Re: Installing a mailgate on orange, IPCop v2.1.9

Hi there,

On Mon, 25 Apr 2016, Chris Bell wrote:

> I want to install a filtering smtp(s) mailgate on orange with
> smtp(s) output to a mailserver on green. The mailgate will be
> required to run DNS, blacklist, and virus checks, with exim,
> spamassassin, and clamav, refuse/deny junk before it is accepted,
> and must also receive security and operating system updates.  This
> will require DNS and access to specified blacklists as well as
> system mirrors. Is this possible, or should it connect via blue
> instead?

You are making things much more difficult for yourself than necessary.
There's no need for a 'mailgate', and it will just give you grief.

If you are using Debian for the mail I would recommend that you simply
connect it directly to the Internet.  Choose something with more than
one network port for your Debian box, harden it (Rusty's very old now
but still effective firewall rules are a good place to start), then
ALMOST all you have to do is allow connections to port 25 from some of
the Internet on the public interface.  You can install BIND on the box,
it can be quite self contained.  I assume you have a static IP for the
mail server's Internet-facing port?  If not, then you're going to have
trouble with an increasing number of senders who refuse to talk to you.

I've been running mailservers and nameservers (and IPCop boxes) for a
good many years.  Some of the mail- and name servers are behind IPCop
firewalls, a couple are behind Smoothwall, some are not.  To me there
is as far as administration is concerned really no difference between
any of them.  They're all Linux boxes of course, I ditched any Windows
machines that were handling mail whenever I got my hands on them.

On Tue, 26 Apr 2016, Chris Bell wrote:

> ... By default, Orange does not have DNS, and outgoing requests are
> generally blocked to prevent spamming, but the mailgate will need
> DNS and access to other sites. The full exim system on Debian stable
> can provide the mailgate software, although it warns that it relies
> on the package security updates. IPCop Blue is little used here, so
> could provide the required facilities, and I could block smtp(s)
> from the mailgate to Red, but has anyone succeded in using Orange?
> I am sure that it would be possible to use Shorewall to correctly
> configure a suitable firewall, and handle IPv6, but it would be a
> steep learning curve for me, with mistakes possible.

You will likely make more mistakes if you make things more complex.
If this is your first mail server, you will in any case make a lot.
Don't ask me how I know that. :)

> But it would require a DNS server to check the source IP address of
> each email, not provided to reduce the chance of a compromised box
> sending SPAM, although it would not itself prevent relay. I reported
> a very well concealed spoof of an Amazon.UK delivery note yesterday,
> the only indication that it came from Jakarta was the real IP
> address of the sender. I would prefer to block SMTP(S) from orange
> to red.  Are the IP addresses of standard blacklists permanently
> fixed?

There's a lot more to checking incoming mail than doing a reverse DNS
lookup.  In fact IMHO such checks aren't especially useful.  Much more
useful, I find, are things like the Spamhaus DROP List, GeoIP, SPF,
MIMEDefang, greylisting, iptables (I currently block more than 25% of
the IPv4 address space using iptables alone) and assorted personalized
tweaks using something like regexes.  I recommend milter-regex, but as
I'm a dyed-in-the-wool Sendmail type I don't know how easy it would be
to use that lot with Exim.  Don't relay mail.  No, the many blacklists
that are around are anything but fixed.  I use a few, but they're all
some sort of a compromise and you can't rely on them alone.  You can't
go far wrong with Spamhaus (different from DROP - Do not Route Or Peer)
lists but some of the others are prone to excessive false positives.
You've mentioned virus scanning, but after all the other filtering is
done here, very little malicious mail gets as far as a virus scanner.

Don't run mail content pattern matching if you can just drop packets.
The most important feature for me in a mail scanner is being able to
use things like 3rd-party content filtering.  Here I would especially
recommend the Sanesecurity lists, which kick some serious @$$ and do
most of my heavy lifting after the more lightweight filters are done.

> I also need to figure out how to fully test the DNS checking before
> it is enabled.

I don't understand what you plan to do here.  If you want to learn
about DNS there are mountains of documents for you to read for the
price of a couple of mouse-clicks.  Simply install a caching-only
nameserver (BIND), make sure the Debian security updates will be
applied to it (I recommend Debian automatic updates for BIND), use it
as the primary DNS for your mail server's and the internal network's
needs, and then (unless you plan to get into DNSSEC) you can almost
forget all about it.  Your mail server will use it as it requires (I
don't know exactly what Exim does, as I said it's not my sphere).

Log everything.  By default on Debian your logs will be rotated and
then deleted after a brief interval.  Extend that interval to, say,
a decade so you can go back and figure out what you did wrong later.
Increase the verbosity of the logs so you can see more of the SMTP
conversations in them.  You can err on the generous side and reduce
verbosity later if you feel the need.  Much of the mail that comes
into my servers is recorded verbatim as the conversation proceeds,
then I can look back at my leisure to see exactly what happened if
something gets through that I think shouldn't have.  It happens.

For the record, I don't recommend using a Debian box as your firewall
until you're familiar with the issues.  That will take a few years.

There's still a lot more to administering a mail server than what I've
roughly sketched out here, but it should give you some flavour of the
monumental task ahead of you.

-- 

73,
Ged.

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user