Anti-virus, anti-spam y hardening de correo > 2024

Este documento describe como se configura un servidor de correo Postfix  para ofrecer la mayor oposicion contra SPAM, Virus y demas amenazas.

Las medidas pueden ser tomadas en varios ambientes, empezando por el mismo MTA y luego utilizando herramientas adicionales

Solo postfix ya hace

“… I would first like to make a point about authenticated SMTP (using SASL2) and TLS encryption. While this is not exactly an anti-spam measure, assuming that some persons (users) need to relay mail through your server, enabling authenticated smtp relaying can limit spammers' abilities to use your server as an open relay. TLS encryption will prevent anyone in the middle (logically) of your users and mail server from being able to sniff (read/detect)
information about mail being sent or passwords being used. …”

#### TLSsmtpd_use_tls = yessmtp_use_tls = yessmtpd_tls_auth_only = nosmtp_tls_note_starttls_offer = yessmtpd_tls_key_file = /etc/pki/tls/private/sk_sinternet.skinatech.com.keysmtpd_tls_cert_file = /etc/pki/tls/certs/sk_sinternet.skinatech.com.certsmtpd_tls_CAfile = /etc/pki/tls/cert.pemsmtpd_tls_loglevel = 1smtpd_tls_received_header = yessmtpd_tls_session_cache_timeout = 3600stls_random_source = dev:/dev/urandom

La autenticacion adicional usando SASL mejora lo selectivo del sistema http://www.securitysage.com/antispam/sasltls.html

Amavis es la herramienta que permite mezclar en un solo programa varias herramientas de filtrado de correo como anti-spams y anti-virus

• Configuración especial del MTA
• SpamAssasin
• CLam Antivirus
• Amavis

En mandrake tengo

• libclamav1-0.67-4mdk
• clamav-0.67-4mdk
• clamav-db-0.67-4mdk
• clamd-0.67-4mdk
• amavisd-new-0.20030616-18mdk
• spamassassin-tools-2.63-2mdk
• spamassassin-2.63-2mdk

En Debian

• clamav 0.80-4 Antivirus scanner for Unix
• clamav-base 0.80-4 Base package for clamav, an anti-virus utili
• clamav-daemon 0.80-4 Powerful Antivirus scanner daemon
• clamav-data 20040725.23100 clamav data files
• libclamav1 0.80-4 Virus scanner library
• amavisd-new 20030616p10-4 Interface between MTA and virus scanner/cont
• razor 2.610-2 spam-catcher using a collaborative filtering
• spamassassin 2.64-1 Perl-based spam filter using text analysis
•  spamc 2.64-1 Client for perl-based spam filtering daemon

En /etc/amavis/amavisd.conf

$mydomain = 'skina.com.co';$forward_method = 'smtp:[127.0.0.1]:10025'; # donde recibe postfix de vuelta$notify_method = $forward_method;$final_virus_destiny = D_DISCARD; # (defaults to D_BOUNCE)$final_banned_destiny = D_BOUNCE; # (defaults to D_BOUNCE)$final_spam_destiny = D_REJECT; # (defaults to D_REJECT)$final_bad_header_destiny = D_PASS; # (defaults to D_PASS),$virus_quarantine_to = undef; # No ponga nada en cuarentena$inet_socket_port = 10024;$sa_local_tests_only = 0;#  @local_domains_acl = ( ".$mydomain", 'cuy.mct.com.co', 'correo.mct.com.co' );$sa_tag_level_deflt = 4.0; # add spam info headers if at, or above that level$sa_tag2_level_deflt = 6.3; # add 'spam detected' headers at that level$sa_kill_level_deflt = $sa_tag2_level_deflt; # triggers spam evasive actions 

La opción que merece más atencion es $forward_method, que será la ví­a que utilizará amavisd-new para reinyectar el mensaje de correo en postfix; en este caso le hemos dicho que lo haga usando un smtp en localhost por el puerto 10025.


OJO: de que si lo dejaramos por defecto (D_REJECT) estarí­amos perdiendo  los posibles falsos positivos.

Revise que la seccion de clamav esta correcta y mas importante que el socket corresponda al real.

