Mantenimiento de DNS y correo de sico

cd /etc/postfix
openssl dhparam -out dhparams.pem 2048
echo "smtpd_tls_dh1024_param_file = /etc/postfix/dhparams.pem" >> main.cf
postfix reload
/etc/dovecot
cp ../postfix/dhparams.pem dh.pem
cd conf.d
echo "ssl_dh_parameters_length = 2048" >> 10-ssl.conf
#Lo siguiente es para dovecot 2.3+ y en zen está 2.1
#echo "ssl_dh = </etc/dovecot/dh.pem" >> 10-ssl.conf
/etc/init.d/dovecot restart

cd /usr/src/src.dovecot/to-install
dpkg -i dovecot-core_2.3.13+dfsg1-2+deb11u2_amd64.deb\
 dovecot-imapd_2.3.13+dfsg1-2+deb11u2_amd64.deb\
 dovecot-managesieved_2.3.13+dfsg1-2+deb11u2_amd64.deb\
 dovecot-pgsql_2.3.13+dfsg1-2+deb11u2_amd64.deb\
 dovecot-pop3d_2.3.13+dfsg1-2+deb11u2_amd64.deb\
 dovecot-sieve_2.3.13+dfsg1-2+deb11u2_amd64.deb

...
doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem
doveconf: Warning: You can generate it with: dd if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dhparam -inform der > /etc/dovecot/dh.pem
...

sed "/^ssl_key/assl_dh = </etc/dovecot/dh.pem" /etc/dovecot/dovecot.conf
/etc/init.d/dovecot restart

 sqlpool(pgsql): Query failed, retrying: ERROR:  column mailbox.enablepop3tls does not exist

cd /etc/dovecot
perl -pi -e 's/^ssl_protocols/#${1}/g' dovecot.conf
perl -pi -e 's#(postmaster_address.*)##g' dovecot.conf
perl -pi -e 's#^(mail_plugins.*) stats(.*)#${1} old_stats${2}#g' dovecot.conf
perl -pi -e 's#imap_stats#imap_old_stats#g' dovecot.conf
perl -pi -e 's#service stats#service old-stats#g' dovecot.conf
perl -pi -e 's#fifo_listener stats-mail#fifo_listener old-stats-mail#g' dovecot.conf
perl -pi -e 's#stats_refresh#old_stats_refresh#g' dovecot.conf
perl -pi -e 's#stats_track_cmds#old_stats_track_cmds#g' dovecot.conf
sed -i "/^ssl_dh/d" dovecot.conf
if [ ! -e  /etc/ssl/dh2048_param.pem ] ; then openssl dhparam -out  /etc/ssl/dh2048_param.pem 2048  ; fi
rm -f /tmp/conf-add.tmp
cat > /tmp/conf-add.tmp <<'EOF'
ssl_dh = </etc/ssl/dh2048_param.pem

service stats {
    unix_listener stats-reader {
        user = vmail
        group = vmail
        mode = 0660
    }

    unix_listener stats-writer {
        user = vmail
        group = vmail
        mode = 0660
    }
}
EOF
cat /tmp/conf-add.tmp >> dovecot.conf
rm /tmp/conf-add.tmp

su - postgres
psql
\c vmail;
\d mailbox;
ALTER TABLE mailbox ADD COLUMN enableimaptls INT2 NOT NULL DEFAULT 1;
CREATE INDEX idx_mailbox_enableimaptls ON mailbox (enableimaptls);
ALTER TABLE mailbox ADD COLUMN enablepop3tls INT2 NOT NULL DEFAULT 1;
CREATE INDEX idx_mailbox_enablepop3tls ON mailbox (enablepop3tls);
ALTER TABLE mailbox ADD COLUMN enablesievetls INT2 NOT NULL DEFAULT 1;
CREATE INDEX idx_mailbox_enablesievetls ON mailbox (enablesievetls);
\d mailbox;
\q
exit

