2007 - EnGarde Secure Linux - inštalácia poštovej brány

|=------------------------=[ ENGARDE SECURE LINUX ]=-----------------------=|
+---------------------------------------------------------------------------+
|                                                                           |
|                          Instalacia Postovej brany                        |
|                                                                           |
+---------------------------------------------------------------------------+
|=-------------------------------=[ BH 2007 ]=-----------------------------=|

Po nainstalovani zakladneho systemu s volbami:
- mail services
- firewall
- intrusion detection
nainstalujeme ostatne potrebne balicky. Samozrejme predtym korektne nastavime GDSN.

[root@fw bh]# newrole -r sysadm_r
[root@fw bh]# apt-get update
[root@fw bh]# apt-get install engarde-policy-sources
[root@fw bh]# apt-get install amavisd-new
[root@fw bh]# apt-get install perl-BerkeleyDB
[root@fw bh]# apt-get install perl-Digest-SHA1
[root@fw bh]# apt-get install perl-Net-DNS
[root@fw bh]# apt-get install clamav
[root@fw bh]# apt-get install spamassassin
[root@fw bh]# apt-get install mc

[root@fw bh]# chown root:vscan /usr/bin/freshclam
[root@fw bh]# chmod 510 /usr/bin/freshclam
[root@fw bh]# /etc/init.d/clamd start
[root@fw bh]# su - vscan
[vscan@fw ~]$ freshclam

Spamassassin je defaultne celkom dobre nastaveny, ale v pripade potreby editujeme:
/etc/mail/spamassassin/local.cf

/etc/amavisd.conf
-----------------
$myhostname = 'fw.domena.sk';
$mydomain = 'domena.sk';

start
-----
[root@fw bh]# /etc/init.d/amavisd start

master.cf
---------

echo "smtp-amavis unix - - n - 2 smtp -o smtp_data_done_timeout=1200 -o mtp_send_xforward_command=yes -o disable_dns_lookups=yes -o max_use=20" >> /etc/postfix/master.cf

echo "127.0.0.1:10025 inet n - y - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_delay_reject=no -o smtpd_client_restrictions=permit_mynetworks,reject -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks_style=host -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes -o smtpd_error_sleep_time=0 -o smtpd_soft_error_limit=1001 -o smtpd_hard_error_limit=1000 -o smtpd_client_connection_count_limit=0 -o smtpd_client_connection_rate_limit=0 -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks" >> /etc/postfix/master.cf

main.cf
-------

echo "content_filter = smtp-amavis:localhost:10024" >> /etc/postfix/main.cf

echo "receive_override_options = no_address_mappings" >> /etc/postfix/main.cf

start
-----
[root@fw bh]# /etc/init.d/postfix start

/etc/selinux/engarde/src/policy/policy/modules/services/postfix.te
------------------------------------------------------------------
# Hajzer
#
# postfix + amavisd + clamav
#
allow postfix_client_t sysadm_t:fifo_file { read write };
allow postfix_t port_t:tcp_socket name_connect;
allow initrc_t var_t:file { read write };
allow initrc_t var_t:dir write;
allow initrc_t user_home_t:dir write;
allow initrc_t user_home_t:file write;
allow initrc_t port_t:tcp_socket name_connect;
allow initrc_t port_t:udp_socket name_bind;
allow initrc_t var_run_t:sock_file write;
allow initrc_t var_t:dir { add_name create read remove_name };
allow initrc_t var_t:file { create ioctl unlink };
allow initrc_t user_home_t:file append;

#
# syslog-ng
#
allow syslogd_t self:capability sys_admin;

#
# psad
#
allow initrc_t sysadm_t:fifo_filo write;
allow initrc_t usr_t:fle execute;
allow initrc_t var_log_t:dir create;
allow run_init_t initrc_t:process transition;