | ted per RFC6591. | ||
| + | |||
| + | | ||
| + | When failure reports are enabled and one is to be generated, always | ||
| + | to the address(es) | ||
| + | domain owner, the address(es) are added in a Bcc: field. | ||
| + | made, they address(es) are used in a To: field. | ||
| + | |||
| + | | ||
| + | Supplementary | ||
| + | for sending domains that publish a " | ||
| + | |||
| + | | ||
| + | Sets the value of the From: field to be used when sending failure reports (see | ||
| + | above). | ||
| + | the local host name to construct an email address. | ||
| + | |||
| + | | ||
| + | If set, specifies the location of a text file to which records | ||
| + | that can be used to generate DMARC aggregate reports. | ||
| + | rows containing information about a single received message, and include | ||
| + | relevant | ||
| + | expected that this will not be used in its raw form, but rather | ||
| + | imported | ||
| + | extracted. | ||
| + | |||
| + | | ||
| + | If set, causes mail from authenticated clients (i.e., | ||
| + | AUTH) to be ignored by the filter. | ||
| + | |||
| + | | ||
| + | Specifies | ||
| + | and/or CIDR expressions identifying hosts whose SMTP connections | ||
| + | ignored by the filter. | ||
| + | |||
| + | | ||
| + | Gives a list of domain names whose mail (based on the From: domain) is to be | ||
| + | ignored by the filter. | ||
| + | this list is case-insensitive. | ||
| + | is ignored. | ||
| + | |||
| + | | ||
| + | Sets the debug level to be requested from the milter library. | ||
| + | 0. | ||
| + | |||
| + | | ||
| + | Specifies | ||
| + | ing the process ID. | ||
| + | |||
| + | | ||
| + | Specifies the path to a file that contains top-level domains (TLDs) that will | ||
| + | be used to compute | ||
| + | described in the DMARC specification. | ||
| + | able to determine the Organizational Domain and only the presented domain will | ||
| + | be evaluated. | ||
| + | |||
| + | | ||
| + | If set and HistoryFile is in use, all received messages are recorded | ||
| + | history | ||
| + | domain published a DMARC record will be recorded in the history file. | ||
| + | |||
| + | | ||
| + | If set, messages will be rejected if they fail the DMARC evaluation, or temp- | ||
| + | failed | ||
| + | rejected or temp-failed regardless of the outcome of the DMARC evaluation | ||
| + | the message. | ||
| + | The default is " | ||
| + | |||
| + | | ||
| + | Indicates the shell command to which failure | ||
| + | delivery when FailureReports is enabled. | ||
| + | |||
| + | | ||
| + | If set, the filter will ensure the header of the message conforms to the basic | ||
| + | header field count restrictions laid out in RFC5322, | ||
| + | failing this test are rejected without further processing. | ||
| + | which no domain name could be extracted will also be rejected. | ||
| + | |||
| + | | ||
| + | Specifies the socket that should be established by the filter to receive | ||
| + | nections | ||
| + | of two forms: local:path, which creates a UNIX domain socket at the specified | ||
| + | path, or inet: | ||
| + | the specified port for the appropriate protocol family. | ||
| + | given as either a hostname or an IP address, the socket will be listening on | ||
| + | all interfaces. | ||
| + | on the command line. If an IP address is used, it must be enclosed in square | ||
| + | brackets. | ||
| + | |||
| + | | ||
| + | Causes opendmarc to add a " | ||
| + | of this filter | ||
| + | product' | ||
| + | contents. | ||
| + | |||
| + | | ||
| + | Causes | ||
| + | This is useful if you want the filter to perfrom SPF checks itself, or because | ||
| + | you don't trust the arriving header. | ||
| + | |||
| + | | ||
| + | Causes | ||
| + | SPF results in the message header. | ||
| + | looks for SPF results in headers and always performs the SPF check itself when | ||
| + | this is set. The default is " | ||
| + | |||
| + | | ||
| + | Log via calls to syslog(3) any interesting activity. | ||
| + | |||
| + | | ||
| + | Log via calls to syslog(3) using the named facility. | ||
| + | the same as the ones allowed in syslog.conf(5). | ||
| + | |||
| + | | ||
| + | Specifies | ||
| + | default is /var/tmp. | ||
| + | |||
| + | | ||
| + | Provides a list of authserv-ids that are to be used to identify | ||
| + | tion-Results header fields whose contents are to be assumed as valid input for | ||
| + | the DMARC assessment. | ||
| + | string | ||
| + | returned by the gethostname(3) function) will be used. Matching against | ||
| + | list is case-insensitive. | ||
| + | |||
| + | UMask (integer) | ||
| + | Requests | ||
| + | really applies to creation of the socket when Socket specifies a UNIX domain | ||
| + | socket, | ||
| + | mkstemp(3) function that enforces a specific file mode on creation | ||
| + | of the process umask. | ||
| + | |||
| + | | ||
| + | Attempts to become the specified userid before starting operations. | ||
| + | is of the form userid[: | ||
| + | and primary | ||
| + | fied. | ||
| + | |||
| + | FILES | ||
| + | / | ||
| + | Default location of this file. | ||
| + | |||
| + | VERSION | ||
| + | This man page covers version 1.3.0 of opendmarc. | ||
| + | |||