/etc/init.d/dovecot restart

 v=DMARC1; p=none; rua=mailto:dmarc_reports@sicosoft.es;

echo 'ignoreip = 3.0.1.170' >> /etc/fail2ban/fail2ban.conf
/etc/init.d/fail2ban restart

cd /var/vmail/backup/pgsql
cat > clean_old.sh <<'EOF'
#!/bin/bash
cd /var/vmail/backup/pgsql
curyear=$(date "+%Y")
prevyear=$(( $curyear -1 ))
for i in $( ls -1 | grep "^[0-9][0-9][0-9][0-9]\$" ) ; do
        if [ "m$i" == "m$curyear" ] ; then
                continue
        fi
        for j in $( ls -1 $i ) ; do
                if [ "m$i" == "m$prevyear" ] && [ "m$j" == "m12" ] ; then
                        continue
                fi
                rm -rf "$i/$j"
                rmdir "$i" 2>/dev/null
        done
done
EOF
chmod a+x clean_old.sh
(crontab -l ; echo -e "# Clean old pgsql backups en forst day of month at 04:01 AM\n1   4   1   *   *   /bin/bash /var/vmail/backup/pgsql/clean_old.sh 2>&1 >/dev/null" ) | crontab -e

cd /var/vmail/backup/pgsql/
./clean_old.sh

 /var/spool/cron/crontabs/root

1   3   *   *   *   /usr/sbin/cbpadmin --config=/etc/cluebringer/cluebringer.conf --cleanup >/dev/null
# iRedMail: update Awstats statistics
1   */1   *   *   *   perl /usr/lib/cgi-bin/awstats.pl -config=web -update >/dev/null
1   */1   *   *   *   perl /usr/lib/cgi-bin/awstats.pl -config=smtp -update >/dev/null
# Backup on 03:01 AM
1   3   *   *   *   /bin/bash /var/vmail/backup/backup_pgsql.sh
# Clean old pgsql backups en forst day of month at 04:01 AM
1   4   1   *   *   /bin/bash /var/vmail/backup/pgsql/clean_old.sh 2>&1 >/dev/null
# Backup del correo
0 4 * * 5 /root/backupcorreo.sh 2>/dev/null >/dev/null

cd /var/vmail/backup/pgsql
rm -rf 2019 2020 2021

root@mail:/var/vmail/backup/pgsql# du -hs * | sort -h
8,7G    2019
20G     2023
38G     2020
46G     2021
53G     2022
root@mail:/var/vmail/backup/pgsql# 

ssh root@zen
su - postgres
postgres@mail:~$ psql -l
postgres@mail:~$ psql -d vmail
psql (9.1.24)
Digite «help» para obtener ayuda.

select * from alias where address = 'mcriado@sicosoft.es' and domain = 'sicosoft.es';
update alias set goto = 'mcriado@sicosoft.es' , domain = 'sicosoft.es' where address = 'mcriado@sicosoft.es' and domain = 'sicosoft.es';
select * from alias where address = 'mcriado@sicosoft.es';
commit;
\q
exit
exit

ssh root@zen
su - postgres
psql -d vmail
select * from alias where address = 'sicosoft@sicosoft.es' and domain = 'sicosoft.es';
update alias set goto = 'mcriado@sicosoft.es' , domain = 'sicosoft.es' where address = 'sicosoft@sicosoft.es' and domain = 'sicosoft.es';
select * from alias where address = 'sicosoft@sicosoft.es';
commit;
\q
exit
exit

apt-get install nginx-extras
cd /root
cat > imap4s-ssl.sh <<'EOF'
#!/bin/bash
# https://www.hackingarticles.in/socat-for-pentester/
cat /etc/perdition/sico.sicosoft.es/privkey.pem /etc/perdition/sico.sicosoft.es/fullchain.pem > /etc/perdition/socat.pem
nohup /usr/bin/socat OPENSSL-LISTEN:993,cert=/root/socat.pem,verify=0,reuseaddr,fork TCP4:127.0.0.1:143 &
EOF
cat > zen-imapssl.sh <<'EOF'
#!/bin/bash
# https://www.hackingarticles.in/socat-for-pentester/
cat /etc/perdition/sico.sicosoft.es/privkey.pem /etc/perdition/sico.sicosoft.es/fullchain.pem > /etc/perdition/socat.pem
nohup /usr/bin/socat OPENSSL-LISTEN:993,cert=/root/socat.pem,verify=0,reuseaddr,fork TCP4:127.0.0.1:143 &
EOF
chmod a+x imap4s-ssl.sh zen-imapssl.sh

 obelisk:/etc/nginx/nginx.conf (sólo el final)

...

