File Contoh

• imapproxy.conf

Pengaturan Pengikatan

Pengantar

Bind akan diatur dengan chroot untuk meningkatkan keamanan. Kami juga akan menggunakan tampilan untuk mencegah penyalahgunaan server dns.

Konfigurasi Dasar

Konfigurasi dasar dinonaktifkan secara default, kueri rekursif, dan transfer zona. Kami juga mengaburkan versi BIND yang kami jalankan sehingga kami tidak terkena kerentanan zero day dari script kiddies.

options { direktori "/var/named"; pid-file "/var/run/named/named.pid"; mendengarkan { 127.0.0.1; 192.168.1.5; }; versi "tebak saja"; izinkan-rekursi { "localhost"; }; izinkan-transfer { "tidak ada"; };};

Logging

Logging disesuaikan untuk menghapus "lame-server" yang mengganggu dan memperbarui kesalahan yang muncul di log:

logging { pembaruan kategori { null; }; kategori pembaruan-keamanan { null; }; kategori lumpuh-server{ null; };};

Croot

Pastikan bahwa ini diatur dalam file /etc/sysconfig/named (biasanya disetel oleh paket bind-chroot):

ROOTDIR=/var/named/chroot

Server Titik

Biarkan mesin menggunakan server ini untuk mengedit resolusi dns /etc/resolv.conf dan menambahkan:

server nama 127.0.0.1

File contoh

• named.conf
• /etc/sysconfig/named

Penyiapan Vsftpd

Pengantar

Kami akan menggunakan vsftpd sebagai server ftp kami. Ini memiliki rekam jejak yang lebih baik dibandingkan dengan server proftpd &wuftpd.

Setelan Dasar

Pengaturan dasar kami menonaktifkan pengguna anonim, dan memungkinkan pengguna sistem lokal untuk terhubung ke server ftp.

anonymous_enable=NOlocal_enable=YESwrite_enable=YESlocal_umask=022anon_upload_enable=NOanon_mkdir_write_enable=NOdirmessage_enable=YESxferlog_enable=YESconnect_from_port_20=YESxferlog_file=/var/log/vsftpd.logxferlog_std_format=YESftpd_banner=Welcome to example.com serverpam_service_name=vsftpdtcp_wrappers=YES

Croot

Semua pengguna akan di-chroot ke direktori home mereka (kecuali nama pengguna di file /etc/vsftpd/chroot_list) yang berarti tidak dapat membuka dan melihat file pengguna lain.

chroot_list_enable=YESchroot_local_user=YESchroot_list_file=/etc/vsftpd/chroot_list

Pengguna yang Diblokir

Pengguna yang ditambahkan ke file /etc/vsftpd/user_list tidak akan diizinkan untuk masuk:

userlist_enable=YA

File Contoh

• vsftpd.conf
• daftar_pengguna
• chroot_list

Cara Hosting Virtual Dengan Virtualmin Di CentOS 5.1 - Halaman 5

Pengaturan Milter Clamav

• Edit /etc/sysconfig/clamav-milter:

CLAMAV_FLAGS=" --config-file=/etc/clamd.conf --force-scan --local --max-children=5 --sendmail-cf=--outgoing --quiet"SOCKET_ADDRESS="local :/var/clamav/clmilter.socket"

• Menambal file init untuk memperbaiki izin soket:

wget http://www.topdog-software.com/files/clamav-milter.patch
patch /etc/init.d/clamav-milter

Pengaturan MySQL

Konfigurasi Dasar

• Dengarkan hanya localhost, edit /etc/my.cnf di bawah bagian mysqld:

mengikat-alamat =127.0.0.1

Setel Kata Sandi Root

• Setel kata sandi root:

service mysqld start
mysqladmin -u root password NEWPASSWORD

Penyiapan SpamAssassin

Konfigurasi Dasar

required_hits 5report_safe 0rewrite_header Subjek [SPAM]

Buat Database MySQL

• Buat databasenya:

mysqladmin -p buat bayes

• Mengisi database:

mysql -p bayes

• Buat pengguna:

mysql -p
mysql> GRANT ALL ON bayes.* KE [email protected] DIIDENTIFIKASI DENGAN 'password';