| + | COPYRIGHT | ||
| + | | ||
| + | |||
| + | SEE ALSO | ||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | The Trusted Domain Project | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== opendmarc-check ==== | ||
| + | # man opendmarc-check | ||
| + | < | ||
| + | |||
| + | NAME | ||
| + | | ||
| + | |||
| + | SYNOPSIS | ||
| + | | ||
| + | |||
| + | DESCRIPTION | ||
| + | | ||
| + | | ||
| + | that the DMARC policy you have placed in the nameserver is what you intended for oth‐ | ||
| + | ers to see. | ||
| + | |||
| + | VERSION | ||
| + | This man page covers version 1.3.0 of opendmarc. | ||
| + | |||
| + | COPYRIGHT | ||
| + | | ||
| + | |||
| + | SEE ALSO | ||
| + | | ||
| + | |||
| + | The Trusted Domain Project | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== opendmarc-expire ==== | ||
| + | # man opendmarc-expire | ||
| + | < | ||
| + | |||
| + | NAME | ||
| + | | ||
| + | |||
| + | SYNOPSIS | ||
| + | | ||
| + | |||
| + | DESCRIPTION | ||
| + | | ||
| + | | ||
| + | |||
| + | OPTIONS | ||
| + | | ||
| + | Expire records in all tables rather than only the large ones. | ||
| + | |||
| + | | ||
| + | Attempts to connect to the database server on the named host. The default | ||
| + | " | ||
| + | |||
| + | | ||
| + | Requests | ||
| + | marc". | ||
| + | |||
| + | | ||
| + | Attempts to authenticate to the database server using the specified | ||
| + | The default is " | ||
| + | |||
| + | | ||
| + | Tries to connect | ||
| + | 3306. | ||
| + | |||
| + | | ||
| + | Attempts to authenticate to the database server as the specified | ||
| + | default is " | ||
| + | |||
| + | | ||
| + | Indicates the number of days of data to keep. The default is 180. | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | Requests verbose output. | ||
| + | |||
| + | | ||
| + | Prints version number and exits. | ||
| + | |||
| + | VERSION | ||
| + | | ||
| + | of OpenDMARC. | ||
| + | |||
| + | COPYRIGHT | ||
| + | | ||
| + | |||
| + | SEE ALSO | ||
| + | | ||
| + | |||
| + | The Trusted Domain Project | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== opendmarc-import ==== | ||
| + | # man opendmarc-import | ||
| + | < | ||
| + | |||
| + | NAME | ||
| + | | ||
| + | |||
| + | SYNOPSIS | ||
| + | | ||
| + | |||
| + | DESCRIPTION | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | | ||
| + | |||
| + | OPTIONS | ||
| + | | ||
| + | Specifies | ||
| + | value of the environment variable | ||
| + | environment variable is not set. | ||
| + | |||
| + | | ||
| + | Specifies | ||
| + | environment variable OPENDMARC_DB, | ||
| + | is not set. | ||
| + | |||
| + | | ||
| + | Specifies | ||
| + | value of the environment variable OPENDMARC_PASSWORD, | ||
| + | environment variable is not set. | ||
| + | |||
| + | | ||
| + | Specifies | ||
| + | Defaults to the value of the environment variable OPENDMARC_PORT, | ||
| + | the environment variable is not set. | ||
| + | |||
| + | | ||
| + | Specifies | ||
| + | value of the environment variable OPENDMARC_USER, | ||
| + | ronment variable is not set. | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | Increase the amount of verbosity written to standard output. | ||
| + | |||
| + | | ||
| + | Print version number and exit. | ||
| + | |||
| + | VERSION | ||
| + | | ||
| + | of OpenDMARC. | ||
| + | |||
| + | COPYRIGHT | ||
| + | | ||
| + | |||
| + | SEE ALSO | ||
| + | | ||
| + | |||
| + | The Trusted Domain Project | ||
| + | </ | ||
| + | |||
| + | |||
| + | ==== opendmarc-importstats ==== | ||
| + | # man opendmarc-importstats | ||
| + | < | ||
| + | |||
| + | NAME | ||
| + | | ||
| + | |||
| + | SYNOPSIS | ||
| + | | ||
| + | |||
| + | DESCRIPTION | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | The intent of this last step is to cause cron to generate a message to a responsible | ||
| + | party so that the failure will be investigated. | ||
| + | |||
| + | VERSION | ||
| + | | ||
| + | 1.3.0 of OpenDMARC. | ||
| + | |||
| + | COPYRIGHT | ||
| + | | ||
| + | |||
| + | SEE ALSO | ||
| + | | ||
| + | |||
| + | The Trusted Domain Project | ||
| + | </ | ||
| + | |||
| + | |||
| + | |||
| + | ==== opendmarc-params ==== | ||
| + | # man opendmarc-params | ||
| + | < | ||
| + | |||
| + | NAME | ||
| + | | ||
| + | |||
| + | SYNOPSIS | ||
| + | | ||
| + | |||
| + | DESCRIPTION | ||
| + | | ||
| + | named domain and flags it as " | ||
| + | done to allow an administrator to force generation of reports and have them sent to a | ||
| + | | ||
| + | named domain. | ||
| + | |||
| + | OPTIONS | ||
| + | | ||
| + | Attempts | ||
| + | " | ||
| + | |||
| + | | ||
| + | Requests a connection to the database called name. | ||
| + | marc". | ||
| + | |||
| + | | ||
| + | Attempts | ||
| + | The default is " | ||
| + | |||
| + | | ||
| + | Tries to connect to the database at the specified TCP port. | ||
| + | 3306. | ||
| + | |||
| + | | ||
| + | Attempts | ||
| + | default is " | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | Sets the reporting URI for the named domain to the specified string. | ||
| + | |||
| + | | ||
| + | Unlocks the record for the named domain. | ||
| + | |||
| + | | ||
| + | Requests verbose output. | ||