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;

# para el auth de imap
        server {
                listen 9000;
                location /auth {
                        content_by_lua_block {
                                local username = ngx.req.get_headers()["auth-user"]
                                if username == nil then
                                        username = "no-username"
                                end
                                if username == "avisossicosoft@sicosoft.es" or username == "rarias@sicosoft.es" or username == "avisospcitfno@sicosoft.es" or username == "mcriado@sicosoft.es" then
                                        ngx.header["Auth-Status"] = "OK"
                                        ngx.header["Auth-Server"] = "127.0.0.1"
                                        ngx.header["Auth-Port"] = 9993
                                else
                                        ngx.header["Auth-Status"] = "Unauthorized " .. username
                                        ngx.header["Auth-Wait"] = 3
                                end
                                ngx.exit(200)
                        }
                }
        }
}

mail {
    server_name sico2.sicosoft.es;
    auth_http localhost:9000/auth;
    proxy_pass_error_message on;
    imap_capabilities  "IMAP4rev1"  "UIDPLUS";
    server {
        listen 143;
        protocol imap;
        proxy on;
    }
}

 obelisk:/etc/init.d/nginx

...
start_nginx() {
        # Start the daemon/service
        #
        # Returns:
        #   0 if daemon has been started
        #   1 if daemon was already running
        #   2 if daemon could not be started
        # SICO START: PARAR LOS redir
        (netstat -pan | grep 80 ; netstat -pan | grep 443 ) | grep redir | expand | sed "s:^.* \([0-9][0-9]*\)/.*:\1:g" | xargs kill 2>/dev/null >/dev/null
        # SICO END
        start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON --test > /dev/null \
                || return 1
        start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON -- \
                $DAEMON_OPTS 2>/dev/null \
                || return 2
}
...

 obelisk:/etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo eth0 eth1
allow-hotplug eth2

iface lo inet loopback

iface eth0 inet static
        address 3.0.1.53
        #gateway 3.0.1.51
        network 3.0.1.0
        netmask 255.255.255.0
        broadcast 3.0.1.255
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 3.0.1.3
        dns-search sicosoft.es
        post-up /sbin/ifconfig eth0:1 3.0.1.54
        #post-up /sbin/ifconfig eth0:2 192.168.2.254 netmask 255.255.255.0
        post-up /sbin/route add -host 16.0.62.18 gw 3.0.1.42
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward

iface eth1 inet static
        address 192.168.1.2
        network 192.168.1.0
        netmask 255.255.255.0
        broadcast 192.168.1.255
        gateway 192.168.1.1
        post-up /bin/sh -c "/etc/init.d/iptables start ; sleep 1 ; /root/nat.sh eth1 ; /root/autossh-sico2.sh ; /root/nat-carteles.sh ; /root/autossh-vps.sh"
        post-up /bin/sh -c "cd /root ; ./zen-imapssl.sh ; ./imap4s-ssl.sh"