Konfigurasikan Untuk Menggunakan DB

• Edit file /etc/mail/spamassassin/local.cf dan tambahkan:

bayes_store_module Mail::SpamAssassin::BayesStore::MySQLbayes_sql_dsn DBI:mysql:bayes:localhostbayes_sql_override_username bayesbayes_sql_username bayesbayes_sql_password password

Konfigurasi FuzzyOCR

Kami akan menyimpan hash gambar dalam database mysql untuk meningkatkan kinerja sehingga gambar yang telah kami pindai tidak dipindai lagi karena OCR adalah aktivitas sumber daya yang intensif.

Buat Database MySQL

• Script sql membuat database dan tabel dan menambahkan user fuzzyocr dengan password fuzzyocr:

mysql -p

• Ubah kata sandi:

mysqladmin -u fuzzyocr -p kata sandi fuzzyocr

Setelan Dasar

• Edit /etc/mail/spamassassin/FuzzyOCR.cf dan atur opsi dasar:

focr_path_bin /usr/bin:/usr/local/bininfocr_minimal_scanset 1focr_autosort_scanset 1focr_enable_image_hashing 3focr_logfile /tmp/FuzzyOcr.log

Buat FuzzyOCR Gunakan Basis Data

• Edit file /etc/mail/spamassassin/FuzzyOcr.cf dan tambahkan:

focr_mysql_db FuzzyOcrfocr_mysql_hash Hashfocr_mysql_safe Safefocr_mysql_user fuzzyocrfocr_mysql_pass passwordfocr_mysql_host localhostfocr_mysql_port 3306focr_mysql_socket /var/lib/mysql/mysql.sock

Pembaruan Aturan SARE

• Impor kunci GPG yang digunakan untuk menandatangani aturan:

mkdir /etc/mail/spamassassin/sa-update-keys/
chmod 700 /etc/mail/spamassassin/sa-update-keys/
wget http://daryl.dostech.ca/sa- update/sare/GPG.KEY
sa-update --import GPG.KEY

• Buat file saluran /etc/mail/spamassassin/sare-sa-update-channels.txt:

updates.spamassassin.org72_sare_redirect_post3.0.0.cf.sare.sa-update.dostech.net70_sare_evilnum0.cf.sare.sa-update.dostech.net70_sare_bayes_poison_nxm.cf.sare.sa-update.dostech_html070_sare.sare_html070_sare.sare_html070_sare. .sa-update.dostech.net70_sare_html_eng.cf.sare.sa-update.dostech.net70_sare_header0.cf.sare.sa-update.dostech.net70_sare_header_eng.cf.sare.sa-update.dostech.net70_sare_specific.cf.sare.sa -update.dostech.net70_sare_adult.cf.sare.sa-update.dostech.net72_sare_bml_post25x.cf.sare.sa-update.dostech.net99_sare_fraud_post25x.cf.sare.sa-update.dostech.net70_sare_spoof.cf.sare.sa-update .dostech.net70_sare_random.cf.sare.sa-update.dostech.net70_sare_oem.cf.sare.sa-update.dostech.net70_sare_genlsubj0.cf.sare.sa-update.dostech.net70_sare_genlsubj_eng.cf.sare.sa-update. .net70_sare_unsub.cf.sare.sa-update.dostech.net70_sare_uri0.cf.sare.sa-update.dostech.net70_sare_obfu0.cf.sare.sa-update.dostech.net70_sare_stocks.cf.sare.sa-update.dostech.net 

• Buat skrip pembaruan /usr/local/bin/update-sa:

#!/bin/bash##sa-update -D --channelfile /etc/mail/spamassassin/sare-sa-update-channels.txt --gpgkey 856AA88A &>/var/log/sa-updates. log

• Jadikan itu dapat dieksekusi dan tambahkan ke cron:

chmod +x /usr/local/bin/update-sa
ln -s /usr/local/bin/update-sa /etc/cron.daily/
ln -s /usr/local/bin /update-sa /etc/cron.hourly/

Penyiapan Spamassmilter

Basic Configuration

• Edit /etc/sysconfig/spamass-milter:

SOCKET=/var/run/spamass.sockEXTRA_FLAGS="-m -r 8"

Patch

We need to patch the init file to fix the permissions of the socket created such that postfix is able to use the socket.

wget http://www.topdog-software.com/files/spamass-milter.patch
patch /etc/rc.d/init.d/spamass-milter

Apache Setup

Disable Modules

We will disable some modules that we are not using thus freeing up memory and also improving security.

