Email quest – part 2
After venturing into the basic architecture of a robust email solution last week, we will look into the remaining missing bits today. Then we should look for some answers about how to secure the email communication end-to-end. In this article we find anti-spam and anti-virus solution integrated into our infrastructure, configure server-side filters, add DKIM[1] signing and verification and give our users nice webmail interface to use.
Amavis: Anti-spam and anti-virus
In order to protect our users from malicious programs distributed by unsolicited email and also to shield them from the burden of finding legitimate email in their mailboxes, we use amavisd-new[2] software package which can integrate multiple filtering and scoring solutions into one email proxy that can flag or ultimately drop emails based on a predefined set of tests. For our anti-spam solution we use Apache SpamAssassin[3] and to protect against malicious software we leverage the ClamAV[4] antivirus.
We can install all of them pretty simply:
yum install amavisd-new spamassassin clamav
First, we configure SpamAssassin. Contrary to the default installation, we want to run the SpamAssassin daemon under separate user from the start as it processes potentially untrusted data. We prepare a user for that:
groupadd spamd useradd -g spamd -s /bin/false -d /var/log/spamassassin spamd chown spamd:spamd /var/log/spamassassin
Then update start options of the daemon in /etc/sysconfig/spamassasin:
SPAMDOPTIONS="-d -c -m5 -H -u spamd"
And start it:
systemctl enable spamassassin systemctl start spamassassin
Now we are ready to configure ClamAV. There are actually two components that need to be configured. Firstly the ClamAV daemon itself and secondly the freshclam service that ensure the latest virus database is always available to it. ClamAV scanning service is configured in /etc/clamd.d/scan.conf and basically the following is sufficient:
DatabaseDirectory /var/lib/clamav LocalSocket /var/run/clamd.scan/clamd.sock ScanMail yes
And of course, we start the daemon:
systemctl enable clamd@scan systemctl start clamd@scan
For the freshclam service, everything should be ready and we just need to enable and start it:
systemctl enable clam-freshclam systemctl start clam-freshclam
Integrating anti-spam and anti-virus using amavisd-new into postfix[5] is pretty easy. We setup the general amavisd-new service in /etc/amavisd/amavisd.conf, by adding the following modifications:
$mydomain = 'trustica.cz'; $myhostname = 'mailserver.trustica.cz'; $notify_method = 'smtp:[127.0.0.1]:10025'; $forward_method = 'smtp:[127.0.0.1]:10025'; # set to undef with milter!
And, once again, just start the service:
systemctl enable amavisd systemctl start amavisd
On the postfix side of the email queue, we tell it to pass all incoming email to amavisd-new for filtering by adding the following configuration to /etc/postfix/main.cf:
content_filter=smtp-amavis:[127.0.0.1]:10024
In the /etc/postfix/master.cf configuration file we add stanza for the return receiver on TCP[6] port 10025 with content_filter option disabled:
127.0.0.1:10025 inet n - n - - smtpd
-o content_filter=
And then only restart postfix to start using our amavisd-new with anti-virus and anti-spam filters:
systemctl restart postfix
This is it. We have protected our users against spam and viruses (mostly).
Server-side filters in dovecot
Many users do not realize it as they see email filtering of any email solution they use, but for both common cases – either using web mail or desktop mail user agent – there are many benefits of server-side filtering. To integrate it seamlessly into both solutions, the delivery agent and IMAP[7] server must do it the right way. The current Internet standard for email filtering is the Sieve[8] protocol and language.
For dovecot[9], there is a Sieve implementation called pigeonhole. Wouldn’t it be nice if those pigeons delivering your messages would also do some filtering based on your preferences and – for example – spam checking which has taken place just before email delivery? We install the plugin easily:
yum install dovecot-pigeonhole
To configure it, we need to ensure the following directives are present in dovecot configuration:
mail_plugins = $mail_plugins imap_stats imap_sieve sieve_plugins = sieve_imapsieve
And then just restart the dovecot service:
systemctl restart dovecot
Now it is possible to configure your server-side filters using either your favorite mail client plugin or you can wait for web mail to be configured and use web-based administration interface provided there.
DKIM signing
To add DKIM signatures to outgoing emails – for configured domains – and to verify signatures of incoming email messages, we use OpenDKIM[10]. It can be easily installed with:
yum install opendkim
With OpenDKIM installed, we create our default signing key by issuing the following commands:
opendkim-default-keygen
This generates the signing key in /etc/opendkim/keys/default.txt. We can change the comment to reflect our system name, but the important part is the key anyway.
As we will use OpenDKIM for both signing and verification and we want to use it for signing email messages of multiple domains, the following configuration prepares everything for us:
Mode sv Socket inet:8891@localhost Canonicalization relaxed/simple KeyTable refile:/etc/opendkim/KeyTable SigningTable refile:/etc/opendkim/SigningTable ExternalIgnoreList refile:/etc/opendkim/TrustedHosts InternalHosts refile:/etc/opendkim/TrustedHosts
Mode directive tells OpenDKIM to process both outgoing emails by adding DKIM signature as instructed in key and signing tables and verifying incoming emails containing DKIM signatures. The key and signing tables map keys and domains, so we can use single key for signing messages from multiple domains and we can also use multiple signing keys on our system. OpenDKIM documentation gives more detailed information on this.