 asterisk:/root/renew-certbot.sh

#!/bin/bash
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
n=`certbot certificates 2>/dev/null | grep "[^A-Z]VALID: [0-9]" | wc -l | tr -dc 0-9`
daysleft=`certbot certificates 2>/dev/null | grep "[^A-Z]VALID: [0-9]" | head -1 | sed "s/^.*VALID: \([0-9][0-9]*\).*/\1/g"`
if [ "m$n" != "m1" ] || [ $daysleft -le 30 ] ; then
        ssh root@vps.sicosoft.es "ps -efa | grep 'redir .*83.48.87.215:80\|redir .*83.48.87.215:443' | expand | sed 's/  */ /g' | cut -d ' '  -f 2 | xargs kill"
        ssh root@vps.sicosoft.es "redir 51.38.32.171:80 83.48.87.215:80 ; redir 51.38.32.171:443 83.48.87.215:443 "
        ssh root@obelisk "/etc/init.d/nginx stop"
        ssh root@obelisk "redir 192.168.1.2:80 3.0.1.52:80 ; redir 192.168.1.2:443 3.0.1.52:443"
        service nginx stop
        certbot renew
        service nginx start
        ssh root@vps.sicosoft.es "ps -efa | grep 'redir .*83.48.87.215:80\|redir .*83.48.87.215:443' | expand | sed 's/  */ /g' | cut -d ' '  -f 2 | xargs kill"
        scp /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem root@zen:/etc/letsencrypt/live/sico.sicosoft.es/
        ssh root@zen "chgrp ssl-cert /etc/letsencrypt/live/sico.sicosoft.es/* ; /etc/init.d/dovecot restart ; /etc/init.d/postfix restart ; apache2ctl restart"
        cat /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem | ssh root@obelisk "cat > /root/socat.pem ; chmod 600 /root/socat.pem"
        scp /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem root@obelisk:/root/
        ssh root@obelisk "ps -efa | grep socat | grep ':993,' | grep -v grep | expand | sed 's/  */ /g' | cut -d ' ' -f 2 | xargs kill 2>/dev/null"
        ssh -f root@obelisk "cd /root ; ./zen-imapssl.sh ; ./imap4s-ssl.sh " &
        ssh root@obelisk "/etc/init.d/nginx start"
fi
# Comprobar que el certificado de zen está actualizado
if [ "m$(ssh root@zen 'cd /etc/letsencrypt/live/sico.sicosoft.es && cat fullchain.pem privkey.pem | md5sum | cut -c 1-32')" != "m$(cd /etc/letsencrypt/live/sico.sicosoft.es && cat fullchain.pem privkey.pem | md5sum | cut -c 1-32)" ] ; then
        scp /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem root@zen:/etc/letsencrypt/live/sico.sicosoft.es/
        ssh root@zen "chgrp ssl-cert /etc/letsencrypt/live/sico.sicosoft.es/* ; /etc/init.d/dovecot restart ; /etc/init.d/postfix restart ; apache2ctl restart"
fi

cd /root
cat /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem | ssh root@obelisk "cat > /root/socat.pem ; chmod 600 /root/socat.pem"
scp /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem root@obelisk:/root/
ssh root@obelisk "ps -efa | grep socat | grep ':993,' | grep -v grep | expand | sed 's/  */ /g' | cut -d ' ' -f 2 | xargs kill 2>/dev/null"
ssh -f root@obelisk "cd /root ; ./zen-imapssl.sh ; ./imap4s-ssl.sh "
ssh root@obelisk "/etc/init.d/nginx start"

apt-get install perdition
cd /etc/default
for i in POP3 POP3S IMAP4 ; do sed -i "s/$i=.*/$i=no/g" perdition ; done
sed -i 's/IMAP4S_FLAGS=.*/IMAP4S_FLAGS="--ssl_mode ssl_listen"/g' etc/default/perdition
cd /etc/perdition
cat > popmap <<'EOF'
avisossicosoft@sicosoft.es:mail.sicosoft.es:993
rarias@sicosoft.es:mail.sicosoft.es:993
EOF
make
dd if=/dev/urandom count=2 | openssl dhparam -rand - 512 > dhparam