| + | |||
| + | | ||
| + | Prints version number and exits. | ||
| + | |||
| + | VERSION | ||
| + | This man page covers the version of opendmarc-params that shipped with version | ||
| + | of OpenDMARC. | ||
| + | |||
| + | COPYRIGHT | ||
| + | | ||
| + | |||
| + | SEE ALSO | ||
| + | | ||
| + | |||
| + | The Trusted Domain Project | ||
| + | </ | ||
| + | |||
| + | ==== opendmarc-reports ==== | ||
| + | # man opendmarc-reports | ||
| + | < | ||
| + | |||
| + | NAME | ||
| + | | ||
| + | |||
| + | SYNOPSIS | ||
| + | | ||
| + | |||
| + | DESCRIPTION | ||
| + | | ||
| + | gate reports. | ||
| + | sage history file generated by an opendmarc(8) filter as messages arrive and are pro‐ | ||
| + | | ||
| + | make reports available to those that request them. | ||
| + | |||
| + | OPTIONS | ||
| + | | ||
| + | Generate | ||
| + | below). | ||
| + | running. | ||
| + | or " | ||
| + | |||
| + | | ||
| + | Specifies the SQL database name to be accessed. | ||
| + | environment | ||
| + | is not set. | ||
| + | |||
| + | | ||
| + | Specifies the password for the SQL database to be accessed. | ||
| + | value of the environment variable OPENDMARC_PASSWORD, | ||
| + | environment variable is not set. | ||
| + | |||
| + | | ||
| + | Specifies the TCP port on which the SQL server is expected | ||
| + | Defaults | ||
| + | the environment variable is not set. | ||
| + | |||
| + | | ||
| + | Specifies the SQL user to be used to access the database. | ||
| + | value of the environment variable OPENDMARC_USER, | ||
| + | ronment variable is not set. | ||
| + | |||
| + | | ||
| + | Generates a report (if one is due) for the named domain, rather than checking | ||
| + | all of them. | ||
| + | |||
| + | | ||
| + | |||
| + | | ||
| + | Generates | ||
| + | least the last secs seconds. | ||
| + | |||
| + | | ||
| + | Skips generating a report for the named domain. | ||
| + | times to skip multiple reporting domains. | ||
| + | |||
| + | | ||
| + | Suppresses marking the time of the transmission of the report in the database. | ||
| + | Normally this would be done to prevent | ||
| + | together. | ||
| + | |||
| + | | ||
| + | Causes | ||
| + | which can be an IP address or a hostname. | ||
| + | |||
| + | | ||
| + | Causes reports to be sent by transmitting them using SMTP to the specified | ||
| + | port. The default is 25. | ||
| + | |||
| + | | ||
| + | Otherwise, the database default is used. | ||
| + | |||
| + | | ||
| + | Increase the amount of verbosity written to standard output. | ||
| + | |||
| + | | ||
| + | Print version number and exit. | ||
| + | |||
| + | VERSION | ||
| + | This man page covers the version of opendmarc-reports that shipped with version 1.3.0 | ||
| + | of OpenDMARC. | ||
| + | |||
| + | COPYRIGHT | ||
| + | | ||
| + | |||
| + | SEE ALSO | ||
| + | | ||
| + | |||
| + | The Trusted Domain Project | ||
| + | </ | ||
| + | |||
| + | ===== Konfiguration ===== | ||
| + | ==== opendmarc ==== | ||
| + | === opendmarc.conf === | ||
| + | Die Konfiguration von OpenDMARC erfolgt über die Konfigurationsdatei **opendmarc.conf** im Verzeichnis // | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | ## opendmarc.conf -- configuration file for OpenDMARC filter | ||
| + | ## | ||
| + | ## Copyright (c) 2012-2014, The Trusted Domain Project. | ||
| + | ## | ||
| + | |||
| + | ## AuthservID (string) | ||
| + | ## defaults to MTA name | ||
| + | ## | ||
| + | ## Sets the " | ||
| + | ## header field after verifying a message. | ||
| + | ## provided, the name of the host running the filter (as returned by the | ||
| + | ## gethostname(3) function) will be used. | ||
| + | # | ||
| + | # AuthservID name | ||
| + | # Django : 2014-12-17 | ||
| + | AuthservID mx01.nausch.org | ||
| + | |||
| + | ## AuthservIDWithJobID { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## If " | ||
| + | ## Authentication-Results header fields contain the job ID of the message | ||
| + | ## being evaluated. | ||
| + | # | ||
| + | # AuthservIDWithJobID false | ||
| + | # Django : 2014-02-17 | ||
| + | AuthservIDWithJobID true | ||
| + | |||
| + | ## AutoRestart { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## Automatically re-start on failures. Use with caution; if the filter fails | ||
| + | ## instantly after it starts, this can cause a tight fork(2) loop. | ||
| + | # | ||
| + | # AutoRestart false | ||
| + | |||
| + | ## AutoRestartCount n | ||
| + | ## default 0 | ||
| + | ## | ||
| + | ## Sets the maximum automatic restart count. | ||
| + | ## restarts, the filter will give up and terminate. | ||
| + | ## limit. | ||
| + | # | ||
| + | # AutoRestartCount 0 | ||
| + | |||
| + | ## AutoRestartRate n/t[u] | ||
| + | ## default (no limit) | ||
| + | ## | ||
| + | ## Sets the maximum automatic restart rate. If the filter begins restarting | ||
| + | ## faster than the rate defined here, it will give up and terminate. | ||
| + | ## is a string of the form n/t[u] where n is an integer limiting the count | ||
| + | ## of restarts in the given interval and t[u] defines the time interval | ||
| + | ## through which the rate is calculated; t is an integer and u defines the | ||
| + | ## units thus represented (" | ||
