Curs 8

Serviciul de e-mail

Gestiunea Serviciilor de Ret, ea

8 decembrie 2011

GSR

Curs 8, Serviciul de e-mail

1/45

Moto

Diamonds are forever. E-mail comes close.

GSR

Curs 8, Serviciul de e-mail

2/45

E-mail
Postfix
Courier IMAP
Maildrop
E-mail security
Anti-spam
Incheiere
Intrebari

GSR

Curs 8, Serviciul de e-mail

3/45

Prerequisites

Cartea de RL:
http://books.google.com/books?id=GdF_3ttxnRIC
I

GSR

Capitolul 8 E-mail

Curs 8, Serviciul de e-mail

4/45

Suport

Unix and Linux System Administration

I

GSR

Chapter 20 Electronic Mail

Professional Linux System Administration

Chapter 10 Mail Services

Curs 8, Serviciul de e-mail

5/45

Outline
E-mail
Postfix
Courier IMAP
Maildrop
E-mail security
Anti-spam
Incheiere
Intrebari

GSR

Curs 8, Serviciul de e-mail

6/45

E-mail

GSR

killer-app of the Internet n anii 80

mesaje text

MIME Multipurpose Internet Mail Extensions

SMTP, POP3, IMAP

MTA, MUA, MSA, MDA/LDA

mbox/Maildir

Curs 8, Serviciul de e-mail

7/45

Funct, ionare e-mail

GSR

Curs 8, Serviciul de e-mail

8/45

Funct, ionare e-mail (2)

GSR

Curs 8, Serviciul de e-mail

9/45

Servere de e-mail

MTA Mail Transfer Agent, mail relay

I
I
I
I
I

Server IMAP/POP3
I
I
I

GSR

SMTP, portul 25
livreaza s, i primesc mesaje
surse pentru MTA: MUA, alt MTA
destinat, ii pentru MTA: casut, a pos, tala, alt MTA
Sendmail, Postfix, Exim, Dovecot, Microsoft Exchange Server
IMAP 143 (993)
POP3 110 (995)
Courier-IMAP, Courier-POP, Cyrus IMAP, WU-IMAP,
Microsoft Exchange Server

Curs 8, Serviciul de e-mail

10/45

Client, i de e-mail

GSR

SMTP, POP3, IMAP

extra: news, aggregators

Alpine, Mutt, mailx

Microsoft Outlook, Mozilla Thunderbird, Evolution, KMail,

Claws

webmail

calendaring, autentificare, LDAP, SSL/TLS

PGP, thread view, phishig, labels, signatures, searching

PIM Personal Information Manager

Curs 8, Serviciul de e-mail

11/45

LDA

GSR

Local Delivery Agent / Mail Delivery Agent

MTA LDA casut, a pos, tala

forma de baza integrata n MTA

filtrare (pe directoare), actualizare mesaje, utilitare externe

Curs 8, Serviciul de e-mail

12/45

Formate de casut, e pos, tale

intrari n sistemul de fis, iere pentru stocarea mesajelor

I

mbox
I
I

RFC 2822
un singur fis, ier stocheaza mesajele
/var/[spool/]mail/$username

Maildir
I
I

fiecare mesaj este stocat ntr-un fis, ier

trei subdirectoare
I
I
I

GSR

tmp temporar (necesar pentru sincronizarea fis, ierului n new)

new fis, iere noi
cur fis, iere accesate de clientul de e-mail

Curs 8, Serviciul de e-mail

13/45

Outline
E-mail
Postfix
Courier IMAP
Maildrop
E-mail security
Anti-spam
Incheiere
Intrebari

GSR

Curs 8, Serviciul de e-mail

14/45

Postfix

Wietse Venema, IBM Research

aparut n 1999, activ dezvoltat

suport pentru TLS, mbox, Maildir, Milter etc.

portabil pe majoritatea Unix-urilor

alternativa la Sendmail

un set de daemoni/procese/delivery agents

I
I
I

least privilege
chroot
master (root), smtpd, cleanup, bounce, trivial-rewrite

delivery agents
I

GSR

security design

smtp, local, lmtp, virtual, pipe

Curs 8, Serviciul de e-mail

15/45

Arhitectura Postfix

GSR

Curs 8, Serviciul de e-mail

16/45

Interact, iune cu Postfix

I
I

/etc/init.d/postfix start|stop|restart|reload
/etc/postfix/main.cf
I
I

I
I

man 5 postconf
/usr/share/postfix/main.cf.dist

editare de mana
folosire postconf
I
I

postconf listare directive de configurare

postconf -e nume_directiva = valore_directiva
I

/etc/postfix/master.cf
I
I

GSR

postconf -e mydestination = alpha.ro

configurare daemoni
man 5 master

Curs 8, Serviciul de e-mail

17/45

Configurare de baza Postfix

myhostname, mydomain, myorigin

mynetworks, mydestination

inet_interfaces

relay_domains
home_mailbox

I
I
I
I
I

GSR

casut, a pos, tala

pathname relative to userss home directory
daca nu se precizeaza /var/[spool/]mail/user
Mailbox format mbox
Maildir/ format Maildir (se termina cu /)