 asterisk:/root/renew-certbot.sh

#!/bin/bash
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
n=`certbot certificates 2>/dev/null | grep "[^A-Z]VALID: [0-9]" | wc -l | tr -dc 0-9`
daysleft=`certbot certificates 2>/dev/null | grep "[^A-Z]VALID: [0-9]" | head -1 | sed "s/^.*VALID: \([0-9][0-9]*\).*/\1/g"`
if [ "m$n" != "m1" ] || [ $daysleft -le 30 ] ; then
        ssh root@vps.sicosoft.es "ps -efa | grep 'redir .*83.48.87.215:80\|redir .*83.48.87.215:443' | expand | sed 's/  */ /g' | cut -d ' '  -f 2 | xargs kill"
        ssh root@vps.sicosoft.es "redir 51.38.32.171:80 83.48.87.215:80 ; redir 51.38.32.171:443 83.48.87.215:443 "
        ssh root@obelisk "/etc/init.d/nginx stop"
        ssh root@obelisk "redir 192.168.1.2:80 3.0.1.52:80 ; redir 192.168.1.2:443 3.0.1.52:443"
        service nginx stop
        certbot renew
        service nginx start
        ssh root@vps.sicosoft.es "ps -efa | grep 'redir .*83.48.87.215:80\|redir .*83.48.87.215:443' | expand | sed 's/  */ /g' | cut -d ' '  -f 2 | xargs kill"
        scp /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem root@zen:/etc/letsencrypt/live/sico.sicosoft.es/
        ssh root@zen "chgrp ssl-cert /etc/letsencrypt/live/sico.sicosoft.es/* ; /etc/init.d/dovecot restart ; /etc/init.d/postfix restart ; apache2ctl restart"
        # Actualizamos el certificado del perdition en obelisk
        scp /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem root@obelisk:/etc/perdition/perdition.key.pem
        ssh root@obelisk "chmod 600 /etc/perdition/perdition.key.pem"
        scp /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem root@obelisk:/etc/perdition/perdition.crt.pem
        ssh root@obelisk "cat /etc/perdition/dhparam >> /etc/perdition/perdition.crt.pem"
        scp /etc/letsencrypt/live/sico.sicosoft.es/chain.pem root@obelisk:/etc/perdition/perdition.ca.pem
        ssh root@obelisk "cat /etc/perdition/dhparam >> /etc/perdition/perdition.crt.pem"
        ssh root@obelisk "/etc/init.d/perdition restart"
        ssh root@obelisk "ps -efa | grep 'redir .*3.0.1.52 80\|redir .*3.0.1.52 443' | expand | sed 's/  */ /g' | cut -d ' '  -f 2 | xargs kill"
        ssh root@obelisk "/etc/init.d/nginx start"
fi
# Comprobar que el certificado de zen está actualizado
if [ "m$(ssh root@zen 'cd /etc/letsencrypt/live/sico.sicosoft.es && cat fullchain.pem privkey.pem | md5sum | cut -c 1-32')" != "m$(cd /etc/letsencrypt/live/sico.sicosoft.es && cat fullchain.pem privkey.pem | md5sum | cut -c 1-32)" ] ; then
        scp /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem root@zen:/etc/letsencrypt/live/sico.sicosoft.es/
        ssh root@zen "chgrp ssl-cert /etc/letsencrypt/live/sico.sicosoft.es/* ; /etc/init.d/dovecot restart ; /etc/init.d/postfix restart ; apache2ctl restart"
fi

        ssh root@vps.sicosoft.es "ps -efa | grep 'redir .*83.48.87.215:80\|redir .*83.48.87.215:443' | expand | sed 's/  */ /g' | cut -d ' '  -f 2 | xargs kill"
        ssh root@vps.sicosoft.es "ps -efa | grep 'redir .*83.48.87.215:80\|redir .*83.48.87.215:443' | expand | sed 's/  */ /g' | cut -d ' '  -f 2 | xargs kill"
        ssh root@vps.sicosoft.es "redir 51.38.32.171:80 83.48.87.215:80 ; redir 51.38.32.171:443 83.48.87.215:443 "
        ssh root@obelisk "/etc/init.d/nginx stop"
        ssh root@obelisk "redir 192.168.1.2:80 3.0.1.52:80 ; redir 192.168.1.2:443 3.0.1.52:443"
        service nginx stop
certbot certonly --cert-name sico.sicosoft.es --standalone -d sico.sicosoft.es -d sico2.sicosoft.es -d informes.sicosoft.es -d mail.sicosoft.es -d mail2.sicosoft.es -d vpn.sicosoft.es -d webmail.sicosoft.es
# Se le da a "U" de update
        service nginx start
        ssh root@vps.sicosoft.es "ps -efa | grep 'redir .*83.48.87.215:80\|redir .*83.48.87.215:443' | expand | sed 's/  */ /g' | cut -d ' '  -f 2 | xargs kill"
        scp /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem root@zen:/etc/letsencrypt/live/sico.sicosoft.es/
        ssh root@zen "chgrp ssl-cert /etc/letsencrypt/live/sico.sicosoft.es/* ; /etc/init.d/dovecot restart ; /etc/init.d/postfix restart ; apache2ctl restart"
        scp /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem root@obelisk:/etc/perdition/perdition.key.pem
        ssh root@obelisk "chmod 600 /etc/perdition/perdition.key.pem"
        scp /etc/letsencrypt/live/sico.sicosoft.es/cert.pem root@obelisk:/etc/perdition/perdition.crt.pem
        scp /etc/letsencrypt/live/sico.sicosoft.es/chain.pem root@obelisk:/etc/perdition/perdition.ca.pem
        ssh root@obelisk "cat /etc/perdition/dhparam >> /etc/perdition/perdition.crt.pem"
        ssh root@obelisk "/etc/init.d/perdition restart"
        ssh root@obelisk "ps -efa | grep 'redir .*3.0.1.52 80\|redir .*3.0.1.52 443' | expand | sed 's/  */ /g' | cut -d ' '  -f 2 | xargs kill"
        ssh root@obelisk "/etc/init.d/nginx start"