| + | ## for minutes; " | ||
| + | ## value of " | ||
| + | ## default, meaning restart rate is not limited. | ||
| + | # | ||
| + | # AutoRestartRate n/t[u] | ||
| + | |||
| + | ## Background { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## Causes opendmarc to fork and exits immediately, | ||
| + | ## running in the background. | ||
| + | # | ||
| + | # Background true | ||
| + | |||
| + | ## BaseDirectory (string) | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## If set, instructs the filter to change to the specified directory using | ||
| + | ## chdir(2) before doing anything else. This means any files referenced | ||
| + | ## elsewhere in the configuration file can be specified relative to this | ||
| + | ## directory. | ||
| + | ## saved to a specific location. | ||
| + | # | ||
| + | # BaseDirectory / | ||
| + | |||
| + | ## ChangeRootDirectory (string) | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## Requests that the operating system change the effective root directory of | ||
| + | ## the process to the one specified here prior to beginning execution. | ||
| + | ## chroot(2) requires superuser access. | ||
| + | ## UserID is not also set. | ||
| + | # | ||
| + | # ChangeRootDirectory / | ||
| + | |||
| + | ## CopyFailuresTo (string) | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## Requests addition of the specified email address to the envelope of | ||
| + | ## any message that fails the DMARC evaluation. | ||
| + | # | ||
| + | # CopyFailuresTo postmaster@localhost | ||
| + | |||
| + | ## DNSTimeout (integer) | ||
| + | ## default 5 | ||
| + | ## | ||
| + | ## Sets the DNS timeout in seconds. | ||
| + | ## (NOT YET IMPLEMENTED) | ||
| + | # | ||
| + | # DNSTimeout 5 | ||
| + | |||
| + | ## EnableCoredumps { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## On systems that have such support, make an explicit request to the kernel | ||
| + | ## to dump cores when the filter crashes for some reason. | ||
| + | ## systems suppress core dumps during crashes for security reasons if the | ||
| + | ## user ID has changed during the lifetime of the process. | ||
| + | ## supported on Linux. | ||
| + | # | ||
| + | # EnableCoreDumps false | ||
| + | |||
| + | ## FailureReports { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## Enables generation of failure reports when the DMARC test fails and the | ||
| + | ## purported sender of the message has requested such reports. | ||
| + | ## formatted per RFC6591. | ||
| + | # | ||
| + | # FailureReports false | ||
| + | # Django : 2014-12-17 | ||
| + | FailureReports true | ||
| + | |||
| + | ## FailureReportsBcc (string) | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## When failure reports are enabled and one is to be generated, always | ||
| + | ## send one to the address(es) specified here. If a failure report is | ||
| + | ## requested by the domain owner, the address(es) are added in a Bcc: field. | ||
| + | ## If no request is made, they address(es) are used in a To: field. | ||
| + | ## is no default. | ||
| + | # | ||
| + | # FailureReportsBcc postmaster@example.coom | ||
| + | |||
| + | ## FailureReportsOnNone { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## Supplements the " | ||
| + | ## domains that advertise " | ||
| + | ## generated (when enabled) for sending domains advertising a " | ||
| + | ## or " | ||
| + | # | ||
| + | # FailureReportsOnNone false | ||
| + | |||
| + | ## FailureReportsSentBy string | ||
| + | ## default " | ||
| + | ## | ||
| + | ## Specifies the email address to use in the From: field of failure | ||
| + | ## reports generated by the filter. | ||
| + | ## the user running the filter and the local hostname to construct an | ||
| + | ## email address. | ||
| + | ## could not be determined. | ||
| + | # | ||
| + | # FailureReportsSentBy USER@HOSTNAME | ||
| + | # Django : 2014-12-17 | ||
| + | FailureReportsSentBy dmarc-admin@nausch.org | ||
| + | |||
| + | ## HistoryFile path | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## If set, specifies the location of a text file to which records are written | ||
| + | ## that can be used to generate DMARC aggregate reports. | ||
| + | ## of rows containing information about a single received message, and | ||
| + | ## include all relevant information needed to generate a DMARC aggregate | ||
| + | ## report. | ||
| + | ## rather periodically imported into a relational database from which the | ||
| + | ## aggregate reports can be extracted by a tool such as opendmarc-import(8). | ||
| + | # | ||
| + | HistoryFile / | ||
| + | |||
| + | ## IgnoreAuthenticatedClients { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## If set, causes mail from authenticated clients (i.e., those that used | ||
| + | ## SMTP AUTH) to be ignored by the filter. | ||
| + | # | ||
| + | # IgnoreAuthenticatedClients false | ||
| + | |||
| + | ## IgnoreHosts path | ||
| + | ## default (internal) | ||
| + | ## | ||
| + | ## Specifies the path to a file that contains a list of hostnames, IP | ||
| + | ## addresses, and/or CIDR expressions identifying hosts whose SMTP | ||
| + | ## connections are to be ignored by the filter. | ||