Curs 8, Serviciul de e-mail

18/45

Utilitarul mail

miniclient de e-mail

pachetul mailx
citire mesaje

I
I

scriere mesaje
I

GSR

mail
cites, te din post office (/var/mail/) (suprasris de variabila
de mediu MAIL)
h pentru ajutor
echo "message" | mail -s $subject -c $carbon_copy
$destination
echo "hello" | mail -s hello -c bob@beta.org
ana@beta.org

Curs 8, Serviciul de e-mail

19/45

Configurare alias-uri
I
I

redirectari de mesaje (forwarding)

tabele de aliasuri
I

utilitare specifice obt, in fis, iere index (binare) .db (sau .dbm)
folosite de MTA

compatibilitate Sendmail
I
I
I
I

directivele alias_maps s, i alias_database n Postfix

/etc/aliases, /etc/aliases.db
newaliases
postalias /etc/aliases

configurare per user

I

/.forward
I

GSR

destionation_name1, destination_name2

editarea se face n fis, iere text

I

alias_name:

cont, ine adresele c

atre care va fi livrat mesajul

Curs 8, Serviciul de e-mail

20/45

Configurare domenii virtuale

domenii multiple partajate

I

mydestination = alpha.org beta.org gogu.com

dorel.ro

domenii separate
I

virtual_alias_domains = example.com mydomain.com

I

I
I

GSR

diferite de domeniile din $mydestination

virtual_alias_maps = hash:/etc/postfix/virtual
cat /etc/postfix/virtual
info@example.com alice
sales@example.com bob
postmap /etc/postfix/virtual

Curs 8, Serviciul de e-mail

21/45

Suport Maildir n Postfix

home_mailbox=Maildir/

se comenteaza directiva mailbox_command

creare director Maildir

GSR

maildirmake Maildir/

maildirmake este instalat cu diferite pachete (maildrop,

courier-imap etc.)

Curs 8, Serviciul de e-mail

22/45

Outline
E-mail
Postfix
Courier IMAP
Maildrop
E-mail security
Anti-spam
Incheiere
Intrebari

GSR

Curs 8, Serviciul de e-mail

23/45

Courier IMAP

parte din suita Courier Mail Server (SMTP, IMAP, POP3,

SMAP, webmail, maildrop)

apt-get install courier-imap

/etc/courier/imapd
suport SSL

I
I

GSR

apt-get install courier-imap-ssl

/etc/courier/imapd-ssl

/etc/init.d/courier-imap start|stop|restart

/var/log/mail.log

Curs 8, Serviciul de e-mail

24/45

Casut, e pos, tale virtuale n Courier IMAP

I
I

courier-authdaemon Courier authentication daemon

/etc/courier/authdaemonrc
I

GSR

authmodulelist="authuserdb" (userdatabase)

userdb (comanda)

Curs 8, Serviciul de e-mail

25/45

Outline
E-mail
Postfix
Courier IMAP
Maildrop
E-mail security
Anti-spam
Incheiere
Intrebari

GSR

Curs 8, Serviciul de e-mail

26/45

Maildrop

GSR

MDA

apt-get install maildrop

/etc/maildroprc

$HOME/.mailfilter

$HOME/.mailfiters/

integrare cu Postfix

mailbox_command = /usr/local/bin/maildrop -d
$USER

Curs 8, Serviciul de e-mail

27/45

Configurare Maildrop
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
GSR

PATH=/bin:/usr/bin:/usr/local/bin
DEFAULT=$HOME/Maildir/
MAILDIR=$HOME/Maildir
LOGFILE=$HOME/.mailfilterlogs
SHELL=/bin/bash
# lpi
if ( /^(From|To|Cc): .*@.*lpi\.org/ )
{
to $MAILDIR/.projects.lpic/
}
# pisr
if ( /^Subject: .*\[pisr\]/ || /^Subject: .*PISR.*/ )
{
to $MAILDIR/.school.pisr/
}
# Catch-all rule for all unmatched email
to $MAILDIR/
Curs 8, Serviciul de e-mail

28/45

Outline
E-mail
Postfix
Courier IMAP
Maildrop
E-mail security
Anti-spam
Incheiere
Intrebari

GSR

Curs 8, Serviciul de e-mail

29/45

SASL

GSR

Simple Authentication and Security Layer (RFC 4422)

framework for authentication and data security

separarea mecanismului de autentificare de protocolul de date

foloses, te mecanisme de autentificare (ca module): PLAIN,

OTP, DIGEST-MD5 etc.