Crear un proceso SMTP que solo correrá en la interfaz loopback (127.0.0.1) en en el puerto 10025 y que pasará los correos a los usuarios sin pasarlo por amavisd-new. Esto es necesario para evitar que los correos entren en
un bucle sin fin. En /etc/postfix/main.cf añadiremos:

content_filter=smtp-amavis:[127.0.0.1]:10024

en /etc/postfix/master.cf:

### By Skinasmtp-amavis unix - - y - 2 smtp-o smtp_data_done_timeout=1200-o disable_dns_lookups=yes127.0.0.1:10025 inet n - n - - smtpd-o content_filter=-o local_recipient_maps=-o relay_recipient_maps=-o smtpd_restriction_classes=-o smtpd_client_restrictions=-o smtpd_helo_restrictions=-o smtpd_sender_restrictions=-o smtpd_recipient_restrictions=permit_mynetworks,reject-o mynetworks=127.0.0.0/8-o strict_rfc821_envelopes=yes-o smtpd_error_sleep_time=0-o smtpd_soft_error_limit=1001

Para que amavisd-new haga uso de SpamAssassin debemos cerciorarnos de que
no existe esta lí­nea en el fichero de configuración de amavisd-new. Si
la tenemos, es el momento de comentarla.

 @bypass_spam_checks_acl = qw( . )

En amavisd.conf suba el nivel de logueo $log_level=2;

y siga la bitacora de mail buscando … el inicio del filtro
en donde levanta el soporte para virus y spam y esta abriendo el
puerto 10024

Nov 22 19:59:42 alpha amavis[11780]: SMTP-in protocol code loaded

Nov 22 19:59:42 alpha amavis[11780]: ANTI-VIRUS code loaded

Nov 22 19:59:42 alpha amavis[11780]: ANTI-SPAM code loaded

pe Net::Server::PreForkSimple) starting! pid(11781)

Nov 22 19:59:42 alpha amavis[11781]: Net::Server: Binding to TCP port 10024 on host 127.0.0.1

Nov 22 19:59:42 alpha amavis[11781]: Net::Server: Setting gid to “109 109”

Nov 22 19:59:42 alpha amavis[11781]: Net::Server: Setting uid to “105”

Otro sitio intersante es ver el encabezado de los mails que han sido filtrados.

X-Virus-Scanned: by amavisd-new-20030616-p10 at example.com

OK

Si Ud quiere que ademas por ejemplo el correo que esta marcado sea enviado
a otro sitio … uhmmm hace falta procmail .. tonces el proceso.

A. Verfique que tiene instalado procmail …

###> which procmail
###> /usr/bin/procmail

B. Mire que el servidor de correo use procmail para enviarlo. Usualmente
postfix no lo hace .. tonces toca descomentar…

mailbox_command = /usr/bin/procmail

Monitoree la cosa pa tener certeza que funciona con un tail a la bitacora
de correo /var/log/maillog /var/log/maillog-20210103 /var/log/maillog-20210110 /var/log/maillog-20210118 /var/log/maillog-20210124 /var/log/maillog-20240505.gz /var/log/maillog-20240512.gz /var/log/maillog-20240519.gz /var/log/maillog-20240526.gz

C. Crear el archivo de configuracion de procmail (/etc/procmailrc).. pa que
funcione .. digamos puede identificarlo por el nivel de spam o por el
Subject. … ejm
 

 # Please check if all the paths in PATH are reachable, remove the ones that# are not.LOGFILE=/var/log/procmail.logVERBOSE=yesLOGABSTRACT=all# Mail that is very likely spam (>7) can be dropped on the floor.# Move the # up one line to save it on the server instead.# Note that dropping mail on the floor is a *bad*# idea unless you really, really believe no false positives will# have a score greater than 7.:0* ^X-Spam-Level: \\*\\*\\*\\*\\*\\*|\\^Subject: *RECHAZADO\\ EEC/var/spool/mail/basura 

OJO con los permisos del archivo de log /var/log/procmail.log y del buzon
de basura .. yo por pereza los puse 666

http://www.howtoforge.com/linux_spam_filter_mail_gateway http://www200.pair.com/mecham/spam/spamfilter20060630.html  

Cosas como lo que sigue en /etc/amavisd.conf … deja un comportamiento diferente para los usuarios locales.