| + | ## to " | ||
| + | # | ||
| + | # IgnoreHosts / | ||
| + | # Django : 2014-12-17 | ||
| + | IgnoreHosts / | ||
| + | |||
| + | ## IgnoreMailFrom domain[, | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## Gives a list of domain names whose mail (based on the From: domain) is to | ||
| + | ## be ignored by the filter. | ||
| + | ## against this list is case-insensitive. | ||
| + | ## meaning no mail is ignored. | ||
| + | # | ||
| + | # IgnoreMailFrom example.com | ||
| + | |||
| + | ## MilterDebug (integer) | ||
| + | ## default 0 | ||
| + | ## | ||
| + | ## Sets the debug level to be requested from the milter library. | ||
| + | # | ||
| + | # MilterDebug 0 | ||
| + | # Django : 2014-12-17 | ||
| + | MilterDebug 5 | ||
| + | |||
| + | ## PidFile path | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## Specifies the path to a file that should be created at process start | ||
| + | ## containing the process ID. | ||
| + | ## | ||
| + | # | ||
| + | # PidFile / | ||
| + | |||
| + | ## PublicSuffixList path | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## Specifies the path to a file that contains top-level domains (TLDs) that | ||
| + | ## will be used to compute the Organizational Domain for a given domain name, | ||
| + | ## as described in the DMARC specification. | ||
| + | ## not be able to determine the Organizational Domain and only the presented | ||
| + | ## domain will be evaluated. | ||
| + | # | ||
| + | # PublicSuffixList path | ||
| + | |||
| + | ## RecordAllMessages { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## If set and " | ||
| + | ## to the history file. If not set (the default), only messages for which | ||
| + | ## the From: domain published a DMARC record will be recorded in the | ||
| + | ## history file. | ||
| + | # | ||
| + | # RecordAllMessages false | ||
| + | |||
| + | ## RejectFailures { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## If set, messages will be rejected if they fail the DMARC evaluation, or | ||
| + | ## temp-failed if evaluation could not be completed. | ||
| + | ## will be rejected or temp-failed regardless of the outcome of the DMARC | ||
| + | ## evaluation of the message. | ||
| + | ## field will be added. | ||
| + | # | ||
| + | # RejectFailures false | ||
| + | |||
| + | ## ReportCommand string | ||
| + | ## default "/ | ||
| + | ## | ||
| + | ## Indicates the shell command to which failure reports should be passed for | ||
| + | ## delivery when " | ||
| + | # | ||
| + | # ReportCommand / | ||
| + | |||
| + | ## RequiredHeaders { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## If set, the filter will ensure the header of the message conforms to the | ||
| + | ## basic header field count restrictions laid out in RFC5322, Section 3.6. | ||
| + | ## Messages failing this test are rejected without further processing. | ||
| + | ## From: field from which no domain name could be extracted will also be | ||
| + | ## rejected. | ||
| + | # | ||
| + | # RequiredHeaders false | ||
| + | |||
| + | ## Socket socketspec | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## Specifies the socket that should be established by the filter to receive | ||
| + | ## connections from sendmail(8) in order to provide service. | ||
| + | ## in one of two forms: local:path, which creates a UNIX domain socket at | ||
| + | ## the specified path, or inet: | ||
| + | ## a TCP socket on the specified port for the appropriate protocol family. | ||
| + | ## If the host is not given as either a hostname or an IP address, the | ||
| + | ## socket will be listening on all interfaces. | ||
| + | ## either in the configuration file or on the command line. If an IP | ||
| + | ## address is used, it must be enclosed in square brackets. | ||
| + | # | ||
| + | # Socket inet: | ||
| + | # Django : 2014-12-17 | ||
| + | Socket inet: | ||
| + | |||
| + | ## SoftwareHeader { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## Causes the filter to add a " | ||
| + | ## presence of this filter in the path of the message from injection to | ||
| + | ## delivery. | ||
| + | ## the header field' | ||
| + | # | ||
| + | # SoftwareHeader false | ||
| + | # Django : 2014-12-17 | ||
| + | SoftwareHeader true | ||
| + | |||
| + | ## SPFIgnoreResults { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## Causes the filter to ignore any SPF results in the header of the | ||
| + | ## message. | ||
| + | ## itself, or because you don't trust the arriving header. | ||
| + | # | ||
| + | # SPFIgnoreResults false | ||
| + | |||
| + | ## SPFSelfValidate { true | false } | ||
| + | ## default false | ||
| + | ## | ||
| + | ## Enable internal spf checking with --with-spf | ||
| + | ## To use libspf2 instead: | ||
| + | ## | ||
| + | ## Causes the filter to perform a fallback SPF check itself when | ||
| + | ## it can find no SPF results in the message header. | ||
| + | ## is also set, it never looks for SPF results in headers and | ||
| + | ## always performs the SPF check itself when this is set. | ||
| + | # | ||
| + | # SPFSelfValidate false | ||
| + | |||
| + | ## Syslog { true | false } | ||
