Anti-virus, anti-spam y hardening de correo

Este documento describe como se configura un servidor de correo Postfix  para ofrecer la mayor oposicion contra SPAM, Virus y demas amenazas.

Las medidas pueden ser tomadas en varios ambientes, empezando por el mismo MTA y luego utilizando herramientas adicionales

Agregue lo siguiente en el main.cf para volverlo muy selectivo, el primero es autenticación y el resto es para excluir fuentes y destinos malos (ver anexo).

$############# by skina #####################

smtpd_data_restrictions =  reject_unauth_pipelining, reject_multi_recipient_bounce, permit

#smtpd_helo_restrictions = permit_mynetworks, reject_unauth_pipelining,
#        reject_invalid_hostname, permit

#smtpd_client_restrictions = permit_mynetworks,reject_invalid_hostname, permit

#smtpd_sender_restrictions = permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain,
#        permit

smtpd_recipient_restrictions =
        permit_mynetworks, permit_sasl_authenticated, check_sender_access hash:/etc/postfix/restricted_senders,
                  reject_non_fqdn_sender,reject_unknown_sender_domain,
        reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination,
        permit

smtpd_restriction_classes = local_only

local_only = reject_unauth_destination, permit_mynetworks, check_recipient_access hash:/etc/postfix/local_domains,
            reject

Hay muchas mas opciones que estan comentadas en el archivo incluido en el modelo, pero hay que afinar una a una para lograr una restriccion razonable.

TODOS los chequeos con RBSL se hacen por spamassassin (supuestamente) entonces no es necesario ponerlo aqui.

Revise el documento speech_linuxforum_2004_postfix_spam.pdf y http://www.securitysage.com/antispam/intro.html

Para el resto de las exigencias al protocolo y demas.

strict_rfc821_envelopes = yessmtpd_helo_required = yesdisable_vrfy_command = yessmtp_always_send_ehlo = yesbiff = nomaximal_queue_lifetime = 7200sdelay_warning_time = 1smtpd_hard_error_limit = 2strict_7bit_headers = yes# empty_address_recipient = MAILER-DAEMON# notify_classes = protocol,resource,software

Chequeos de encabezados .. aunque han sido supuestamente ahora obsoletos, pero sirven cuando se quiere bloquear por ejemplo un subject particular

header_checks = regexp:/etc/postfix/maps/header_checksbody_checks = regexp:/etc/postfix/maps/body_checksmime_header_checks = regexp:/etc/postfix/maps/mime_header_checks 

 * OJO esto puede bloquear el reporte de lectura

Los fuentes de estos archivos pueden sacarse de http://www.securitysage.com/files Aqui tambien se consigue el update-filters.sh para actualizar estos filtros .. aunque ya dejaron de ser actualizados y confian mas en los antispams aun hay cosas que funcionan mejor por este lado. 

“… I would first like to make a point about authenticated SMTP (using SASL2) and TLS encryption. While this is not exactly an anti-spam measure, assuming that some persons (users) need to relay mail through your server, enabling authenticated smtp relaying can limit spammers' abilities to use your server as an open relay. TLS encryption will prevent anyone in the middle (logically) of your users and mail server from being able to sniff (read/detect)
information about mail being sent or passwords being used. …”

#### TLSsmtpd_use_tls = yessmtp_use_tls = yessmtpd_tls_auth_only = nosmtp_tls_note_starttls_offer = yessmtpd_tls_key_file = /etc/pki/tls/private/sk_sinternet.skinatech.com.keysmtpd_tls_cert_file = /etc/pki/tls/certs/sk_sinternet.skinatech.com.certsmtpd_tls_CAfile = /etc/pki/tls/cert.pemsmtpd_tls_loglevel = 1smtpd_tls_received_header = yessmtpd_tls_session_cache_timeout = 3600stls_random_source = dev:/dev/urandom

La autenticacion adicional usando SASL mejora lo selectivo del sistema http://www.securitysage.com/antispam/sasltls.html

