tuto:linux_divers:dkim_dmarc_onpmg [WikiT]

Cette page est en lecture seule. Vous pouvez afficher le texte source, mais ne pourrez pas le modifier. Contactez votre administrateur si vous pensez qu'il s'agit d'une erreur.
====== Add DKIM and DMARC support to Proxmox Mail Gateway ======

[[https://www.proxmox.com/en/proxmox-mail-gateway|Proxmox Mail Gateway]] is a great email filtering solution, but it lacks DKIM and DMARC support. This how-to explains how to add them. And also how to configure ports 465 and 587 for authenticated clients.

===== Enable authenticated ports =====
This is needed if you want your external clients to be able to relay emails through PMG. Ports 465 and 587 will be equivalent to the 26 one, but with encryption (either STARTTLS or SSL in Wrapper mode). I'll use AD to auth my user, but it could be another LDAP server

  * Install SASL daemon
<code bash>
apt install sasl2-bin libsasl2-modules-ldap
</code>
  * Add postfix to the sasl group
<code bash>
usermod -a -G sasl postfix
</code>
  * Configure the SASL daemon
<code bash>
cat <<_EOF > /etc/default/saslauthd
START=yes
DESC="SASL Authentication Daemon"
NAME="saslauthd"
MECHANISMS="ldap"
MECH_OPTIONS=""
OPTIONS="-c -m /var/run/saslauthd"
_EOF
cat <<_EOF > /etc/postfix/sasl/smtpd.conf
pwcheck_method: saslauthd
mech_list: plain login
_EOF
cat << _EOF > /etc/saslauthd.conf
ldap_servers: ldap://dc1.domain.tld ldap://dc2.domain.tld
ldap_start_tls: yes
ldap_tls_check_peer: yes
ldap_tls_cacert_file: /etc/ssl/certs/ca-certificates.crt
ldap_search_base: DC=domain,DC=tld
ldap_filter: (&(|(memberOf=CN=Mail,OU=Groups,DC=domain,DC=tld)(sAMAccountName=smtp))(objectClass=user)(|(userPrincipalName=%u@domain.tld)(sAMAccountName=%u)))
ldap_bind_dn: CN=Proxmox Mail Gateway,OU=Apps,DC=doman,DC=tld
ldap_password: SuperSecretPassw0rd
_EOF
</code>

<note tip>You need to adjust the addresses of your servers, the search base, the filter, the bind dn and its password of course</note>

  * Now start the sasl auth daemon

<code bash>
systemctl enable saslauthd
systemctl restart saslauthd
</code>

<note tip>Note that auth is not enabled yet, postfix must be configured for this, we'll do it later, when enabling dkim and dmarc</note>

===== Configure DKIM =====
We'll use the opendkim project for this. And we'll use two separated instances
  * One responsible for signing outgoing email
  * The other responsible for DKIM signature verification for inbound emails

  * Install packages
<code bash>
apt install opendkim opendkim-tools
</code>

  * Configuration for the //verifier// instance

<code bash>
mkdir /etc/opendkim
cat <<_EOF > /etc/opendkim/verifier.conf
Syslog yes
LogResults yes
LogWhy yes
SyslogSuccess yes
UMask 007
Mode v
AllowSHA1Only yes
AlwaysAddARHeader yes
Socket local:/var/run/opendkim/verifier.sock
PidFile /var/run/opendkim/verifier.pid
TrustAnchorFile /usr/share/dns/root.key
UserID opendkim
Background no
Nameservers 10.99.2.1
_EOF
</code>

<note tip>Replace 10.99.2.1 with the DNS server you want to use, or remove the line to let opendkim resolv itself. You should use a local, recursive, caching resolver</note>

  * Configuration of the //signer// instance
<code bash>
cat <<_EOF > /etc/opendkim/signer.conf
Syslog yes
LogResults yes
LogWhy yes
SyslogSuccess yes
UMask 007
KeyTable /etc/opendkim/keytable
SigningTable /etc/opendkim/signingtable
Mode s
InternalHosts 0.0.0.0/0
Socket local:/var/run/opendkim/signer.sock
PidFile /var/run/opendkim/signer.pid
TrustAnchorFile /usr/share/dns/root.key
UserID opendkim
Background no
Nameservers 10.99.2.1
_EOF
cat <<_EOF > /etc/opendkim/signingtable
# Add one line per domain you want to sign when email are being sent.
# You can use different keys if needed
# Or just use a wildcard to sign everything with the same key
* default
_EOF
cat <<_EOF > /etc/opendkim/keytable
default %:default:/etc/opendkim/keys/default/default.private
_EOF
</code>
  * Create the keys
<code bash>
mkdir -p /etc/opendkim/keys/default
chown opendkim /etc/opendkim/{keys,keys/default}
chmod 700 /etc/opendkim/{keys,keys/default}
opendkim-genkey -D /etc/opendkim/keys/default/ -s default }}
</code>

<note tip>Replace 10.99.2.1 with the DNS server you want to use, or remove the line to let opendkim resolv itself. You should use a local, recursive, caching resolver</note>
<note tip>In this example, every outbound emails will be signed, and the same key will be used for all of them. You can configure different key though.</note>

  * Create systemd unit for both opendkim instances
<code bash>
cat <<_EOF > /etc/systemd/system/opendkim-signer.service
[Unit]
Description=OpenDKIM DomainKeys Identified Mail (DKIM) Milter - signer
Documentation=man:opendkim(8) man:opendkim.conf(5) man:opendkim-genkey(8) man:opendkim-genzone(8) man:opendkim-testadsp(8) man:opendkim-testkey http://www.opendkim.org/docs.html
After=network.target nss-lookup.target

[Service]
Type=simple
UMask=0007
ExecStart=/usr/sbin/opendkim -x /etc/opendkim/signer.conf
User=opendkim
Group=opendkim
MemoryLimit=50M
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=full
ProtectHome=yes
NoNewPrivileges=yes
Restart=on-failure
ExecReload=/bin/kill -USR1 $MAINPID

[Install]
WantedBy=multi-user.target
_EOF
cat <<_EOF > /etc/systemd/system/opendkim-verifier.service
[Unit]
Description=OpenDKIM DomainKeys Identified Mail (DKIM) Milter - verifier
Documentation=man:opendkim(8) man:opendkim.conf(5) man:opendkim-genkey(8) man:opendkim-genzone(8) man:opendkim-testadsp(8) man:opendkim-testkey http://www.opendkim.org/docs.html
After=network.target nss-lookup.target

[Service]
Type=simple
UMask=0007
ExecStart=/usr/sbin/opendkim -x /etc/opendkim/verifier.conf
User=opendkim
Group=opendkim
MemoryLimit=50M
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=full
ProtectHome=yes
NoNewPrivileges=yes
Restart=on-failure
ExecReload=/bin/kill -USR1 $MAINPID

[Install]
WantedBy=multi-user.target
_EOF
systemctl daemon-reload
</code>

  * Start and enable the daemons

<code bash>
systemctl stop opendkim
systemctl disable opendkim
systemctl enable opendkim-signer
systemctl start opendkim-signer
systemctl enable opendkim-verifier
systemctl start opendkim-verifier
</code>

===== Configure DMARC =====
DMARC is a policy framework sitting on top of SPF and DKIM. This time, we only need one instance to filter incoming emails

  * Install opendmarc
<code bash>
apt install opendmarc
</code>
  * Configure dmarc
<code bash>
cat <<_EOF > /etc/opendmarc.conf
Background false
IgnoreAuthenticatedClients true
IgnoreHosts /etc/pmg/mynetworks
PidFile /var/run/opendmarc/opendmarc.pid
PublicSuffixList /usr/share/publicsuffix/
Syslog true
RejectFailures true
UMask 007
Socket local:/var/run/opendmarc/opendmarc.sock
HistoryFile /var/run/opendmarc/history.dat
_EOF
</code>
  * Start and enable the service

<code bash>
systemctl enable opendmarc
systemctl start opendmarc
</code>

<note tip>Storing and sending DMARC report can be done, but you need a mysql server. I'll leave it out of scope for this how-to, though, reporting is an important piece of DMARC</note>

===== Configure postfix to use all this =====
Now, we just have to copy master.cf template and adjust it to make use of the new features

<code bash>
mkdir /etc/pmg/templates
cp -a /var/lib/pmg/templates/master.cf.in /etc/pmg/templates/
</code>

Edit **/etc/pmg/templates/master.cf.in** and apply this patch
<code diff>
   -o smtpd_helo_restrictions=
   -o smtpd_client_restrictions=
   -o smtpd_sender_restrictions=
+  -o smtpd_milters=unix:/var/run/opendkim/signer.sock
 
 [% pmg.mail.ext_port %]       inet  n -       -       -       1 postscreen
 
@@ -91,6 +23,25 @@
   -o receive_override_options=no_address_mappings
   -o smtpd_discard_ehlo_keywords=silent-discard,dsn
   -o mynetworks=127.0.0.0/8,[% postfix.int_ip %]
+  -o smtpd_milters=unix:/var/run/opendkim/verifier.sock,unix:/var/run/opendmarc/opendmarc.sock
+
+submission       inet  n -       -       -       100      smtpd
+  -o content_filter=scan:127.0.0.1:10023
+  -o smtpd_enforce_tls=yes
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o smtpd_recipient_restrictions=reject_unknown_recipient_domain
+  -o smtpd_sender_restrictions=
+  -o smtpd_helo_restrictions=
+  -o smtpd_milters=unix:/var/run/opendkim/signer.sock
+
+smtps        inet  n -       -       -       100      smtpd
+  -o content_filter=scan:127.0.0.1:10023
+  -o smtpd_tls_wrappermode=yes
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o smtpd_recipient_restrictions=reject_unknown_recipient_domain
+  -o smtpd_sender_restrictions=
+  -o smtpd_helo_restrictions=
+  -o smtpd_milters=unix:/var/run/opendkim/signer.sock
 
 127.0.0.1:10025 inet  n       -       n       -       -      smtpd
   -o content_filter=
</code>

<note tip>You can see we just add smtpd_milters for inbound and outbound. And we add two new listeners on 465 (smtps) and 587 (submission), with settings equivalent to the listener on port 26</note>