sed -i "s/zen/mail/g" /etc/hostname
sed -i "s/zen.sicosoft.es/zen.sicosoft.es mail mail.sicosoft.es/g" /etc/hosts
sed -i "s/zen.sicosoft.es/mail.sicosoft.es" /etc/postfix/main.cf
reboot

apt-get install opendkim opendkim-tools
cat >> /etc/opendkim.conf <<'EOF'
KeyTable           /etc/opendkim/key_table
SigningTable       /etc/opendkim/signing_table
ExternalIgnoreList /etc/opendkim/trusted_hosts
InternalHosts      /etc/opendkim/trusted_hosts
AutoRestart             Yes
AutoRestartRate         10/1h
Mode                    sv
PidFile                 /var/run/opendkim/opendkim.pid
SignatureAlgorithm      rsa-sha256
Canonicalization        relaxed/simple
UserID                  opendkim:opendkim
EOF
mkdir -p /etc/opendkim/sicosoft.es
cat >>/etc/opendkim/trusted_hosts <<'EOF'
127.0.0.1
3.0.1.0/24
EOF
ssh root@vps.sicosoft.es
apt-get update
apt-get upgrade
apt-get install opendkim opendkim-tools
cat >> /etc/opendkim.conf <<'EOF'
KeyTable           /etc/opendkim/key_table
SigningTable       /etc/opendkim/signing_table
ExternalIgnoreList /etc/opendkim/trusted_hosts
InternalHosts      /etc/opendkim/trusted_hosts
AutoRestart             Yes
AutoRestartRate         10/1h
Mode                    sv
PidFile                 /var/run/opendkim/opendkim.pid
SignatureAlgorithm      rsa-sha256
Canonicalization        relaxed/simple
UserID                  opendkim:opendkim
EOF
cat >>/etc/opendkim/trusted_hosts <<'EOF'
127.0.0.1
83.48.87.215
EOF
exit
cd /etc/opendkim/sicosoft.es/
opendkim-genkey -s mail -d sicosoft.es
chown opendkim:opendkim mail.private 
scp * root@vps.sicosoft.es:/etc/opendkim/sicosoft.es
ssh root@vps.sicosoft.es "chown opendkim:opendkim /etc/opendkim/sicosoft.es/mail.private"
cd /etc/opendkim
cat >>/etc/opendkim/key_table <<'EOF'
mail._domainkey.sicosoft.es sicosoft.es:mail:/etc/opendkim/sicosoft.es/mail.private
EOF
cd ..
scp key_table root@vps.sicosoft.es:/etc/opendkim/
cat >>/etc/opendkim/signing_table <<'EOF'
sicosoft.es mail._domainkey.sicosoft.es
EOF
scp signing_table root@vps.sicosoft.es:/etc/opendkim/
echo "SOCKET=inet:12345@localhost" >> /etc/default/opendkim 
ssh root@vps.sicosoft.es 'echo "SOCKET=inet:12345@localhost" >> /etc/default/opendkim'
cat >>/etc/postfix/main.cf <<'EOF'
# DKIM
milter_protocol = 6
milter_default_action = accept
smtpd_milters = inet:localhost:12345
non_smtpd_milters = inet:localhost:12345
EOF
ssh root@vps.sicosoft.es
cat >>/etc/postfix/main.cf <<'EOF'
# DKIM
milter_protocol = 6
milter_default_action = accept
smtpd_milters = inet:localhost:12345
non_smtpd_milters = inet:localhost:12345
EOF
exit
cat /etc/opendkim/sicosoft.es/mail.txt 