• Edit /etc/httpd/conf/httpd.conf and comment out the modules as below.

#LoadModule ldap_module modules/mod_ldap.so#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so#LoadModule dav_module modules/mod_dav.so#LoadModule status_module modules/mod_status.so#LoadModule dav_fs_module modules/mod_dav_fs.so#LoadModule proxy_module modules/mod_proxy.so#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so#LoadModule proxy_http_module modules/mod_proxy_http.so#LoadModule proxy_connect_module modules/mod_proxy_connect.so#LoadModule cache_module modules/mod_cache.so#LoadModule disk_cache_module modules/mod_disk_cache.so#LoadModule file_cache_module modules/mod_file_cache.so#LoadModule mem_cache_module modules/mod_mem_cache.so

• Edit /etc/httpd/conf.d/proxy_ajp.conf and comment out as below:

#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so

Listen To One IP For HTTPS

Apache has to be configured to listed to one address for port 443 as webmin will be using the same port. Edit /etc/httpd/conf.d/ssl:

Listen 192,168.1.6:443

Enable Gzip Compression

We setup gzip compression via the mod_deflate module to improve web server performance and to cut down on bandwidth usage by compressing responses to the client.

SetOutputFilter DEFLATEBrowserMatch ^Mozilla/4 gzip-only-text/htmlBrowserMatch ^Mozilla/4\.0[678] no-gzipBrowserMatch \bMSIE !no-gzip !gzip-only-text/htmlSetEnvIfNoCase Request_URI \\.(?:gif|jpe?g|png)$ no-gzip dont-varyHeader append Vary User-Agent env=!dont-vary

Set up logging for the deflate module:

DeflateFilterNote deflate_ratioLogFormat "%v %h %l %u %t \"%r\" %>s %b mod_deflate:%{deflate_ratio}n pct." vhost_with_deflate_infoCustomLog logs/deflate_access_log vhost_with_deflate_info

Increase PHP Max Memory

Edit the file /etc/php.ini and set the following:

memory_limit =64M

Enable Virtual Hosting

NameVirtualHost *:80

Create Default Virtual Host

This needs to be the first virtual host, it will be the default on the server the equivalent of the server with out virtual hosting.

 Servername localhost.localdomain Serveradmin [email protected]

Roundcube Webmail Setup

Buat Basis Data

• Create the database and add the roundcube user.

mysqladmin -p create roundcube
mysql -p
mysql> GRANT ALL ON roundcube.* TO [email protected] IDENTIFIED BY 'password';

• Initialize the database:

mysql -u roundcube -p roundcube

Basic Config

• Configure database DSN in /var/www/roundcube/config/db.inc.php:

$rcmail_config['db_dsnw'] ='mysql://roundcube:[email protected]/roundcube';

• Configure roundcube in /var/www/roundcube/config/main.inc.php:

$rcmail_config['default_host'] ='localhost';$rcmail_config['default_port'] =143;$rcmail_config['virtuser_file'] ='/etc/postfix/virtual';$rcmail_config['smtp_server'] ='localhost';$rcmail_config['smtp_port'] =25;$rcmail_config['smtp_helo_host'] ='localhost';

Set Up Catch All Virtualhost

As we will be providing webmail for all domains that are created on the system we need to setup a catch all virtualhost that can display roundcube when ever a user accesses http://webmail.domainname. Edit /etc/httpd/conf/httpd.conf and append:

ServerName webmail.example.comServerAlias webmail.*DocumentRoot /var/www/roundcubeOptions -Indexes IncludesNOEXEC FollowSymLinksallow from all

Firewall Setup

Introduction

This is a basic firewall it may not suit your needs, firewalling is an art so i recommend to read into it to improve on this basic one.