Amavis es la herramienta que permite mezclar en un solo programa varias herramientas de filtrado de correo como anti-spams y anti-virus

• Configuración especial del MTA
• SpamAssasin
• CLam Antivirus
• Amavis

En mandrake tengo

• libclamav1-0.67-4mdk
• clamav-0.67-4mdk
• clamav-db-0.67-4mdk
• clamd-0.67-4mdk
• amavisd-new-0.20030616-18mdk
• spamassassin-tools-2.63-2mdk
• spamassassin-2.63-2mdk

En Debian

• clamav 0.80-4 Antivirus scanner for Unix
• clamav-base 0.80-4 Base package for clamav, an anti-virus utili
• clamav-daemon 0.80-4 Powerful Antivirus scanner daemon
• clamav-data 20040725.23100 clamav data files
• libclamav1 0.80-4 Virus scanner library
• amavisd-new 20030616p10-4 Interface between MTA and virus scanner/cont
• razor 2.610-2 spam-catcher using a collaborative filtering
• spamassassin 2.64-1 Perl-based spam filter using text analysis
•  spamc 2.64-1 Client for perl-based spam filtering daemon

En /etc/amavis/amavisd.conf

$mydomain = 'skina.com.co';$forward_method = 'smtp:[127.0.0.1]:10025'; # donde recibe postfix de vuelta$notify_method = $forward_method;$final_virus_destiny = D_DISCARD; # (defaults to D_BOUNCE)$final_banned_destiny = D_BOUNCE; # (defaults to D_BOUNCE)$final_spam_destiny = D_REJECT; # (defaults to D_REJECT)$final_bad_header_destiny = D_PASS; # (defaults to D_PASS),$virus_quarantine_to = undef; # No ponga nada en cuarentena$inet_socket_port = 10024;$sa_local_tests_only = 0;#  @local_domains_acl = ( ".$mydomain", 'cuy.mct.com.co', 'correo.mct.com.co' );$sa_tag_level_deflt = 4.0; # add spam info headers if at, or above that level$sa_tag2_level_deflt = 6.3; # add 'spam detected' headers at that level$sa_kill_level_deflt = $sa_tag2_level_deflt; # triggers spam evasive actions 

La opción que merece más atencion es $forward_method, que será la ví­a que utilizará amavisd-new para reinyectar el mensaje de correo en postfix; en este caso le hemos dicho que lo haga usando un smtp en localhost por el puerto 10025.


OJO: de que si lo dejaramos por defecto (D_REJECT) estarí­amos perdiendo  los posibles falsos positivos.

Revise que la seccion de clamav esta correcta y mas importante que el socket corresponda al real.

Crear un proceso SMTP que solo correrá en la interfaz loopback (127.0.0.1) en en el puerto 10025 y que pasará los correos a los usuarios sin pasarlo por amavisd-new. Esto es necesario para evitar que los correos entren en
un bucle sin fin. En /etc/postfix/main.cf añadiremos:

content_filter=smtp-amavis:[127.0.0.1]:10024

en /etc/postfix/master.cf:

### By Skinasmtp-amavis unix - - y - 2 smtp-o smtp_data_done_timeout=1200-o disable_dns_lookups=yes127.0.0.1:10025 inet n - n - - smtpd-o content_filter=-o local_recipient_maps=-o relay_recipient_maps=-o smtpd_restriction_classes=-o smtpd_client_restrictions=-o smtpd_helo_restrictions=-o smtpd_sender_restrictions=-o smtpd_recipient_restrictions=permit_mynetworks,reject-o mynetworks=127.0.0.0/8-o strict_rfc821_envelopes=yes-o smtpd_error_sleep_time=0-o smtpd_soft_error_limit=1001

Para que amavisd-new haga uso de SpamAssassin debemos cerciorarnos de que
no existe esta lí­nea en el fichero de configuración de amavisd-new. Si
la tenemos, es el momento de comentarla.