Curs 8, Serviciul de e-mail

30/45

SASL Life Cycle

GSR

Curs 8, Serviciul de e-mail

31/45

Suport TLS n Postfix

GSR

implicit, la instalarea postfix

Curs 8, Serviciul de e-mail

32/45

Configurare client

New Account

adresa

nume de utilizator
SMTP Server (sending e-mail)

I
I

IMAP Server (receiving e-mail) (993)

I

GSR

use authentication (SASL)

TLS enable
SSL enable

Curs 8, Serviciul de e-mail

33/45

DKIM/ADSP

GSR

DomainKeys Identified Mail

un mesaj primes, te o semnatura DKIM-Signature

verificatorul obt, ine o cheie publica folosind DNS s, i apoi

verifica semnatura

informat, ia este stocata ntr-o resursa TXT

Curs 8, Serviciul de e-mail

34/45

Outline
E-mail
Postfix
Courier IMAP
Maildrop
E-mail security
Anti-spam
Incheiere
Intrebari

GSR

Curs 8, Serviciul de e-mail

35/45

SPF

GSR

Sender Policy Framework

intrare SPF n DNS

example.com.

se verifica header-ul

IN SPF "v=spf1 a mx -all"

Curs 8, Serviciul de e-mail

36/45

Greylisting

GSR

temporary reject email (4xx SMTP error code)

MTA-ul init, iator va ncerca reconectare

la fiecare conexiune se ret, ine adresa IP sursa, sender address,

recipient address

la reconectare se verifica

avantaj: funct, ioneaza (spammerii, n general, nu retrimit

mesaje), configurare minima, resurse consumate minime

dezavantaje: ntarzierea mesajelor, anumite servere/client, i

vechi nu vor retrimite

n general, first line of defense n fat, a spam filterelor

Curs 8, Serviciul de e-mail

37/45

Blacklisting

GSR

DNSBL DNS-based Blackhole List

lista de adrese IP publicate prin DNS fie un fis, ier zona, fie o
zona live

prima implementare RBL (Real-time Blackhole List)

The Spamhaus Project

Curs 8, Serviciul de e-mail

38/45

Postgrey

Postfix Greylisting Policy Server

apt-get install postgrey

/etc/postgrey/whitelist_*

conexiuni pe portul 60000 local

n /etc/postfix/main.cf

I
I

GSR

smtpd_recipient_restrictions
check_policy_service inet:127.0.0.1:60000

Curs 8, Serviciul de e-mail

39/45

Blacklisting n Postfix

GSR

smtpd_recipient_restrictions

reject_rbl_client sbl-xbl.spamhaus.org

Curs 8, Serviciul de e-mail

40/45

SpamAssassin

GSR

e-mail spam filtering

content-matching rule

DNS-based, Bayesian filtering, external programs, blacklists

apt-get install spamassassin

/etc/default/spamassassin enable

/etc/init.d/spamassassin

grup s, i utilizator aferent (spamd)

Curs 8, Serviciul de e-mail

41/45

Outline
E-mail
Postfix
Courier IMAP
Maildrop
E-mail security
Anti-spam
Incheiere
Intrebari

GSR

Curs 8, Serviciul de e-mail

42/45

Cuvinte cheie

GSR

e-mail

domenii virtuale

MTA, MUA, MSA, MDA

casut, e pos, tale virtuale

SMTP, POP3, IMAP

Courier-IMAP

mbox, Maildir

userdb

/var/mail/

Maildrop

Postfix

SASL

/etc/postfix/main.cf

saslauthd

/etc/postfix/master.cf

TLS

postconf

SSL

mail

greylisting, blacklisting

/etc/aliases

postgrey

newaliasias, postalias

SpamAssassin

Curs 8, Serviciul de e-mail

43/45

Resurse utile

I http://www.postfix.org/
I http://www.courier-mta.org/maildrop/
I http://www.courier-mta.org/imap/
I http://en.wikipedia.org/wiki/Simple_Authentication_and_

Security_Layer
I http://en.wikipedia.org/wiki/DNSBL
I http://postgrey.schweikert.ch/
I http://spamassassin.apache.org/

GSR

Curs 8, Serviciul de e-mail

44/45

Outline
E-mail
Postfix
Courier IMAP
Maildrop
E-mail security
Anti-spam
Incheiere
Intrebari

GSR

Curs 8, Serviciul de e-mail

45/45