Chapter 6. Security

Table of Contents
6.1. Avoiding Unsolicited Email
6.2. Avoiding Viruses
6.2.1. Integrating Anti-Virus Software
6.2.2. Filtering Incoming Email
6.3. Enabling SSL

6.1. Avoiding Unsolicited Email

The Messaging Server provides the following protection against unsolicited email (or "spam"):

built-in defaults 

The Messaging Server includes a simple built-in filter that diverts any mail not directly addressed to a Messaging Server user or alias. Diverted mail can be sent to a folder or destroyed. This eliminates messages sent as Blind CC (bcc), a major delivery vehicle for unsolicited email. This filter is activated by the msgaclset utility for any user who is added to the system. The filter and exception lists can also be managed for individual users using the msgusermod utility. See the msgaclset(8) and msgusermod(8) manual pages for more information.

Postfix UCE configuration
  

By default, the Postfix SMTP server only accepts mail from or to the local network or domain, or to domains that are hosted by Postfix. This prevents your system from being used as a mail relay to forward bulk mail from unknown sources.

You can also implement UCE (unsolicited commercial email) policies that prevent such email altogether; for example, you can configure Postfix to use RBL (real-time blackhole list) name servers. For more information, see "Postfix Configuration - UCE Controls" in the Wietse's Postfix Project documentation.

6.2. Avoiding Viruses

6.2.1. Integrating Anti-Virus Software

The Messaging Server provides integration with anti-virus software. To enable supported anti-virus software:

  1. Install the anti-virus software.

  2. Edit the /etc/opt/lsb-caldera.com-volution/msg/vscan.conf file and remove the comments appropriate to your anti-virus software.

For more information, see:

6.2.2. Filtering Incoming Email

Postfix provides support for filtering the headers of incoming mail messages. In addition to routine message sorting, this can be useful in the early stages of a virus' distribution when the subject heading is known but anti-virus checking software has not been updated to protect against it.

Postfix MTA can protect against such attacks using a "header_checks" file. For example, to block all messages with the subject header ILOVEYOU from being received or propagated:

  1. Create the file /etc/postfix/header_checks with the contents:

        /^Subject: ILOVEYOU/ REJECT

  2. Change the file ownership to the postfix account:

        chown postfix /etc/postfix/header_checks

  3. Then modify the file /etc/postfix/main.cf to include:

        header_checks = regexp:/etc/postfix/header_checks

  4. Restart Postfix using either:

    Server Manager 

    In the System menu, click on Mail Services, then click on Reload in the postfix display.

    command line 

    Enter:

        /etc/rc.d/init.d/postfix reload

6.3. Enabling SSL

The Messaging Server provides SSL (Secure Socket Layer) configuration by default. That is, https can be used immediately using demonstration keys, and should be used to provide secure web connections.

However, many SSL benefits are not available without a signed certificate and key. These can be obtained:

We recommend using commercial products, because they guarantee unique certificates, and they provide legal protection. Nonetheless, self-signed certificates are adequate for many installations.

Both self-signed certificates and CSRs can be managed with Webmin. In the Webmin interface, select System and Certificate and Key Management. Then select either:

Generate Key and Certificate Signing Request (CSR)
  

Use the defaults provided and fill out other forms as desired. The Common Name field must match the Messaging Server address. When you receive the signed certificate and key from the Certificate Authority, you must import it using the Webmin Import Key or Signed Certificate facility.

Generate Self Signed Certificate and Key
  

Use the defaults provided and fill out other forms as desired. The Common Name field must match the Messaging Server address. When you generate the key, you will be prompted to overwrite the demonstration keys in the /etc/ssl/private directory; you can safely do so.

Once you have acquired or generated a key, you must provide the Cyrus and Postfix services with read/write access to the key. Assuming that the new key is /etc/ssl/private/hostkey.pem, enter:

    cd /etc/ssl
    cp private/hostkey.pem cyrus-key.pem
    chown cyrus cyrus-key.pem
    chmod 600 cyrus-key.pem
    cp private/hostkey.pem postfix-key.pem
    chown postfix postfix-key.pem
    chmod 600 postfix-key.pem

For more information about SSL configuration, see "4.8. Using Certificate and Key Management" in the Caldera OpenLinux System Administration Guide.