 @bypass_spam_checks_acl = qw( . )

En amavisd.conf suba el nivel de logueo $log_level=2;

y siga la bitacora de mail buscando … el inicio del filtro
en donde levanta el soporte para virus y spam y esta abriendo el
puerto 10024

Nov 22 19:59:42 alpha amavis[11780]: SMTP-in protocol code loaded

Nov 22 19:59:42 alpha amavis[11780]: ANTI-VIRUS code loaded

Nov 22 19:59:42 alpha amavis[11780]: ANTI-SPAM code loaded

pe Net::Server::PreForkSimple) starting! pid(11781)

Nov 22 19:59:42 alpha amavis[11781]: Net::Server: Binding to TCP port 10024 on host 127.0.0.1

Nov 22 19:59:42 alpha amavis[11781]: Net::Server: Setting gid to “109 109”

Nov 22 19:59:42 alpha amavis[11781]: Net::Server: Setting uid to “105”

Otro sitio intersante es ver el encabezado de los mails que han sido filtrados.

X-Virus-Scanned: by amavisd-new-20030616-p10 at example.com

OK

Si Ud quiere que ademas por ejemplo el correo que esta marcado sea enviado
a otro sitio … uhmmm hace falta procmail .. tonces el proceso.

A. Verfique que tiene instalado procmail …

###> which procmail
###> /usr/bin/procmail

B. Mire que el servidor de correo use procmail para enviarlo. Usualmente
postfix no lo hace .. tonces toca descomentar…

mailbox_command = /usr/bin/procmail

Monitoree la cosa pa tener certeza que funciona con un tail a la bitacora
de correo /var/log/maillog /var/log/maillog-20210103 /var/log/maillog-20210110 /var/log/maillog-20210118 /var/log/maillog-20210124 /var/log/maillog-20240505.gz /var/log/maillog-20240512.gz /var/log/maillog-20240519.gz /var/log/maillog-20240526.gz

C. Crear el archivo de configuracion de procmail (/etc/procmailrc).. pa que
funcione .. digamos puede identificarlo por el nivel de spam o por el
Subject. … ejm
 

 # Please check if all the paths in PATH are reachable, remove the ones that# are not.LOGFILE=/var/log/procmail.logVERBOSE=yesLOGABSTRACT=all# Mail that is very likely spam (>7) can be dropped on the floor.# Move the # up one line to save it on the server instead.# Note that dropping mail on the floor is a *bad*# idea unless you really, really believe no false positives will# have a score greater than 7.:0* ^X-Spam-Level: \\*\\*\\*\\*\\*\\*|\\^Subject: *RECHAZADO\\ EEC/var/spool/mail/basura 

OJO con los permisos del archivo de log /var/log/procmail.log y del buzon
de basura .. yo por pereza los puse 666

http://www.howtoforge.com/linux_spam_filter_mail_gateway http://www200.pair.com/mecham/spam/spamfilter20060630.html  

Cosas como lo que sigue en /etc/amavisd.conf … deja un comportamiento diferente para los usuarios locales.

$policy_bank{'MYUSERS'} = { terminate_dsn_on_notify_success => 0, spam_kill_level_maps => 6.9,  virus_admin_maps => ["virusalert\\@$mydomain"], # alert of internal viruses  spam_admin_maps  => ["spamalert\\@$mydomain"],  # alert of internal spam  bypass_spam_checks_maps   => [1],  # or: don't spam-check internal mail  bypass_banned_checks_maps => [1],  # don't banned-check internal mail  warnbadhsender => 1,  # warn local senders about their broken MUA  banned_filename_maps => ['MYNETS-DEFAULT'], # more permissive banning rules  spam_quarantine_cutoff_level_maps => undef, # quarantine all local spam  spam_dsn_cutoff_level_maps => undef,  # ensure NDN regardless of spam level  spam_dsn_cutoff_level_bysender_maps => # but only from local domain senders    [ { lc(".$mydomain") => undef,  '.' => 15 } ],}; 

http://postfixmail.com/blog/index.php/policy-banks-with-amavis/ –

• El sitio de antispam SAGE  (http://web.archive.org/web/20070106022525/http://www.securitysage.com/antispam/)
• Un excelente articulo con anti-spam y todo IMGate .. Lo de freeBSD lo puede ignorar
  

pero lo demas es bueniiiiisimo. !! Deberia tener copia local  (http://web.archive.org/web/20060516093559/http://www.cotel.com.ar/postfix)