Basic Config

Add these rules in your configuration file /etc/sysconfig/iptables:

*raw:PREROUTING ACCEPT [0:0]:OUTPUT ACCEPT [0:0]COMMIT*nat:PREROUTING ACCEPT [0:0]:POSTROUTING ACCEPT [0:0]:OUTPUT ACCEPT [0:0]COMMIT*mangle:PREROUTING ACCEPT [0:0]:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]:POSTROUTING ACCEPT [0:0]COMMIT*filter:FORWARD DROP [0:0]:INPUT DROP [0:0]:OUTPUT DROP [0:0]-A INPUT -i lo -j ACCEPT-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT-A INPUT -p tcp -m multiport -j ACCEPT --dports 80,443,25,110,143,53-A INPUT -p udp -m udp --dport 53 -j ACCEPT-A INPUT -p icmp -m icmp -m limit --icmp-type 8 --limit 5/min -j ACCEPT-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT-A OUTPUT -s 127.0.0.1 -j ACCEPT-A OUTPUT -s 192.168.1.5 -j ACCEPT-A OUTPUT -s 192.168.1.6 -j ACCEPTCOMMIT

Activate Config

service iptables restart

Virtual Hosting Howto With Virtualmin On CentOS 5.1 - Page 6

Configure Virtualmin

Introduction

Virtualmin is a powerful and flexible hosting control panel that integrates with webmin. We will be using it to provide the virtual hosting functions such as creation of domains, accounts and maintaining configurations on the system.

Start Services

You need to start up services that are required to be able to configure virtualmin. Start the following services:

service named start
service spamassassin start
service spamass-milter start
service clamav-milter start
service postfix start
service dovecot start
service imapproxy start
service httpd start

Initial Settings

MySQL

Webmin needs to be able to communicate with mysql since we have set a password for mysql we need to set that up in webmin, go to servers ? mysql and enter this information:

Configure Features

You need to enable the features and plugins that we want to use. On login this is the screen that you will see.

• Enable the following features and save
  • Home directory
  • Administration user
  • Mail for domain
  • BIND DNS domain
  • Apache website
  • Webalizer reporting
  • Log file rotation
  • Mysql database
  • Webmin user

Configure Server Templates

Server template are used to customize the services and to create packages for different hosting account types.

Apache Template

You can make changes to the way apache virtual hosts are created by editing this template, The defaults however will do for purposes of this howto.

Domain Owner Template

This template is used to configure various server limits such as number of mailboxes,aliases,databases,virtual servers and other options like bandwidth limits, admin abilities. For this howto we will use the default values.

Home Directory Template

This template allows you to set a skel directory to hold setting for new users for this howto we will use the defaults.

Administration User

This template lets you set the quota for the virtual server and the admin user for this howto we will use the default quota 1GB.

Mail For Domain Template

This template sets various mail related options, we will modify the email message sent on server creation to have the content below:

The following virtual server has been set up successfully :Domain name:${DOM}Hosting server:${HOSTNAME}${IF-VIRT}Virtual IP address:${IP}${ENDIF-VIRT}Administration login:${USER}Administration password:${PASS}${IF-WEBMIN}Administration URL:${WEBMIN_PROTO}://www.${DOM}:${WEBMIN_PORT}/${ENDIF-WEBMIN}${IF-WEB}Website:http://www.${DOM}/${IF-WEBALIZER}Webalizer log reporting:Enabled${ELSE-WEBALIZER}Webalizer log reporting:Disabled${ENDIF-WEBALIZER}${ENDIF-WEB}${IF-MAIL}Email domain:${DOM}SMTP server:mail.${DOM}POP3 server:mail.${DOM}Webmail:webmail.${DOM}${ENDIF-MAIL}${IF-DNS}DNS domain:${DOM}Nameserver:${HOSTNAME}${ENDIF-DNS}${IF-MYSQL}MySQL database:${DB}MySQL login:${MYSQL_USER}MySQL password:${PASS}${ENDIF-MYSQL}${IF-POSTGRES}PostgreSQL database:${DB}PostgreSQL login:${USER}PostgreSQL password:${PASS}${ENDIF-POSTGRES}

We will leave the other options as the defaults.