Technically speaking OpenDKIM implements „milter“[11] – that is sendmail[12]-compatible filter that gets a message plus some meta information, processes the message and returns the result to the calling process. Connecting postfix to milter is really straightforward and can be achieved by adding the following to /etc/postfix/main.cf configuration file:
smtpd_milters = inet:127.0.0.1:8891 non_smtpd_milters = $smtpd_milters milter_default_action = accept
Now we just enable and start OpenDKIM daemon and restart postfix:
systemctl enable opendkim systemctl start opendkim systemctl restart postfix
And this is it. We are signing outgoing messages as specified in key and signing tables and we are able to use OpenDKIM daemon for verifying incoming messages‘ DKIM signatures.
Webmail
The simplest way of installing Roundcube[13] web mail is the same way as installing postfixadmin[14]. We download the distribution tarball, unpack it to designated directory in our webserver document root and change access rights in order to ensure the HTTP server process can write to required subdirectories:
wget http://nchc.dl.sourceforge.net/project/roundcubemail/roundcubemail/1.1.3/roundcubemail-1.1.3-complete.tar.gz tar -zxvf roundcubemail-1.1.3-complete.tar.gz -C /var/www/html mv /var/www/html/roundcubemail-1.1.3/ /var/www/html/roundcube chown apache:apache /var/www/html/roundcube/temp/ chown apache:apache /var/www/html/roundcube/logs/ chcon -t httpd_sys_content_rw_t /var/www/html/roundcube/temp/ chcon -t httpd_sys_content_rw_t /var/www/html/roundcube/logs/
As with postfixadmin, Roundcube comes with web-based installer and we launch it by pointing our favorite web browser to https://mailserver.trustica.cz/roundcube/installer. During the installation we chose to install jqueryui, managesieve and password plugins. Sometimes, there are problems with PHP[15] installation concerning date formatting and time zone. This is especially true for example with Czech locales. We fix this by adding the following to php.ini file:
date.timezone = "Europe/Prague"
The directive should match system time zone.
As we have installed plugins for password changing and managing sieve filters, we need to allow the HTTP server process to connect to TCP sockets as all the management is done over TCP – although only locally in our case:
setsebool -P httpd_can_network_connect=1 systemctl restart httpd
It is also advisable to run Roundcube database cleaning job regularly by adding the following to crontab[16]:
0 0 * * * apache bash /var/www/roundcube/bin/cleandb.sh > /dev/null 2>&1
And this is it, your users have web-based email client available at https://mailserver.trustica.cz/roundcube and they are able to use it for changing their passwords and managing server-side sieve filters.
Picture 1: Overall architecture of the system.
In this series we have looked at how complex can email communication become if you do it properly. We have also shown it is very robust communication platform and next week we are about to talk more about securing email communication end-to-end with no compromises. See you next week!
References
1. RFC 4870: Domain-Based Email Authentication Using Public Keys Advertised in the DNS (DomainKeys), Network Working Group, May 2007, available online at https://tools.ietf.org/html/rfc4870
2. amavisd-new, official homepage available at https://amavis.org/
3. Apache SpamAssassin, official homepage available at https://spamassassin.apache.org/
4. ClamAV antivirus, official homepage available at https://www.clamav.net/
5. Postfix, Wietse Venema’s mailserver, official homepage available at http://www.postfix.org/
6. RFC 793: TRANSMISSION CONTROL PROTOCOL, Defense Advanced Research Projects Agency, Information Processing Techniques Office, September, 1981, available online at https://tools.ietf.org/html/rfc793
7. RFC 1730: INTERNET MESSAGE ACCESS PROTOCOL – VERSION 4, Network Working Group, December 1994, available online at https://tools.ietf.org/html/rfc1730
8. RFC 3028: Sieve: A Mail Filtering Language, Network Working Group, January, 2001, available online at https://tools.ietf.org/html/rfc3028
9. Dovecot, secure IMAP server, official homepage available at https://www.dovecot.org/
10. OpenDKIM, official homepage available at http://www.opendkim.org/
11. Milter. (2018, January 6). In Wikipedia, The Free Encyclopedia. Retrieved 19:15, January 21, 2018, from https://en.wikipedia.org/w/index.php?title=Milter&oldid=819020086
12. Sendmail. (2017, October 28). In Wikipedia, The Free Encyclopedia. Retrieved 19:16, January 21, 2018, from https://en.wikipedia.org/w/index.php?title=Sendmail&oldid=807511570
13. Roundcube, open source webmail software, official homepage available at https://roundcube.net/
14. postfix.admin, official homepage available at http://postfixadmin.sourceforge.net/
15. PHP: Hypertext Preprocessor, available online at https://secure.php.net/
16. Cron. (2018, January 11). In Wikipedia, The Free Encyclopedia. Retrieved 19:18, January 21, 2018, from https://en.wikipedia.org/w/index.php?title=Cron&oldid=819898936