 _adsp._domainkey.sicosoft.es. TXT "dkim=all"

/etc/init.d/opendkim restart
/etc/init.d/postfix restart

/etc/init.d/opendkim restart
/etc/init.d/postfix restart

adduser dovecot ssl-cert
adduser postfix ssl-cert
chgrp ssl-cert /etc/letsencrypt/live/sico.sicosoft.es/*
/etc/init.d/dovecot restart ; /etc/init.d/postfix restart

...
# Comprobar que el certificado de zen está actualizado
if [ "m$(ssh root@zen 'cd /etc/letsencrypt/live/sico.sicosoft.es && cat fullchain.pem privkey.pem | md5sum | cut -c 1-32')" != "m$(cd /etc/letsencrypt/live/sico.sicosoft.es && cat fullchain.pem privkey.pem | md5sum | cut -c 1-32)" ] ; then
        scp /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem \
/etc/letsencrypt/live/sico.sicosoft.es/privkey.pem root@zen:/etc \
/letsencrypt/live/sico.sicosoft.es/
        ssh root@zen "chgrp ssl-cert /etc/letsencrypt \
/live/sico.sicosoft.es/* ; /etc/init.d/dovecot restart ; /etc/init.d/postfix restart ; apache2ctl restart"
fi
...

root@zen:~# cd /etc/letsencrypt/live/sico.sicosoft.es
root@zen:/etc/letsencrypt/live/sico.sicosoft.es# cat fullchain.pem | openssl x509 -noout -enddate
notAfter=Feb 18 15:41:26 2021 GMT
root@zen:/etc/letsencrypt/live/sico.sicosoft.es# 

cd /etc/dovecot/
ln -s /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem dovecot.pem
mv dovecot.pem dovecot.pem.orig
cd private/
mv dovecot.pem dovecot.pem.orig
ln -s /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem dovecot.pem

• RBL-check for vps.sicosoft.es (51.38.32.171)
• RBL-check for mail.sicosoft.es (83.48.87.215)

cd /etc/postfix
sed -i "s/2.136.41.224/83.48.87.215/g" main.cf
/etc/init.d/postfix restart
sed -i "s/2.136.41.224/83.48.87.215/g" /etc/default/iptables 
reboot

<code>
cat /etc/apache2/sites-available/default-ssl | grep -v "#.*" | expand | sed "s/ *\$//g" | grep . | grep SSLCertif
cd /etc/postfix
sed -i "s:smtpd_tls_cert_file =.*:smtpd_tls_cert_file = /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem:g" main.cf
sed -i "s:smtpd_tls_key_file =.*:smtpd_tls_key_file = /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem:g" main.cf
/etc/init.d/postfix restart

 sed -i s/ENABLED=0/ENABLED=1/g /etc/default/spamassassin

 /etc/init.d/spamassassin start

smtp      inet  n       -       -       -       -       smtpd -o content_filter=spamassassin
spamassassin unix -     n       n       -       -       pipe user=spamd argv=/usr/bin/spamc -f -e  /usr/sbin/sendmail -oi -f ${sender} ${recipient}

/etc/init.d/postfix restart

sed -i "/^message_size_limit/d" /etc/postfix/main.cf
echo "message_size_limit = 104857600" >> /etc/postfix/main.cf
/etc/init.d/postfix restart

ssh root@zen
su postgres
psql -l
psql -d vmail
select * from alias where address = 'saludsanchez@sicosoft.es' and domain = 'sicosoft.es';
update alias set goto = 'saludsd06@gmail.com' , domain = 'sicosoft.es' where address = 'saludsanchez@sicosoft.es' and domain = 'sicosoft.es';
select * from alias where address = 'saludsanchez@sicosoft.es';
commit;
\q
exit
exit

echo "metromadrid.es smtp:vps.sicosoft.es:25" >> /etc/postfix/transport
echo "contratas.metromadrid.es smtp:vps.sicosoft.es:25" >> /etc/postfix/transport
echo "sice.com smtp:vps.sicosoft.es:25" >> /etc/postfix/transport
echo "electren.com smtp:vps.sicosoft.es:25" >> /etc/postfix/transport
echo "sinergiasl.com smtp:vps.sicosoft.es:25" >> /etc/postfix/transport