| + | ## default " | ||
| + | ## | ||
| + | ## Log via calls to syslog(3) any interesting activity. | ||
| + | # | ||
| + | # Syslog false | ||
| + | # Django : 2014-12-17 | ||
| + | Syslog true | ||
| + | |||
| + | ## SyslogFacility facility-name | ||
| + | ## default " | ||
| + | ## | ||
| + | ## Log via calls to syslog(3) using the named facility. | ||
| + | ## are the same as the ones allowed in syslog.conf(5). | ||
| + | # | ||
| + | # SyslogFacility mail | ||
| + | |||
| + | ## TemporaryDirectory path | ||
| + | ## default /var/tmp | ||
| + | ## | ||
| + | ## Specifies the directory in which temporary files should be written. | ||
| + | # | ||
| + | # TemporaryDirectory /var/tmp | ||
| + | |||
| + | ## TrustedAuthservIDs string | ||
| + | ## default HOSTNAME | ||
| + | ## | ||
| + | ## Specifies one or more " | ||
| + | ## upstream DKIM and SPF results. | ||
| + | ## the MTA processing the message. | ||
| + | ## with a comma. | ||
| + | ## the host running the filter as reported by the gethostname(3) function. | ||
| + | # | ||
| + | # TrustedAuthservIDs HOSTNAME | ||
| + | |||
| + | |||
| + | ## UMask mask | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## Requests a specific permissions mask to be used for file creation. | ||
| + | ## only really applies to creation of the socket when Socket specifies a | ||
| + | ## UNIX domain socket, and to the HistoryFile and PidFile (if any); temporary | ||
| + | ## files are normally created by the mkstemp(3) function that enforces a | ||
| + | ## specific file mode on creation regardless of the process umask. | ||
| + | ## umask(2) for more information. | ||
| + | # | ||
| + | # UMask 077 | ||
| + | # Django : 2014-12-17 | ||
| + | UMask 007 | ||
| + | |||
| + | ## UserID user[: | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## Attempts to become the specified userid before starting operations. | ||
| + | ## The process will be assigned all of the groups and primary group ID of | ||
| + | ## the named userid unless an alternate group is specified. | ||
| + | # | ||
| + | # UserID opendmarc | ||
| + | # Django : 2014-12-17 | ||
| + | #UserID opendmarc: | ||
| + | </ | ||
| + | |||
| + | === ignore.hosts ==== | ||
| + | # vim / | ||
| + | <file bash / | ||
| + | # CIDR expressions identifying hosts whose SMTP connections are to be | ||
| + | # ignored by the filter. | ||
| + | # to " | ||
| + | 127.0.0.1 | ||
| + | </ | ||
| + | |||
| + | === Public Suffix List ==== | ||
| + | Im [[https:// | ||
| + | |||
| + | Zuvor holen wir uns aber erst einmal diese Liste von der Webseite **[[https:// | ||
| + | # wget --no-check-certificate -q -N https:// | ||
| + | |||
| + | In unregelmäßigen Abständen, meist mehrmals pro Monat, wird diese Liste aktualisiert. Damit wir nun nicht händisch für die Aktualität dieser Liste sorgen müssen, legen wir uns einen kleinen cronjob an, der 1x pro Woche ausgeführt werden soll. | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # Script zum Aktualisieren der Public Suffix List für opendmarc | ||
| + | # Django < | ||
| + | # | ||
| + | / | ||
| + | |||
| + | Was nun noch fehlt, ist die Aktivierung dieser Option in der Konfigurationsdatei von **opendmarc**. | ||
| + | # vim / | ||
| + | <code bash / | ||
| + | |||
| + | ## PublicSuffixList path | ||
| + | ## default (none) | ||
| + | ## | ||
| + | ## Specifies the path to a file that contains top-level domains (TLDs) that | ||
| + | ## will be used to compute the Organizational Domain for a given domain name, | ||
| + | ## as described in the DMARC specification. | ||
| + | ## not be able to determine the Organizational Domain and only the presented | ||
| + | ## domain will be evaluated. | ||
| + | # | ||
| + | # Django : 2015-12-10 | ||
| + | # default: unset | ||
| + | PublicSuffixList / | ||
| + | |||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Zum Aktivieren der **Public Suffix List** brauchen wir dann nur noch den Daemon 1x durchstarten. | ||
| + | # systemctl restart opendmarc.service | ||
| + | |||
| + | ==== mysql Konfiguration ==== | ||
| + | Eigentlich könnten wir nun schon unseren DMARC-Daemon starten. Jedoch wollen wir noch kurz die nötige mySQL-Datenbank anlegen, damit der Daemon die gewünschten aufbereiteten Statiskdaten und forensischen Berichte generieren und dann per eMail verschicken kann. | ||
| + | |||
| + | Wir melden uns also als berechtigter Datenbankuser an der mySQL-Datenbank an. | ||
| + | # mysql -h localhost -u root -p | ||
| + | |||
| + | < | ||
| + | Welcome to the MySQL monitor. | ||
| + | Your MySQL connection id is 1942 | ||
| + | Server version: 5.1.67 Source distribution | ||
| + | |||
| + | Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved. | ||
| + | |||
| + | Oracle is a registered trademark of Oracle Corporation and/or its | ||
| + | affiliates. Other names may be trademarks of their respective | ||
| + | owners. | ||
| + | |||
| + | Type ' | ||
| + | |||
| + | mysql> | ||
| + | </ | ||
| + | Dort legen wir als aller erst einmal eine Datenbank mit dem Namen **opendmarc** an. | ||
| + | | ||
| + | |||
| + | Anschließend legen wir uns dann einen Datenbankuser an, dem wir entsprechende Rechte an der Datenbank **opendmarc** einräumen. | ||
