Mailserver Postfix, Dovecot, MySQL etc

apt-get install openssl ssh rsync fail2ban mysql-server dovecot-common dovecot-imapd dovecot-pop3d postfix postfix-mysql logwatch mc

apt-get install linux-image-2.6.32-5-bigmem

mailer = "/usr/sbin/sendmail -t"  
TmpDir = /tmp
MailFrom = root
Detail = High
Service = All

crontab -e

00 20 * * * /usr/sbin/logwatch –mail-to 

#################################
#
# Unterstütze Protokolle
#
#################################
protocols = imaps pop3s managesieve

#################################
#
# Sicherheit
#
#################################
disable_plaintext_auth = no
auth_mechanisms = plain
log_timestamp = "%Y-%m-%d %H:%M:%S "  
ssl_cert_file = /etc/postfix/sslcert/cert.crt
ssl_key_file = /etc/postfix/sslcert/key.key

############################################
#
# Konfiguration der Protokolle
#
############################################
protocol pop3 {
  pop3_uidl_format = %08Xu%08Xv
}

protocol imap {
mail_plugins = quota imap_quota
}

protocol lda {
  postmaster_address = example@example.com
  auth_socket_path = /var/run/dovecot/auth-master
  mail_plugins = sieve
}

#############################################
#
# Passwort abfragen
#
############################################
auth default {
  mechanisms = plain login

passdb sql {
    args = /etc/dovecot/dovecot-mysql.conf
  }
  userdb sql {
    # Path for SQL configuration file, see /etc/dovecot/dovecot-sql.conf for example
    args = /etc/dovecot/dovecot-mysql.conf
  }
  user = root
###############################################
#
# Passwort Datenbanken/BACKEND
#
###############################################
  socket listen {
    master {
      path = /var/run/dovecot/auth-master
      mode = 0600
      user = vmail
    }
    client {
      path = /var/spool/postfix/private/auth_dovecot
      mode = 0660
      user = postfix
      group = postfix
    }
  }
}

##################################################
#
# PLGUINS
#
##################################################
plugin {
sieve_dir = /home/mail/%d/%n/sieve
sieve = /home/mail/%d/%n/dovecot.sieve
quota = maildir:User quota
quota_rule = *:storage=10M
quota_warning = storage=95%% /usr/local/sbin/quota-warning.sh 95
quota_warning2 = storage=80%% /usr/local/sbin/quota-warning.sh 80
}

#EOF

driver = mysql
connect = host=localhost dbname=postfix user=postfix password=mysqlpw
default_pass_scheme = PLAIN-MD5
password_query = SELECT password FROM mailbox WHERE username = '%u'  
user_query = SELECT CONCAT('maildir:/home/mail/',maildir) AS mail, 5000 AS uid, 5000 AS gid, concat('*:bytes=', mailbox.quota) AS quota_rule FROM mailbox WHERE username = '%u'   

##########################################
#
# Allgmein
#
##########################################
myhostname = example.example.com
myorigin = /etc/mailname
mydestination = 	example.example.com 
			localhost
mynetworks = 		127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
smtpd_banner = $myhostname
delay_warning_time = 4h
biff = no
append_dot_mydomain = no
readme_directory = no

##########################################
#
#SSL/TLS parameters
#
##########################################
smtpd_tls_cert_file = /etc/postfix/sslcert/cert.crt
smtpd_tls_key_file = /etc/postfix/sslcert/key.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

#########################################
#
# Anmeldung
#
#########################################
smtpd_sasl_type=dovecot
smtpd_sasl_path=private/auth_dovecot
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
broken_sasl_auth_clients = yes

#########################################
#
# Sicherheit
#
########################################
disable_vrfy_command = yes
smtpd_helo_required = yes
strict_rfc821_envelopes = yes