• How to setup a mail server –
• FAQ de Postfix  --\\
•   postfix-amavis.pdf (35.41 KB)
• http://www.howtoforge.com/virtual_postfix_antispam –
• http://www.howtoforge.com/greylisting_postfix_postgrey –
• Donde estan todos los RBLs y famliares http://spamlinks.net/filter-dnsbl-lists.htm –

FIN
=====================================================================
   ANEXO El maximo antispam

############# by skina ######################## Checks to remove badly formed emailinet_protocols = allstrict_rfc821_envelopes = yessmtpd_helo_required = yesdisable_vrfy_command = yessmtp_always_send_ehlo = yesbiff = nomaximal_queue_lifetime = 7200sdelay_warning_time = 1smtpd_hard_error_limit = 2strict_7bit_headers = yesdisable_dns_lookups = nostrict_8bitmime = nosmtpd_recipient_limit = 3smtpd_recipient_overshoot_limit=2unknown_address_reject_code = 554unknown_hostname_reject_code = 554unknown_client_reject_code = 554relayhost =defer_transports =mailbox_command =mailbox_transport =disable_mime_output_conversion = noprogram_directory = /usr/lib/postfixcanonical_maps = hash:/etc/postfix/canonical#virtual_alias_maps = hash:/etc/postfix/virtualvirtual_alias_domains = hash:/etc/postfix/virtualrelocated_maps = hash:/etc/postfix/relocatedtransport_maps = hash:/etc/postfix/transportsender_canonical_maps = hash:/etc/postfix/sender_canonicalmasquerade_exceptions = rootmasquerade_classes = envelope_sender, header_sender, header_recipientmasquerade_domains =#### restriccionessmtpd_data_restrictions =reject_unauth_pipelining,reject_multi_recipient_bounce,permitsmtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname, regexp:/etc/postfix/helo.regexp, permitsmtpd_helo_restrictions =permit_mynetworks,reject_non_fqdn_hostname,reject_unknown_hostname,reject_invalid_hostname,regexp:/etc/postfix/helo.regexp,check_helo_access hash:/etc/postfix/access,check_helo_access hash:/etc/postfix/maps/access,permit# check_helo_access hash:/etc/postfix/access_helo,smtpd_client_restrictions =check_client_access hash:/etc/postfix/access,check_client_access hash:/etc/postfix/maps/access,permit_sasl_authenticated,permit_mynetworks,reject_multi_recipient_bounce,reject_rbl_client bl.spamcop.net,reject_rbl_client multihop.dsbl.org,reject_rbl_client unconfirmed.dsbl.org,permit# reject_unknown_client_hostname,# reject_unknown_reverse_client_hostname,smtpd_sender_restrictions =check_sender_access hash:/etc/postfix/access,check_sender_access hash:/etc/postfix/maps/access,permit_mynetworks,reject_non_fqdn_sender,reject_unknown_sender_domain,reject_unverified_sender,reject_rhsbl_client bl.spamcop.net,reject_rhsbl_client multihop.dsbl.org,reject_rhsbl_client unconfirmed.dsbl.org,permitaddress_verify_map = btree:/etc/postfix/verifyaddress_verify_sender = postmaster@paginasamarillas.comsmtpd_recipient_restrictions =check_sender_access hash:/etc/postfix/sender_checks,reject_invalid_hostname,### Can cause issues with Auth SMTP, so be weary!reject_non_fqdn_hostname,##################################reject_non_fqdn_sender,reject_non_fqdn_recipient,reject_unknown_sender_domain,reject_unknown_recipient_domain,permit_mynetworks,reject_unauth_destination,smtpd_recipient_restrictions =check_client_access