| + | | ||
| + | |||
| + | Query OK, 0 rows affected (0.00 sec) | ||
| + | |||
| + | | ||
| + | |||
| + | Query OK, 0 rows affected (0.00 sec) | ||
| + | |||
| + | Anschließend setzen wir noch die Nutzerberechtigungen unseres Datenbanknutzers **opendmarc_user** für die Datenbank **opendmarc** | ||
| + | | ||
| + | |||
| + | Query OK, 0 rows affected (0.00 sec) | ||
| + | |||
| + | mysql> GRANT ALL PRIVILEGES ON opendmarc.* TO ' | ||
| + | |||
| + | Query OK, 0 rows affected (0.00 sec) | ||
| + | |||
| + | Zur Aktivierung weisen wir nun noch die Berechtigungen zu: | ||
| + | mysql> FLUSH PRIVILEGES; | ||
| + | |||
| + | Query OK, 0 rows affected (0.00 sec) | ||
| + | |||
| + | Abschließend melden wir uns wieder von unserem Datenbankhost ab. | ||
| + | mysql> quit | ||
| + | |||
| + | Bye | ||
| + | |||
| + | Bevor wir die benötigten Tabellen anlegen, testen wir noch, ob der Zugriff von unserem Mail- bzw. Datenimportserver funktioniert. | ||
| + | # mysql -h mysql.dmz.nausch.org -D opendmarc -u opendmarc_user -p | ||
| + | |||
| + | < | ||
| + | Welcome to the MySQL monitor. | ||
| + | Your MySQL connection id is 2889 | ||
| + | Server version: 5.1.73 Source distribution | ||
| + | |||
| + | Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved. | ||
| + | |||
| + | Oracle is a registered trademark of Oracle Corporation and/or its | ||
| + | affiliates. Other names may be trademarks of their respective | ||
| + | owners. | ||
| + | |||
| + | Type ' | ||
| + | |||
| + | mysql> | ||
| + | </ | ||
| + | | ||
| + | < | ||
| + | | Database | ||
| + | +--------------------+ | ||
| + | | information_schema | | ||
| + | | opendmarc | ||
| + | +--------------------+ | ||
| + | 2 rows in set (0.00 sec) | ||
| + | </ | ||
| + | | ||
| + | |||
| + | Bye | ||
| + | |||
| + | Mit Hilfe der Datei // | ||
| + | # mysql -h mysql.dmz.nausch.org -D opendmarc -u opendmarc_user -p < / | ||
| + | |||
| + | Auch hier können wir uns bei Bedarf noch überprüfen, | ||
| + | # mysql -h mysql.dmz.nausch.org -D opendmarc -u opendmarc_user -p | ||
| + | |||
| + | < | ||
| + | Reading table information for completion of table and column names | ||
| + | You can turn off this feature to get a quicker startup with -A | ||
| + | |||
| + | Welcome to the MySQL monitor. | ||
| + | Your MySQL connection id is 2933 | ||
| + | Server version: 5.1.73 Source distribution | ||
| + | |||
| + | Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved. | ||
| + | |||
| + | Oracle is a registered trademark of Oracle Corporation and/or its | ||
| + | affiliates. Other names may be trademarks of their respective | ||
| + | owners. | ||
| + | |||
| + | Type ' | ||
| + | |||
| + | mysql> | ||
| + | </ | ||
| + | | ||
| + | |||
| + | < | ||
| + | | Database | ||
| + | +--------------------+ | ||
| + | | information_schema | | ||
| + | | opendmarc | ||
| + | +--------------------+ | ||
| + | 2 rows in set (0.00 sec) | ||
| + | |||
| + | mysql> | ||
| + | </ | ||
| + | | ||
| + | |||
| + | Database changed | ||
| + | mysql> | ||
| + | |||
| + | | ||
| + | < | ||
| + | | Tables_in_opendmarc | | ||
| + | +---------------------+ | ||
| + | | domains | ||
| + | | ipaddr | ||
| + | | messages | ||
| + | | reporters | ||
| + | | requests | ||
| + | | signatures | ||
| + | +---------------------+ | ||
| + | 6 rows in set (0.00 sec) | ||
| + | |||
| + | mysql> | ||
| + | </ | ||
| + | | ||
| + | |||
| + | Bye | ||
| + | |||
| + | |||
| + | ==== dbCollecting User einrichten ==== | ||
| + | Nicht immer möchte oder kann man von seinem oder seinen Mailservern eine Verbindung zum Datenbankhost ermöglichen. Um jetzt nicht von jedem einzelnen MX-Server einzurichten, | ||
| + | |||
| + | Wir legen uns nun unseren Nutzer an. Als UID und GID verwenden wir eine entsprechend freie Nummer, die wir entsprechend vorher abprüfen. | ||
| + | # grep 989 /etc/group | ||
| + | |||
| + | # grep 989 /etc/passwd | ||
| + | |||
| + | Anschließend legen wir uns unseren User an. | ||
| + | # groupadd -g 989 dmarc && useradd dmarc -c " | ||
| + | |||
| + | Anschließend erzeugen wir uns noch einen entsprechenden SSH-Key und verteilen diesen auf unseren Mailservern. Entsprechende Schritte sind im Wiki [[https:// | ||
| + | |||
| + | ==== dbCollecting Script anlegen ==== | ||
| + | Zum Einsammeln der Statistikdaten legen wir uns nun ein einfaches Shellscript an. | ||
| + | # vim / | ||
| + | <file bash / | ||
| + | # Script zum Importieren der DMARC-Daten aus dem lokalen cache-Datei in die mySQL Datenbank | ||
| + | # und Generieren der DMARC-reports | ||
| + | # Das Script wird um 03:33 Uhr via cronjob aufgerufen. | ||
| + | # | ||
| + | # crontab | ||
| + | # einmal in der Nacht die DMARC-Statistikdaten abholen und die mySQL-Datenbank damit befüllen. | ||
| + | # 33 3 * * * / | ||
| + | # | ||
| + | # Django : 2014-03-20 | ||
| + | |||
| + | WORKDIR="/ | ||
| + | WORKFILE=" | ||
| + | SSHKEYFILE=" | ||
| + | MXHOSTS=" | ||
| + | DBFILE=" | ||
| + | DBHOST=" | ||
| + | DBPORT=" | ||
| + | DBUSER=" | ||
| + | DBPASSWD=" | ||
| + | DBNAME=" | ||
| + | |||
| + | # DMARC Datenfile von den Mailservern abholen | ||
| + | cd $WORKDIR | ||
