Linux Tutorial and something else.....

7 February 20177 September 2023

Configure DomainKeys (OpenDKIM) with Postfix on CentOS 7

Configure DomainKeys (OpenDKIM) with Postfix on CentOS 7

Very useful guide

by Pradeep Kumar· Published December 2, 2015 · Updated December 2, 2015

In this post we will demonstrate how to install & configure DomainKeys with postfix (MTA) on CentOS 7 , i am assuming Postfix is already installed with following domain and hostname.

Hostname = mail5.freshdaymall.com

Domain = freshdaymall.com

Step:1 Set EPEL Repository using below rpm command

OpenDKIM package is not available in the default yum repositories but available in CentOS 7 EPEL repositories.

[root@mail5 ~]# rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

Step:2 Install OpenDKIM Package using yum

[root@mail5 ~]# yum install -y opendkim

Step:3 Run below Command to create keys

Execute the below command to create public & private keys under folder “/etc/opendkim/keys”

[root@mail5 ~]# opendkim-default-keygen
Generating default DKIM keys:
Default DKIM keys for freshdaymall.com created in /etc/opendkim/keys.
[root@mail5 ~]#
[root@mail5 ~]# cd /etc/opendkim/keys/
[root@mail5 keys]# ll
total 8
-rw-r----- 1 root opendkim 891 Nov 29 08:42 default.private
-rw-r--r-- 1 root opendkim 320 Nov 29 08:42 default.txt
[root@mail5 keys]#

default.private is the private key for the domain and default.txt is public key that we will publish in DNS record (TXT) in the domain. A Selector ( default ) is created while generating keys, a selector can be unique keyword which is associated in keys and included in DKIM signature.

Step:4 Edit the Following Files :

/etc/opendkim.conf —- Config file of opendkim
/etc/opendkim/KeyTable —- As name suggest it defines the path of private key for the domain
/etc/opendkim/SigningTable — This file tells OpenDKIM how to apply the keys.
/etc/opendkim/TrustedHosts — This file defines which hosts are allowed to use keys.

Edit the file “/etc/opendkim.conf” & set the below parameters.

Edit the KeyTable file and replace the example.com with your domain name.

[root@mail5 ~]# cat /etc/opendkim/KeyTable
# OPENDKIM KEY TABLE
# To use this file, uncomment the #KeyTable option in /etc/opendkim.conf,
# then uncomment the following line and replace example.com with your domain
# name, then restart OpenDKIM. Additional keys may be added on separate lines.

#default._domainkey.example.com example.com:default:/etc/opendkim/keys/default.private
default._domainkey.freshdaymall.com freshdaymall.com:default:/etc/opendkim/keys/default.private
[root@mail5 ~]#

Edit the SigningTable file and define who will sign the outgoing mails.

[root@mail5 ~]# cat /etc/opendkim/SigningTable 
# WILDCARD EXAMPLE
# Enables signing for any address on the listed domain(s), but will work only if
# "refile:/etc/opendkim/SigningTable" is included in /etc/opendkim.conf.
# Create additional lines for additional domains.

*@freshdaymall.com default._domainkey.freshdaymall.com

As i am using * in above parameter which means all the users on domain are allowed to sign the emails.

Edit the TrustedHosts file , add Server’s FQDN and domain name below localhost ip (127.0.0.1)

[root@mail5 ~]# cat /etc/opendkim/TrustedHosts 
# OPENDKIM TRUSTED HOSTS
# To use this file, uncomment the #ExternalIgnoreList and/or the #InternalHosts
# option in /etc/opendkim.conf then restart OpenDKIM. Additional hosts
# may be added on separate lines (IP addresses, hostnames, or CIDR ranges).
# The localhost IP (127.0.0.1) should always be the first entry in this file.

127.0.0.1
mail5.freshdaymall.com
freshdaymall.com
[root@mail5 ~]#

Step:5 Edit Postfix Config File (/etc/postfix/main.cf)

Add the below lines at end of /etc/postfix/main.cf file.

[root@mail5 ~]# vi /etc/postfix/main.cf
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters
milter_default_action = accept

Step:6 Start OpenDKIM & postfix Service

[root@mail5 ~]# hash -r
[root@mail5 ~]# systemctl start opendkim ; systemctl enable opendkim ; systemctl restart postfix
ln -s '/usr/lib/systemd/system/opendkim.service' '/etc/systemd/system/multi-user.target.wants/opendkim.service'
[root@mail5 ~]#

Step:7 Update the TXT DNS record of your domain.

Use the output of default.txt and update the DNS Record (TXT) of the Domain.

Step:8 Send a Test email and view the logs.

Check whether email is signed or not.

Wow , Our email is signed and domainKeys configuration task is completed now.

B) cd /etc/opendkim/keys

G) set file for permit the signature : vim /etc/opendkim/SigningTable and add the row

Verification Test :

1) opendkim-testkey -k mail.andreadevicenzi.private -d andreadevicenzi.it

This verification consist to check the DNS TXT record (dig TXT mail._domainkey.andreadevicenzi.it) and extract the public key present in the file on the server mail.andreadevicenzi.txt generated with the command opendkim-genkey and decrypt with the private key mail.andreadevicenzi.private.