$policy_bank{'MYUSERS'} = { terminate_dsn_on_notify_success => 0, spam_kill_level_maps => 6.9,  virus_admin_maps => ["virusalert\\@$mydomain"], # alert of internal viruses  spam_admin_maps  => ["spamalert\\@$mydomain"],  # alert of internal spam  bypass_spam_checks_maps   => [1],  # or: don't spam-check internal mail  bypass_banned_checks_maps => [1],  # don't banned-check internal mail  warnbadhsender => 1,  # warn local senders about their broken MUA  banned_filename_maps => ['MYNETS-DEFAULT'], # more permissive banning rules  spam_quarantine_cutoff_level_maps => undef, # quarantine all local spam  spam_dsn_cutoff_level_maps => undef,  # ensure NDN regardless of spam level  spam_dsn_cutoff_level_bysender_maps => # but only from local domain senders    [ { lc(".$mydomain") => undef,  '.' => 15 } ],}; 

http://postfixmail.com/blog/index.php/policy-banks-with-amavis/ –

• How to setup a mail server –  Lo han venido actualizando
• http://www.howtoforge.com/virtual_postfix_antispam –
• http://www.howtoforge.com/greylisting_postfix_postgrey –

Par de joyas en el internet Archive

• El sitio de antispam SAGE  (http://web.archive.org/web/20070106022525/http://www.securitysage.com/antispam/)
• Un excelente articulo con anti-spam y todo IMGate .. Lo de freeBSD lo puede ignorar
  

pero lo demas es bueniiiiisimo. !! Deberia tener copia local  (http://web.archive.org/web/20060516093559/http://www.cotel.com.ar/postfix)

FIN
=====================================================================
   ANEXO El maximo antispam