| + | for HOST in $MXHOSTS; do | ||
| + | scp -i $WORKDIR$SSHKEYFILE dmarc@${HOST}:/ | ||
| + | ssh -i $WORKDIR$SSHKEYFILE dmarc@${HOST} "/ | ||
| + | cat ${HOST}.dat >> $WORKFILE | ||
| + | done | ||
| + | |||
| + | # DMARC Daten in die mySQL-Datenbank opendmarc schreiben | ||
| + | / | ||
| + | --dbpasswd=$DBPASSWD < $WORKDIR$WORKFILE | ||
| + | |||
| + | # DMARC Statistik-Report erstellen | ||
| + | / | ||
| + | --dbpasswd=$DBPASSWD --verbose --interval=86400 --report-email ' | ||
| + | |||
| + | # DMARC Datenbank aufräumen, Datensätze die älter als 90 Tage sind werden gelöscht | ||
| + | / | ||
| + | --dbpasswd=$DBPASSWD --verbose --expire=90 | ||
| + | |||
| + | # Work-Verzeichnis wieder aufräumen | ||
| + | cd $WORKDIR | ||
| + | rm $WORKDIR*.dat -rf | ||
| + | </ | ||
| + | Anschließen setzen wir die Ausführungsrechte unseres neuen Scriptes. | ||
| + | # chmod +x / | ||
| + | |||
| + | Zu guter Letzt aktivieren wir dann noch einen Cronjob für die tägliche Ausführung. | ||
| + | # crontab -e | ||
| + | <code bash>... | ||
| + | |||
| + | # Django : 2014-03-20 | ||
| + | # einmal in der Nacht die DMARC-Statistikdaten abholen und die mySQL-Datenbank damit befüllen. | ||
| + | 33 3 * * * / | ||
| + | |||
| + | ... | ||
| + | </ | ||
| + | |||
| + | ==== Postfix ==== | ||
| + | In der Konfigurationsdatei **main.cf** unseres Postfix-Mailserver definieren wir uns nun eine eigene Variable, die wir dann in der Datei // | ||
| + | # vim / | ||
| + | <file bash / | ||
| + | |||
| + | ################################################################################ | ||
| + | ## MILTER | ||
| + | # Django : 2014-11-18 | ||
| + | # DMARC Test | ||
| + | spf_milter | ||
| + | opendkim_milter | ||
| + | opendmarc_milter = inet: | ||
| + | amavisd_milter | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | In der Konfigurationsdatei // | ||
| + | # vim / | ||
| + | |||
| + | < | ||
| + | |||
| + | smtp inet n | ||
| + | smtpd | ||
| + | -o smtpd_milters=${spf_milter}, | ||
| + | -o smtpd_sasl_auth_enable=no | ||
| + | dnsblog | ||
| + | tlsproxy | ||
| + | </ | ||
| + | |||
| + | ===== Programmstart ===== | ||
| + | Das Starten des Daemon erfolgt über folgenden Aufruf. | ||
| + | # systemctl start opendmarc | ||
| + | |||
| + | Den erfolgreichen Start bzw. den Status des **smf-spf**-Daemon können wir bei Bedarf mit folgendem Aufruf abfragen. | ||
| + | # systemctl status opendmarc | ||
| + | |||
| + | < | ||
| + | | ||
| + | | ||
| + | Main PID: 2370 (opendmarc) | ||
| + | | ||
| + | | ||
| + | |||
| + | Dec 17 20:58:56 vml000087.dmz.nausch.org systemd[1]: Starting opendmarc - DMARC email policy filter for MTAs.... | ||
| + | Dec 17 20:58:56 vml000087.dmz.nausch.org systemd[1]: Started opendmarc - DMARC email policy filter for MTAs.. | ||
| + | Dec 17 20:58:56 vml000087.dmz.nausch.org opendmarc[2370]: | ||
| + | Dec 17 20:58:56 vml000087.dmz.nausch.org opendmarc[2370]: | ||
| + | Dec 17 20:58:56 vml000087.dmz.nausch.org opendmarc[2370]: | ||
| + | </ | ||
| + | |||
| + | |||
| + | Im Maillog wird der Start des Daemon entsprechend dokumentiert. | ||
| + | # less / | ||
| + | |||
| + | Dec 17 22:45:08 vml000087 opendmarc[2912]: | ||
| + | Dec 17 22:45:08 vml000087 opendmarc[2912]: | ||
| + | Dec 17 22:45:08 vml000087 opendmarc[2912]: | ||
| + | |||
| + | Mit Hilfe von **netstat** können wir überprüfen, | ||
| + | # netstat -tulpen | ||
| + | |||
| + | < | ||
| + | Proto Recv-Q Send-Q Local Address | ||
| + | tcp 0 0 0.0.0.0: | ||
| + | tcp 0 0 127.0.0.1: | ||
| + | tcp 0 0 127.0.0.1: | ||
| + | tcp 0 0 127.0.0.1: | ||
| + | </ | ||
| + | |||
| + | Gleiches können wir natürlich auch mit dem Befehl **lsof** erreichen. | ||
| + | # lsof -i:8893 | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | Damit der Daemon automatisch beim Hochfahren des Servers gestartet wird, nutzen wir folgenden Aufruf. | ||
| + | # systemctl enable opendmarc.service | ||
| + | |||
| + | ln -s '/ | ||
| + | |||
| + | Wollen wir überprüfen ob der Dienst automatisch startet, verwenden wir folgenden Aufruf. | ||
| + | |||
| + | # systemctl is-enabled opendmarc.service | ||
| + | |||
| + | | ||
| + | |||
| + | Die Rückmeldung **enabled** zeigt an, dass der Dienst automatisch startet; ein **disabled** zeigt entsprechend an, dass der Dienst __nicht__ automatisch startet. | ||
| + | |||
| + | ===== Logging / Mailheader ===== | ||
| + | Im Maillog werden entsprechend unserer zuvor festgelegten Konfiguration, | ||
| + | Folgender Logeintrag zeigt einen erfolgreiche DMARC-Überprüfung. | ||
| + | Mar 23 22:46:01 vml000080 opendmarc[25914]: | ||
| + | |||
| + | Im Mailheader der Nachricht, wird dies auch entsprechend vermerkt. | ||
| + | DMARC-Filter: | ||
| + | Authentication-Results: | ||
| + | |||
| + | Hat der Domainbetreiber keinen DMARC-Eintrag im DNS hinterlegt, sieht die betreffende Zeile im Maillog entsprechend so aus. | ||
| + | Mar 19 00:22:36 vml000080 opendmarc[14508]: | ||
| + | |||
| + | Auch dies wird im Mailheader entsprechend vermerkt. | ||
| + | DMARC-Filter: | ||
| + | Authentication-Results: | ||
| + | |||
| + | <WRAP center round alert 35%> \\ | ||
| + | FIXME //... do geds weida!// | ||
| + | </ | ||
django