2) *@andreadevicenzi.it mail._domainkey.andreadevicenzi.it

this row says for each mail sending insert the key to verify

3) to verify the email send a test to : check-auth@verifier.port25.com

generate a file like this: vim public.txt

—–BEGIN PUBLIC KEY—–

public key created in the txt file

—–END PUBLIC KEY—–

openssl pkey -in public.txt -pubin -text -noout

29 January 20178 March 2017

Failban Error – Centos 7

Hi,

from logwatch I saw this error :

ERROR Failed to execute ban jail ‘ssh-iptables’ action ‘iptables’ info ‘CallingMap({‘ipjailmatches’: <function <lambda> at 0x7f8e24d2b578>, ‘matches’: u’Jan 28 00:15:51 saic sshd[30705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ti0100a400-1587.bb.online.no user=root\n

Failed password for root from 85.165.177.58 port 45430 ssh2\n

Failed password for root from 85.165.177.58 port 45430 ssh2′, ‘ip’: ‘85.165.177.58’, ‘ipmatches’: <function <lambda> at 0x7f8e24d2b488>, ‘ipfailures’: <function <lambda> at 0x7f8e24d2bb90>, ‘time’: 1485558957.444361, ‘failures’: 3, ‘ipjailfailures’: <function <lambda> at 0x7f8e24d2b5f0>})’: Error starting action

To solve I follow this : https://github.com/fail2ban/fail2ban/issues/973

and than this : https://github.com/fail2ban/fail2ban/issues/878#issuecomment-65732113

Not necessarily… But if you will really stand-alone fail2ban, so download direct from github or checkout via git (from github). – master – https://github.com/fail2ban/fail2ban/archive/master.zip – debian – https://github.com/fail2ban/fail2ban/archive/debian.zip – repo – git://github.com/fail2ban/fail2ban.git
Hereafter unzip it and run install:

cd /tmp/f2b
?sudo? python setup.py install

So I reinstalled fail2ban, previous backup fine (/etc/fail2ban).

After installation I overwrote /etc/fail2ban with my previous file.

26 January 201726 January 2017

Logwatch Centos 7

useful link to install logwatch:
https://www.digitalocean.com/community/tutorials/how-to-install-and-use-logwatch-log-analyzer-and-reporter-on-a-vps

example
logwatch –detail Low –mailto info@saic.it –service http –range today

25 January 201725 January 2017

Amavis – Clamd – Centos 7

I’ve ths error in /var/log/maillog:
(!)connect to /var/run/clamd.amavisd/clamd.sock failed

I solved in this way:

Edit /etc/clamd/clamd.conf

LocalSocket /var/run/clamd.amavisd/clamd.sock
User amavis

the User I defined (amavis), have to be the owner of the folder /var/run/clamd.amavisd
in the file /etc/amavisd/amavisd.conf you need the same file before : /var/run/clamd.amavisd/clamd.sock in this position
# ### http://www.clamav.net/
[‘ClamAV-clamd’,
\&ask_daemon, [“CONTSCAN {}\n”, “/var/run/clamd.amavisd/clamd.sock“],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],

24 January 201721 July 2017

Configuration for helo hostname and accept mail without postgray check

1.
add the following to the /etc/postfix/main.cf configuration file

smtpd_delay_reject = yes
smtpd_helo_required = yes smtpd_helo_restrictions =
permit_mynetworks,
check_helo_access
hash:/etc/postfix/helo_access,
reject_non_fqdn_hostname,
reject_invalid_hostname,
permit

2.
create the file /etc/postfix/helo_access
and add your restriction like example:

myowndomain.com REJECT
pcname PERMIT

3.
create the database (you don’t need restart postfix)
postmap /etc/postfix/helo_access

4.
postfix check
restart or reload postfix
/etc/init.d/postfix reload

or
/etc/init.d/postfix restart

print out configuration
postconf -n

mailq to see the mail in queue

To remove all mail from the queue, enter:
postsuper -d ALL

Accept mail without any postgray check:

vim /etc/postfix/rbl_override

gmail.com OK

gmail.it OK

yahoo.com OK

hotmail.com OK

outlook.com OK

startcomca.com OK

libero.it OK

and my main.cf

smtpd_recipient_restrictions =
reject_unauth_pipelining,
check_helo_access hash:/etc/postfix/helo_access,
check_client_access hash:/etc/postfix/rbl_override,
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
permit_mynetworks,
reject_invalid_hostname,
reject_non_fqdn_hostname,
reject_non_fqdn_sender,
reject_unknown_sender_domain,
reject_sender_login_mismatch,
reject_non_fqdn_helo_hostname,
permit_sasl_authenticated,
check_policy_service unix:/var/spool/postfix/postgrey/socket,
reject_unauth_destination,
reject_unverified_recipient,
check_recipient_access pcre:/etc/postfix/recipient_checks.pcre,
#check_client_access pcre:/etc/postfix/client_checks.pcre,
reject_rbl_client cbl.abuseat.org,
reject_rbl_client sbl.spamhaus.org,
reject_rbl_client pbl.spamhaus.org,
reject_rbl_client zen.spamhaus.org,
reject_rbl_client bl.spamcop.net,
reject_rbl_client b.barracudacentral.org,
#####reject_rbl_client dnsbl-1.uceprotect.net,
#reject_rbl_client dnsbl.sorbs.net,
#reject_rbl_client dnsrbl.org,
#reject_rbl_client bl.blocklist.de,
#reject_rbl_client babl.rbl.webiron.net,
#reject_rbl_client cabl.rbl.webiron.net,
permit

after this configuration type:

postmap /etc/postfix/rbl_override

restart postfix

Linux Tutorial and something else…..

Posts

Configure DomainKeys (OpenDKIM) with Postfix on CentOS 7

Step:1 Set EPEL Repository using below rpm command

Step:2 Install OpenDKIM Package using yum

Step:3 Run below Command to create keys

Step:4 Edit the Following Files :

Step:5 Edit Postfix Config File (/etc/postfix/main.cf)

Step:6 Start OpenDKIM & postfix Service

Step:7 Update the TXT DNS record of your domain.

Step:8 Send a Test email and view the logs.

Failban Error – Centos 7

Logwatch Centos 7

Amavis – Clamd – Centos 7

Configuration for helo hostname and accept mail without postgray check

Accept mail without any postgray check: