{"action":"created","issue":{"url":"https://api.github.com/repos/andryyy/mailcow/issues/57","labels_url":"https://api.github.com/repos/andryyy/mailcow/issues/57/labels{/name}","comments_url":"https://api.github.com/repos/andryyy/mailcow/issues/57/comments","events_url":"https://api.github.com/repos/andryyy/mailcow/issues/57/events","html_url":"https://github.com/andryyy/mailcow/issues/57","id":89590201,"number":57,"title":"More security options?","user":{"login":"Norcoen","id":1840514,"avatar_url":"https://avatars.githubusercontent.com/u/1840514?v=3","gravatar_id":"","url":"https://api.github.com/users/Norcoen","html_url":"https://github.com/Norcoen","followers_url":"https://api.github.com/users/Norcoen/followers","following_url":"https://api.github.com/users/Norcoen/following{/other_user}","gists_url":"https://api.github.com/users/Norcoen/gists{/gist_id}","starred_url":"https://api.github.com/users/Norcoen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Norcoen/subscriptions","organizations_url":"https://api.github.com/users/Norcoen/orgs","repos_url":"https://api.github.com/users/Norcoen/repos","events_url":"https://api.github.com/users/Norcoen/events{/privacy}","received_events_url":"https://api.github.com/users/Norcoen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-06-19T15:19:16Z","updated_at":"2015-10-02T08:14:36Z","closed_at":null,"body":"I'm slowly getting comfortable with my mailserver running based on mailcow, so I started poking around what more I could possibly add to it for more \"security\".\r\nFirst thing that I came across was DMARC, since we already use SPF and DKIM, it was the logical next step for me.\r\nSearching for a good manual I came across this post:\r\nhttps://www.skelleton.net/2015/03/21/how-to-eliminate-spam-and-protect-your-name-with-dmarc/\r\n\r\nReading it, I came across few other things I think could be worth implementing:\r\n- [ ] Place a bouncer – Validate SPF within Postfix, rewrite headers or reject mails that fail the SPF checks\r\n- [x] Rewrite headers, checking incoming mail for valid DKIM and DMARC (right now we send DKIM, but we don't check it)\r\n- [ ] Help out your fellow admins – DMARC reporting\r\n- [ ] Tweak Spamassassin (I didn't try that yet because I don't understand what exactly he's tweaking/scripting), move failed SPF/DKIM/DMARC mails to junk folder with script.\r\n- [x] Use Dovecot and Sieve to redirect spam to your users junk folder (I think mailcow does this already, didn't have the chance to test it yet)\r\n- [x] Use postgrey? (Can we use it in addition to postscreen? I think it wouldn't hurt, my office has been using postgrey for years) Maybe SQLgrey would be a nice alternative to integrate with the existing database mailcow set up.\r\n\r\nThe setup steps for the SPF bounce in the article work out-of-the-box on Debian 8:\r\n```\r\nJun 19 13:29:50 server1 policyd-spf[11025]: Pass; identity=mailfrom; client-ip=XXX.YYY.17.21; helo=mout.gmx.net; envelope-from=johndoe@gmx.net; receiver=janedoe@example.de\r\n```\r\nThe DMARC part was a bit tricky and cost me a couple of hours. For you it might be easy, but I had some trouble with which options goes into which file and into which section\r\nFinally the sections in my ```/etc/postfix/master.cf``` look like this:\r\n...\r\n```\r\n# Postscreen passes sane clients to the real SMTP daemon here.\r\nsmtpd      pass  -       -       n       -       -       smtpd\r\n  -o cleanup_service_name=cleanup_fufix\r\n  -o content_filter=spamassassin\r\n  -o smtpd_milters=inet:127.0.0.1:10040,inet:localhost:54321\r\n\r\n# MOL - 18.06.205 - enable SMTP TLS on Port 465\r\nsmtps    inet  n       -       n       -       -       smtpd\r\n  -o smtpd_tls_wrappermode=yes\r\n  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject\r\n  -o content_filter=spamassassin\r\n  -o smtpd_milters=inet:127.0.0.1:10040\r\n\r\n# For mail submitting users. Authenticated clients and known networks only.\r\nsubmission inet n       -       -       -       -       smtpd\r\n  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject\r\n  -o smtpd_enforce_tls=yes\r\n  -o smtpd_tls_security_level=encrypt\r\n# smtpd_sasl_auth_enable is already set in main.cf and therefore enabled for all services inside master.cf\r\n#  -o smtpd_sasl_auth_enable=yes\r\n  -o tls_preempt_cipherlist=yes\r\n  -o content_filter=spamassassin\r\n  # Though a milter is run before-queue, DKIM signatures will be valid after SA content-filter\r\n  -o smtpd_milters=inet:127.0.0.1:10040\r\n```\r\n...\r\n\r\nI'm not sure what it looked like before, but i think I got the ```smtpd_milters``` right now, it was trial and error.\r\n\r\n\r\n\r\nReading through the configs on my server I also discovered that in ```/etc/postfix/main.cf``` under ```smtpd_recipient_restrictions``` we define ```reject_unauth_destination``` two times. Is this intended?\r\n\r\nAlso that spamassassin wasn't running causing this error in the logs (might be connected to #49): \r\n```\r\nJun 19 13:19:22 server1 spamc[10876]: connect to spamd on 127.0.0.1 failed, retrying (#3 of 3): Connection refused\r\nJun 19 13:19:22 server1 spamc[10876]: connection attempt to spamd aborted after 3 retries\r\n```\r\n\r\nKind regards\r\nFrank"},"comment":{"url":"https://api.github.com/repos/andryyy/mailcow/issues/comments/144955939","html_url":"https://github.com/andryyy/mailcow/issues/57#issuecomment-144955939","issue_url":"https://api.github.com/repos/andryyy/mailcow/issues/57","id":144955939,"user":{"login":"andryyy","id":2972950,"avatar_url":"https://avatars.githubusercontent.com/u/2972950?v=3","gravatar_id":"","url":"https://api.github.com/users/andryyy","html_url":"https://github.com/andryyy","followers_url":"https://api.github.com/users/andryyy/followers","following_url":"https://api.github.com/users/andryyy/following{/other_user}","gists_url":"https://api.github.com/users/andryyy/gists{/gist_id}","starred_url":"https://api.github.com/users/andryyy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andryyy/subscriptions","organizations_url":"https://api.github.com/users/andryyy/orgs","repos_url":"https://api.github.com/users/andryyy/repos","events_url":"https://api.github.com/users/andryyy/events{/privacy}","received_events_url":"https://api.github.com/users/andryyy/received_events","type":"User","site_admin":false},"created_at":"2015-10-02T08:14:35Z","updated_at":"2015-10-02T08:14:35Z","body":"No problem! :-)\r\nNot sure if security related, but I will try to add a configurable rate-limit per user in the next release. "}}