#################################################
#
# ANTI SPAM
# REIHENFOLGE BEACHTEN
#
#################################################
smtpd_client_restrictions = 	permit_sasl_authenticated
				permit_mynetworks
				reject_unknown_client

smtpd_helo_restricitons =	permit_sasl_authenticated
				permit_mynetworks
				reject_invalid_hostname
				reject_non_fqdn_hostname

smtpd_sender_restrictions =	permit_sasl_authenticated
				permit_mynetworks
				reject_unknown_sender_domain
				reject_non_fqdn_sender				

smtpd_recipient_restrictions =	permit_sasl_authenticated
				reject_unknown_recipient_domain
				reject_non_fqdn_recipient
				reject_unauth_pipelining
				reject_unauth_destination,
        			reject_unlisted_recipient,
        			reject_invalid_hostname,
        			reject_non_fqdn_sender,
        			reject_unknown_sender_domain,
        			reject_unverified_recipient,
        			reject_rbl_client sbl.spamhaus.org,
        			reject_rbl_client dialup.blacklist.jippg.org,
        			reject_rbl_client cbl.abuseat.org,
        			reject_rbl_client zen.spamhaus.org,
        			reject_rbl_client dnsbl.sorbs.net
				permit_auth_destination
				check_policy_service inet:127.0.0.1:12525			
				reject				

################################################
#
# MySQL und MAIL Dir
#
#################################################
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql_sender_login_maps.cf
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql_virtual_alias_maps.cf
virtual_mailbox_base = /home/mail/
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_limit = 112400000
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf
virtual_minimum_uid = 104
virtual_transport = virtual
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps


#EOF

smtp      inet  n       -       n       -       -       smtpd -o content_filter=spamassassin

hosts = localhost
user = postfix
password = mysqlpw
dbname = postfix
query = SELECT username AS allowedUser FROM mailbox WHERE username="%s" AND active = 1 UNION SELECT goto FROM alias WHERE address="%s" AND active = 1  

hosts = localhost
user = postfix
password = mysqlpw
dbname = postfix
query = SELECT goto FROM alias WHERE address='%s' AND active = '1'  

hosts = localhost
user = postfix
password = mysqlpw
dbname = postfix
query = SELECT domain FROM domain WHERE domain='%s' AND active = '1'  

hosts = localhost
user = postfix
password = mysqlpw
dbname = postfix
query = SELECT maildir FROM mailbox WHERE username='%s' AND active = '1'  

#
#Allgemeine Konfiguration
#
rewrite_header Subject *****SPAM*****
required_hits 4.8
rewrite_subject 1
subject_tag [SPAM?]
auto_whitelist_factor 0.03
report_safe 1
use_terse_report 1 

#
#bayes konfiguration
#
use_bayes 1
bayes_path /etc/spamassassin/bayes
bayes_use_chi2_combining 1
bayes_auto_expire 0
bayes_journal_max_size 15000000
bayes_expiry_max_db_size 20000000
bayes_auto_learn 0
bayes_ignore_header Return-Path
bayes_ignore_header Received
bayes_ignore_header X-Spam-Flag
bayes_ignore_header X-Spam-Status
bayes_ignore_header X-Spam-Flag
bayes_ignore_header X-Spam-Level
bayes_ignore_header X-purgate
bayes_ignore_header X-purgate-ID
bayes_ignore_header X-purgate-Ad
bayes_ignore_header X-GMX-Antispam
bayes_ignore_header X-Resent-For
bayes_ignore_header X-Resent-By
bayes_ignore_header X-Resent-To
bayes_ignore_header Resent-To
bayes_ignore_header Sender
bayes_ignore_header Precedence
bayes_ignore_header X-Antispam
bayes_ignore_header X-Sieve
bayes_ignore_header X-Spamcount
bayes_ignore_header X-Spamsensitivity
bayes_ignore_header To
bayes_ignore_header X-Sieve
bayes_ignore_header X-WEBDE-FORWARD 

#dcc konfiguration
dcc_path /usr/local/bin/dccproc
dcc_add_header 1

#pyzor konfiguration
pyzor_path /usr/local/bin/pyzor
pyzor_add_header 1
pyzor_max 3

# Andere Module benutzen
skip_rbl_checks 0
use_razor2 1
use_dcc 1
use_pyzor 1
rbl_timeout 4
ok_languages all
ok_locales all
dns_available yes
check_mx_attempts 0
check_mx_delay 1
auto_learn 1
auto_learn_threshold_spam 5.9
auto_learn_threshold_nonspam 2.0
trusted_networks #mein netzwerk 

# Reports
clear_report_template
report Diese Mail wurde von der Installation des SpamAssassin Spam-Filters als
report Spam erkannt. Sollte diese Nachricht zu Unrecht als Spam markiert worden sein,
report dann bitte diese Mail an example@example.com weiterleiten (wenn moeglich
report als Anlage!). Vielen Dank!
report Die Originalnachricht ist dieser E-Mail als Anhang beigefuegt.
report
report Content analysis details: (_HITS_ points, _REQD_ required)
report
report
report " Pkt Regel Name Beschreibung"  
report ---- ---------------------- --------------------------------------------------
report _SUMMARY_

clear_unsafe_report_template
unsafe_report Diese Nachricht ist nicht komplett in plain text gewesen, so dass es
unsafe_report evtl. gefaehrlich ist, sie zu oeffnen, da die Mail moeglicherweise
unsafe_report einen Virus enthalten koe¶nnte. Wer sie dennoch anschauen moechte, sollte
unsafe_report dafuer besser einen Editor verwenden! 

#spamcop punkte
uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2')  
describe SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org  
tflags SPAMCOP_URI_RBL net
score SPAMCOP_URI_RBL 5.0 

#bayes punkte
score BAYES_00 -6.1
score BAYES_01 -5.0
score BAYES_10 -3.5
score BAYES_20 -2.0
score BAYES_30 -1.0
score BAYES_40 -0.3
score BAYES_44 -0.01
score BAYES_50 0.01
score BAYES_56 0.3
score BAYES_60 1.0
score BAYES_70 1.6
score BAYES_80 3.1
score BAYES_90 5.2
score BAYES_99 7.2

#razor punkte
score RAZOR2_CHECK 1.8
score RAZOR2_CF_RANGE_11_50 0.32
score RAZOR2_CF_RANGE_51_100 2.7

#dcc punkte
score DCC_CHECK 4.9

#pyzor punkte
score PYZOR_CHECK 4.8

score SUBJ_ILLEGAL_CHARS 2.6
score PORN_4 3.7
score RCVD_IN_RFCI 2.0
score RCVD_IN_ORBS 1.0
score RCVD_IN_DSBL 1.0
score RCVD_IN_SBL 0.5
score RCVD_IN_VISI 1.0
score RCVD_IN_RFCI 0.5
score RCVD_IN_SORBS 0.5
score X_NJABL_OPEN_PROXY 0.5
score RCVD_IN_UNCONFIRMED_DSBL 0.2
score RCVD_IN_BL_SPAMCOP_NET 1.1
score RCVD_IN_VISI 0.3
score RCVD_IN_RELAYS_ORDB_ORG 0.3
score USER_AGENT_MACOE 1.0
score NIGERIAN_TRANSACTION_1 1.5
score MICROSOFT_EXECUTABLE 3.100
score MIME_SUSPECT_NAME 3.100
score RCVD_IN_BONDEDSENDER -6.0
score HABEAS_HIL_RBL -6.0
score X_LIST_UNSUBSCRIBE 0.5
score EMAIL_ATTRIBUTION -0.5
score IN_REP_TO -0.5
score QUOTED_EMAIL_TEXT -0.5
score REPLY_WITH_QUOTES -0.5
score HTML_IMAGE_ONLY_02 1.978
score HTML_IMAGE_ONLY_04 2.087
score HTML_IMAGE_ONLY_06 1.228
score HTML_IMAGE_ONLY_08 0.984
score HTML_IMAGE_ONLY_10 0.843
score HTML_IMAGE_ONLY_12 0.487
score EMAIL_ATTRIBUTION -1
score MSGID_GOOD_EXCHANGE -1 

ifplugin Mail::SpamAssassin::Plugin::Shortcircuit
endif # Mail::SpamAssassin::Plugin::Shortcircuit

#EOF

openssl req -new -nodes -keyout key.key -out csr.csr -newkey rsa:4096

#!/usr/bin/perl
######
 #
 # MySQL to Fetchmail, Frontend: Roundcube Plugin (RC0.4 and above)
 # Developped by Arthur Mayer, a.mayer@citex.net
 # Released under GPL license (http://www.gnu.org/licenses/gpl.txt)
 #
######

use DBI;

$db_database="webmail";  
$db_username="webmail";  
$db_password="webmail";  

$text='#temp fetchmailrc  
set no syslog
set postmaster "postmaster"  
set no bouncemail
set properties ""  
';  

$dbh = DBI->connect("DBI:mysql:$db_database;host=IP_ADRESSE0", $db_username, $db_password) or die "Database connection error: $DBI::errstr\n";  

$sth = $dbh->prepare("SELECT mailget_id,userhere,remoteserver,remoteuser,remotepass,type,options,active FROM virtual_fetchmail WHERE active='1' ORDER BY remoteserver ASC");  
$sth->execute;
while(my ($mailget_id,$userhere,$remoteserver,$remoteuser,$remotepass,$type,$options,$active) = $sth->fetchrow_array()) {
$text.="\npoll $remoteserver with proto $type\n";  
if ( $options eq '0' ) { $keep='keep'; } else { $keep=''; }  
$text.="\tuser \"$remoteuser\" there with password \"$remotepass\" is \"$userhere\" here $keep\n";  
}

$dbh->disconnect();

#print $text;

open(DA, ">/home/mail/fetchmail/fetchmailrc") or die "Can't Open File. Try chmod 777";  
print DA $text;
close(DA);

$chown=`chown -R vmail:vmail /home/mail/fetchmail/fetchmailrc`;
$chmod=`chmod -R 600 /home/mail/fetchmail/fetchmailrc`;
$ret=`/usr/bin/fetchmail -f /home/mail/fetchmail/fetchmailrc -i /home/mail/fetchmail/fetchmailid --pidfile /home/mail/fetchmail/fetchmail.pid -L /var/log/fetchmail`;

unlink "/var/mail/fetchmail/fetchmailrc";  

#!/bin/bash
### BEGIN INIT INFO
# Provides:          Iptables
# Required-Start:    
# Required-Stop:     
# Default-Start:     2 
# Default-Stop:      0 1 6
# Short-Description: Startet Iptables
# Description:       Startet das Iptables Firewalling System
### END INIT INFO
#Beginn der Definitionen

#Beginn der Definitionen

IPTABLES="/sbin/iptables"	#Pfad zu den Iptables  
DEV="eth0"					#Netzwerkkarte  

####################################
##
##	Server
##
####################################

ADMINIP=IP Adresse der Firewall von DD Administration
NS1=Erster NS
NS2=Zweiter NS
NAGIOS=Netzwerküberwachung
GALACTICA=WEB Server
CONTROL=Postfixadmin Server

###################################
##
##	Ports
##
###################################

SSH="22"			#SSH Port  
DNS="53"			#DNS Port  
NRPE="5666"			#Netzwerküberwachung  
SMTP="25"			#SMTP  
POP="995"			#POP3  
IMAP="993"			#IMAP  
SIEVE="2000"		#Sieve  
MYSQL="3306"		#MySQL  

###################################
##
##	Module
##
###################################

modprobe ip_conntrack_ftp	#Modul für den Status einer FTP verbindung

####################################
##
## Leere die Ketten 
##
####################################

$IPTABLES -F

####################################
##
##	Sperre Jeden Input 
##
####################################

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

####################################
##
## Beginn der Regeln Für die Verwaltung
##
####################################

#Erlaube nur DD und Backup-Nas Zugriff via SSH
$IPTABLES -A INPUT -i $DEV -p tcp --dport $SSH -s $ADMINIP -j ACCEPT

#Erlaube Nagios Zugriff auf den NRPE Client
$IPTABLES -A INPUT -i $DEV -p tcp --dport $NRPE -s $NAGIOS -j ACCEPT

#Erlaube PING von Nagios zur Ãœberwachung und von DD zur Diagnose
$IPTABLES -A INPUT -p icmp --icmp-type ping -s $NAGIOS -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type ping -s $ADMINIP -j ACCEPT

#####################################
##
## Beginn der Allgemeinen Regeln
##
#####################################
##
##		INPUT
##

#Erlaube Bereits aufgebaute Verbindungen
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#Erlaube HTTP von überall
$IPTABLES -A INPUT -i $DEV -p tcp --dport $SMTP -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -i $DEV -p tcp --dport $IMAP -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -i $DEV -p tcp --dport $POP -m state --state NEW -j ACCEPT

#Öffne DNS Abfragen
$IPTABLES -A INPUT -i $DEV -p tcp -s $NS1 --sport $DNS -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -i $DEV -p udp -s $NS1 --sport $DNS -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -i $DEV -p tcp -s $NS2 --sport $DNS -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -i $DEV -p udp -s $NS2 --sport $DNS -m state --state NEW -j ACCEPT

##
##		OUTPUT
##
#Erlaube Antworten auf angenommene Verbindungen
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A OUTPUT -p tcp --dport $SMTP -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport $IMAP -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport $POP -m state --state NEW -j ACCEPT

#Öffne Web Server Control und Localhost
$IPTABLES -A OUTPUT -d 127.0.0.1 -j ACCEPT
$IPTABLES -A INPUT -s 127.0.0.1 -j ACCEPT
$IPTABLES -A INPUT -s 195.130.198.90 -j ACCEPT
$IPTABLES -A INPUT -s 195.130.198.180 -j ACCEPT

#Öffne DNS Abfragen
$IPTABLES -A OUTPUT  -p tcp -d $NS1 --dport $DNS -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT  -p udp -d $NS1 --dport $DNS -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT  -p tcp -d $NS2 --dport $DNS -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT  -p udp -d $NS2 --dport $DNS -m state --state NEW -j ACCEPT

#EOF

ln -s /etc/init.d/iptables.sh /etc/rc2.dS05iptables.sh

#!/bin/bash
### BEGIN INIT INFO
# Provides:          IPTABLES
# Required-Start:    $local_fs $syslog mdadm-raid
# Required-Stop:     $local_fs $syslog mdadm-raid
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: IPTABLES STOP
# Description:       Stoppt das Firewalling System
### END INIT INFO
#Beginn der Definitionen

IPTABLES="/sbin/iptables"  

####################################
##
## Leere die Ketten 
##
####################################

$IPTABLES -F


####################################
##
##	Erlaube Alles
##
####################################
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
#EOF

#!/bin/sh

PERCENT=$1
FROM="example@example.com"  

msg="From: $FROM  
To: $USER
To: support@example.com
Subject: Your email quota is $PERCENT% full
Content-Type: text/plain; charset=UTF-8

Your mailbox is now $PERCENT% full."  

echo -e "$msg" | /usr/sbin/sendmail -f $FROM "$USER"  

exit 0

#!/bin/sh

MAILLOG='/var/log/mail.log'  
MAILSOURCEPATH='/home/mail/'  
TMPFILEDESTPATH='/usr/local/sbin/checkSPAMtmp'  
CHECKSPAMLIST='/usr/local/sbin/checkSPAM.list'  
WORKDATE=`date +%d.%m.%Y`

### Alte Auswertungen löschen

rm $TMPFILEDESTPATH/*

### aktuelles Datum für Suche definieren

TODAY_DAY=`date +%d`
TODAY_MONTH=`date +%b`

        if [ $TODAY_MONTH = "Mrz" ]; then  
                TODAY_MONTH='Mar'  
        elif [ $TODAY_MONTH = "Mai" ]; then  
                TODAY_MONTH='May'  
        elif [ $TODAY_MONTH = "Okt" ]; then  
                TODAY_MONTH='Oct'  
        elif [ $TODAY_MONTH = "Dez" ]; then  
                TODAY_MONTH='Dec'  
        fi

        if [ $TODAY_DAY -le 10 ]; then

                TODAY_DAY=`echo $TODAY_DAY | sed -e 's/^0/.*/'`  
                TODAY="$TODAY_MONTH$TODAY_DAY"  
        else
                TODAY="$TODAY_MONTH $TODAY_DAY"  
        fi

        TODAY='^'$TODAY  

### Vordefinierte Liste abarbeiten und nach Abgelehnten Emails suchen

        for EMAIL in $(cat $CHECKSPAMLIST)
        do
                grep -i "$TODAY.*reject:.*to=<$EMAIL>" $MAILLOG >> $TMPFILEDESTPATH/$EMAIL  
                echo "### $EMAIL "  

                if [ -f $TMPFILEDESTPATH/$EMAIL ]; then

                FILESIZE=`wc -c $TMPFILEDESTPATH/$EMAIL`
                FILESIZE=`echo $FILESIZE | sed -n -e 's/ .*$/''/gp'`  
                echo $FILESIZE

                        if [ $FILESIZE -ge 1 ]; then

                                for SPAMINFO in $(cat $TMPFILEDESTPATH/$EMAIL)
                                do
                                        SENDFROM=`echo $SPAMINFO | sed -n -e 's/^.*from=</''/gp'`  
                                        SENDFROM=`echo $SENDFROM | sed -n -e 's/>.*$/''/gp'`  

                                        if ! [ -z $SENDFROM ]; then
                                                echo "$SENDFROM" >> $TMPFILEDESTPATH/$EMAIL.txt  
                                        fi
                                done

				ATTACHEMENT="$TMPFILEDESTPATH/$EMAIL.txt"  

                                ### Email an Kunden versenden

					mail -s "SPAM Info $WORKDATE" -a $ATTACHEMENT $EMAIL < /usr/local/sbin/checkSPAM.txt  
                        fi
                fi
        done