BIND DNS Domain Template

This template is used to customize the zones that will be created by virtualmin. The changes to be made are adding a spf record, add the following records to auto generated text box (replace ns1.home.topdog-software.com. with your slave server):

@ IN NS ns1.home.topdog-software.com.;slaveadmin IN A 192.168.1.6;virtualminwebmail IN A 192.168.1.5;webmail

In the directives text box add the following with the IP address of your slave server such that the slave is allowed to do zone transfers.

allow-transfer { 192.168.1.2; };

MySQL Database Template

Contains options on creation of databases by virtualmin, for the howto we will use the defaults.

Webmin Login Template

Contains option on creation of new users by virtualmin, for the howto we will use the defaults.

Create Virtual Server

Finally we have a working virtual server system, lets create our first virtual server. Go to servers ? virtualmin virtual servers and click add new virtual server, owned by new user.

Fill in the require fields and click create.

Add a mail user to the domain. click on the domain name, then click edit mail and FTP users, then add user and fill in the information.

Testing

Postfix

Test SMTP

telnet 192.168.1.5 25
Connected to localhost.
Escape character is '^]'.
220 tds mail cluster
helo me
250 hosting1
mail from:[email protected]
250 2.1.0 Ok
rcpt:[email protected]
250 2.1.0 Ok
DATA
354 End data with .

From:[email protected]
To:[email protected]
Subject:This is a test
Hi
This is a test
.
250 2.0.0 Ok:queued as 4ACCC7C5A6

telnet 192.168.1.5 25
Trying 192.168.1.5...
Connected to localhost.
Escape character is '^]'.
220 tds mail cluster
ehlo me
250-hosting1
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Test dkim

Send a mail to [email protected]

Test domainkeys

Send a mail to [email protected]

Dovecot

Test POP3

telnet 192.168.1.5 110
+OK Dovecot ready.
user andrew.example
+OK
pass password
+OK Logged in.
quit
+OK Logging out.

Test IMAP

telnet 192.168.1.5 143
* OK Dovecot ready.
01 login andrew.example password
01 OK User logged in
01 list "" "*"

* LIST (\HasNoChildren) "." "Trash"
* LIST (\HasNoChildren) "." "Drafts"
* LIST (\HasNoChildren) "." "Junk"
* LIST (\HasNoChildren) "." "Sent"

* LIST (\HasNoChildren) "." "INBOX"
01 OK List completed.
01 logout
* BYE LOGOUT received
01 OK Completed

BIND

dig example.com @127.0.0.1

Clamav-milter

We are using the test virus from www.eicar.org.

telnet 192.168.1.5 25
Connected to localhost.
Escape character is '^]'.
220 tds mail cluster
helo me
250 hosting1
mail from:[email protected]
250 2.1.0 Ok
rcpt:[email protected]
250 2.1.0 Ok
DATA
354 End data with .

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
.
550 5.7.1 virus Eicar-Test-Signature detected by ClamAV - http://www.clamav.net
quit
221 2.0.0 Bye

Take a lot at your /var/log/maillog you should see something like this:

73BC87C4E4:milter-reject:END-OF-MESSAGE from localhost[127.0.0.1]:5.7.1 virus Eicar-Test-Signature detected by ClamAV - http://www.clamav.net; from= to= proto=SMTP helo=

Spamass-milter

We are using the test message from http://spamassassin.apache.org/gtube/.

telnet 192.168.1.5 25
Connected to localhost.
Escape character is '^]'.
220 tds mail cluster
helo me
250 hosting1
mail from:[email protected]
250 2.1.0 Ok
rcpt:[email protected]
250 2.1.0 Ok
DATA
354 End data with .

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
.
550 5.7.1 Blocked by SpamAssassin
quit
221 2.0.0 Bye

You will see this in your log files:

spamd:result:Y 1002 - AWL,GTUBE,MISSING_SUBJECT,TVD_SPACE_RATIO,UNPARSEABLE_RELAY scantime=0.5,size=723,user=root,uid=99,required_score=5.0,