############# by skina ######################## Checks to remove badly formed emailinet_protocols = allstrict_rfc821_envelopes = yessmtpd_helo_required = yesdisable_vrfy_command = yessmtp_always_send_ehlo = yesbiff = nomaximal_queue_lifetime = 7200sdelay_warning_time = 1smtpd_hard_error_limit = 2strict_7bit_headers = yesdisable_dns_lookups = nostrict_8bitmime = nosmtpd_recipient_limit = 3smtpd_recipient_overshoot_limit=2unknown_address_reject_code = 554unknown_hostname_reject_code = 554unknown_client_reject_code = 554relayhost =defer_transports =mailbox_command =mailbox_transport =disable_mime_output_conversion = noprogram_directory = /usr/lib/postfixcanonical_maps = hash:/etc/postfix/canonical#virtual_alias_maps = hash:/etc/postfix/virtualvirtual_alias_domains = hash:/etc/postfix/virtualrelocated_maps = hash:/etc/postfix/relocatedtransport_maps = hash:/etc/postfix/transportsender_canonical_maps = hash:/etc/postfix/sender_canonicalmasquerade_exceptions = rootmasquerade_classes = envelope_sender, header_sender, header_recipientmasquerade_domains =#### restriccionessmtpd_data_restrictions =reject_unauth_pipelining,reject_multi_recipient_bounce,permitsmtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname, regexp:/etc/postfix/helo.regexp, permitsmtpd_helo_restrictions =permit_mynetworks,reject_non_fqdn_hostname,reject_unknown_hostname,reject_invalid_hostname,regexp:/etc/postfix/helo.regexp,check_helo_access hash:/etc/postfix/access,check_helo_access hash:/etc/postfix/maps/access,permit# check_helo_access hash:/etc/postfix/access_helo,smtpd_client_restrictions =check_client_access hash:/etc/postfix/access,check_client_access hash:/etc/postfix/maps/access,permit_sasl_authenticated,permit_mynetworks,reject_multi_recipient_bounce,reject_rbl_client bl.spamcop.net,reject_rbl_client multihop.dsbl.org,reject_rbl_client unconfirmed.dsbl.org,permit# reject_unknown_client_hostname,# reject_unknown_reverse_client_hostname,smtpd_sender_restrictions =check_sender_access hash:/etc/postfix/access,check_sender_access hash:/etc/postfix/maps/access,permit_mynetworks,reject_non_fqdn_sender,reject_unknown_sender_domain,reject_unverified_sender,reject_rhsbl_client bl.spamcop.net,reject_rhsbl_client multihop.dsbl.org,reject_rhsbl_client unconfirmed.dsbl.org,permitaddress_verify_map = btree:/etc/postfix/verifyaddress_verify_sender = postmaster@paginasamarillas.comsmtpd_recipient_restrictions =check_sender_access hash:/etc/postfix/sender_checks,reject_invalid_hostname,### Can cause issues with Auth SMTP, so be weary!reject_non_fqdn_hostname,##################################reject_non_fqdn_sender,reject_non_fqdn_recipient,reject_unknown_sender_domain,reject_unknown_recipient_domain,permit_mynetworks,reject_unauth_destination,smtpd_recipient_restrictions =check_client_access hash:/etc/postfix/helo_client_exceptionscheck_sender_access hash:/etc/postfix/access,check_sender_access hash:/etc/postfix/maps/access,reject_invalid_hostname,permit_auth_destination,reject_non_fqdn_sender,reject_non_fqdn_recipient,reject_unknown_sender_domain,reject_unknown_recipient_domain,reject_unlisted_recipient,reject_unverified_recipient,permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,check_client_access hash:/etc/postfix/rbl_client_exceptions,reject_rbl_client cbl.abuseat.org,reject_rbl_client sbl-xbl.spamhaus.org,reject_rbl_client bl.spamcop.net,reject_rhsbl_sender dsn.rfc-ignorant.org,check_policy_service inet:127.0.0.1:60000permit# reject_rbl_client bl.spamcop.net,# reject_rbl_client list.dsbl.org,# reject_rbl_client multihop.dsbl.org,# reject_rbl_client unconfirmed.dsbl.org,# reject_rbl_client blackholes.wirehub.net,# reject_rbl_client dnsbl.njabl.org,# reject_rbl_client dynablock.wirehub.net,# reject_rbl_client proxies.relays.monkeys.com,# reject_rbl_client dialups.relays.osirusoft.com,# reject_rbl_client spamhaus.relays.osirusoft.com,# reject_rbl_client orbs.dorkslayers.com,# reject_rbl_client socks.relays.osirusoft.com,# reject_rbl_client inputs.relays.osirusoft.com,# reject_rbl_client relays.visi.com,# reject_rbl_client opm.blitzed.org,smtpd_restriction_classes = local_onlylocal_only =permit_mynetworks,reject_unauth_destination,check_recipient_access hash:/etc/postfix/local_domains,reject#### SASLsmtp_sasl_auth_enable = nosmtpd_sasl_auth_enable = yessmtpd_sasl_local_domain =smtpd_sasl_security_options = noanonymousbroken_sasl_auth_clients = yes#### TLSsmtpd_use_tls = yessmtp_use_tls = yessmtpd_tls_auth_only = nosmtp_tls_note_starttls_offer = yessmtpd_tls_key_file = /etc/postfix/ssl/smtpd.keysmtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crtsmtpd_tls_CAfile = /etc/postfix/ssl/cacert.pemsmtpd_tls_loglevel = 1smtpd_tls_received_header = yessmtpd_tls_session_cache_timeout = 3600stls_random_source = dev:/dev/urandommailbox_size_limit = 10240000message_size_limit = 10240000mydestination = /etc/postfix/local-host-namescontent_filter=smtp-amavis:[127.0.0.1]:10024#chequeos adicionalesheader_checks = regexp:/etc/postfix/maps/header_checksbody_checks = regexp:/etc/postfix/maps/body_checksmime_header_checks = regexp:/etc/postfix/maps/mime_header_checks

 ===================================================================== Ultimo Cambio v-1.1: Kasandra 21/03/2006 Primera version Wiki Ultimo Cambio v-1.0: Kasandra 21/10/2005 Incluye sasl, cyrus, etc Ultimo Cambio v-0.95: Kasandra 14/06/2005 Incluye filtros con procmail Ultimo Cambio v-0.9: Kasandra 22/11/2004 Cambia nombre antitodo-howto Ultimo Cambio v-0.8: Kasandra 11/09/2004 Cambia nombre antispam-howto Ultimo Cambio v-0.9: Kasandra 17/08/2004 Ultimo Cambio v-0.8: Kasandra 02/04/2004 Ultimo Cambio v-0.7: Lcarvajal 24/04/2004 Inicio----------------------------------------------------------------------------  Se usa parte del documento de Fernando J. Pereda Garcimartí­n  

Advertencia

Este documento es privado y es de uso exclusivo de sus autores y de SKINA TECH. Cualquier uso sin una autorización escrita es contra le ley de derechos de autor y de propiedad intelectual, y será motivo de una acción legal.