hash:/etc/postfix/helo_client_exceptionscheck_sender_access hash:/etc/postfix/access,check_sender_access hash:/etc/postfix/maps/access,reject_invalid_hostname,permit_auth_destination,reject_non_fqdn_sender,reject_non_fqdn_recipient,reject_unknown_sender_domain,reject_unknown_recipient_domain,reject_unlisted_recipient,reject_unverified_recipient,permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,check_client_access hash:/etc/postfix/rbl_client_exceptions,reject_rbl_client cbl.abuseat.org,reject_rbl_client sbl-xbl.spamhaus.org,reject_rbl_client bl.spamcop.net,reject_rhsbl_sender dsn.rfc-ignorant.org,check_policy_service inet:127.0.0.1:60000permit# reject_rbl_client bl.spamcop.net,# reject_rbl_client list.dsbl.org,# reject_rbl_client multihop.dsbl.org,# reject_rbl_client unconfirmed.dsbl.org,# reject_rbl_client blackholes.wirehub.net,# reject_rbl_client dnsbl.njabl.org,# reject_rbl_client dynablock.wirehub.net,# reject_rbl_client proxies.relays.monkeys.com,# reject_rbl_client dialups.relays.osirusoft.com,# reject_rbl_client spamhaus.relays.osirusoft.com,# reject_rbl_client orbs.dorkslayers.com,# reject_rbl_client socks.relays.osirusoft.com,# reject_rbl_client inputs.relays.osirusoft.com,# reject_rbl_client relays.visi.com,# reject_rbl_client opm.blitzed.org,smtpd_restriction_classes = local_onlylocal_only =permit_mynetworks,reject_unauth_destination,check_recipient_access hash:/etc/postfix/local_domains,reject#### SASLsmtp_sasl_auth_enable = nosmtpd_sasl_auth_enable = yessmtpd_sasl_local_domain =smtpd_sasl_security_options = noanonymousbroken_sasl_auth_clients = yes#### TLSsmtpd_use_tls = yessmtp_use_tls = yessmtpd_tls_auth_only = nosmtp_tls_note_starttls_offer = yessmtpd_tls_key_file = /etc/postfix/ssl/smtpd.keysmtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crtsmtpd_tls_CAfile = /etc/postfix/ssl/cacert.pemsmtpd_tls_loglevel = 1smtpd_tls_received_header = yessmtpd_tls_session_cache_timeout = 3600stls_random_source = dev:/dev/urandommailbox_size_limit = 10240000message_size_limit = 10240000mydestination = /etc/postfix/local-host-namescontent_filter=smtp-amavis:[127.0.0.1]:10024#chequeos adicionalesheader_checks = regexp:/etc/postfix/maps/header_checksbody_checks = regexp:/etc/postfix/maps/body_checksmime_header_checks = regexp:/etc/postfix/maps/mime_header_checks

 ===================================================================== Ultimo Cambio v-1.1: Kasandra 21/03/2006 Primera version Wiki Ultimo Cambio v-1.0: Kasandra 21/10/2005 Incluye sasl, cyrus, etc Ultimo Cambio v-0.95: Kasandra 14/06/2005 Incluye filtros con procmail Ultimo Cambio v-0.9: Kasandra 22/11/2004 Cambia nombre antitodo-howto Ultimo Cambio v-0.8: Kasandra 11/09/2004 Cambia nombre antispam-howto Ultimo Cambio v-0.9: Kasandra 17/08/2004 Ultimo Cambio v-0.8: Kasandra 02/04/2004 Ultimo Cambio v-0.7: Lcarvajal 24/04/2004 Inicio----------------------------------------------------------------------------  Se usa parte del documento de Fernando J. Pereda Garcimartí­n  

Advertencia

Este documento es privado y es de uso exclusivo de sus autores y de SKINA TECH. Cualquier uso sin una autorización escrita es contra le ley de derechos de autor y de propiedad intelectual, y será motivo de una acción legal.