postmap hash:/etc/postfix/transport
/etc/init.d/postfix restart

echo "eaguilera.es smtp:vps.sicosoft.es:25" >> /etc/postfix/transport
postmap hash:/etc/postfix/transport
/etc/init.d/postfix restart

echo "indra.es smtp:vps.sicosoft.es:25" >> /etc/postfix/transport
postmap hash:/etc/postfix/transport
/etc/init.d/postfix restart

echo "dragados.com smtp:vps.sicosoft.es:25" >> /etc/postfix/transport
postmap hash:/etc/postfix/transport
/etc/init.d/postfix restart

root@asterisk:~# cat renew-certbot.sh 
#!/bin/bash
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
n=`certbot certificates 2>/dev/null | grep "[^A-Z]VALID: [0-9]" | wc -l | tr -dc 0-9`
if [ "m$n" != "m1" ] ; then
        service nginx stop
        certbot renew
        service nginx start
        scp /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem root@zen:/etc/letsencrypt/live/sico.sicosoft.es/
        ssh root@zen "apache2ctl restart"
fi

        SSLCertificateFile /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem

        scp /etc/letsencrypt/live/sico.sicosoft.es/fullchain.pem /etc/letsencrypt/live/sico.sicosoft.es/privkey.pem root@zen:/etc/letsencrypt/live/sico.sicosoft.es/
        ssh root@zen "apache2ctl restart"

ssh root@zen
su postgres
psql -l
psql -d vmail
select * from alias where address = 'jjcriado@sicosoft.es' and domain = 'sicosoft.es';
select * from alias where address = 'saludsanchez@sicosoft.es' and domain = 'sicosoft.es';
update alias set goto = 'salud_sanchezd@yahoo.es' , domain = 'sicosoft.es' where address = 'saludsanchez@sicosoft.es' and domain = 'sicosoft.es';
select * from alias where address = 'saludsanchez@sicosoft.es';
commit;
update alias set goto = 'jesusjcriado@yahoo.es' , domain = 'sicosoft.es' where address = 'jjcriado@sicosoft.es' and domain = 'sicosoft.es';
select * from alias where address = 'jjcriado@sicosoft.es';
commit;
\q
exit
exit

ssh root@zen
su postgres
psql -l
psql -d vmail
select * from alias where address = 'jjcriado@sicosoft.es' and domain = 'sicosoft.es';
update alias set goto = 'jjcriado@sicosoft.es' , domain = 'sicosoft.es' where address = 'jjcriado@sicosoft.es' and domain = 'sicosoft.es';
select * from alias where address = 'jjcriado@sicosoft.es';
commit;
\q
exit
exit

dario@uiharu:~$ telnet imr.metromadrid.es 25
Trying 185.89.60.40...
Connected to imr.metromadrid.es.
Escape character is '^]'.
220 ESMTP IMSVA
HELO zen.sicosoft.es ESMTP Postfix (Debian/GNU)
250 imr-out.metromadrid.es
MAIL FROM:<javiersoler@sicosoft.es>
250 2.1.0 Ok
QUIT
221 2.0.0 Bye
Connection closed by foreign host.
dario@uiharu:~$ telnet imr.metromadrid.es 25
Trying 185.89.60.40...
Connected to imr.metromadrid.es.
Escape character is '^]'.
220 ESMTP IMSVA
HELO zen.sicosoft.es ESMTP Postfix (Debian/GNU)
250 imr-out.metromadrid.es
RCPT TO:<sonia.fernandez@metromadrid.es>
550 Service unavailable; Client Host [2.136.17.213] blocked using Trend Micro RBL+. Please see http://www.mail-abuse.com/cgi-bin/lookup?ip_address=2.136.17.213 
Connection closed by foreign host.
dario@uiharu:~$

root@zen:~# telnet imr.metromadrid.es 25
Trying 185.89.60.40...
Connected to imr.metromadrid.es.
Escape character is '^]'.
220 ESMTP IMSVA
HELO sicosoft.es
250 imr-out.metromadrid.es
MAIL FROM:<javiersoler@sicosoft.es>
250 2.1.0 Ok
QUIT
221 2.0.0 Bye
Connection closed by foreign host.

• qualify_domains era "salchicha.sicosoft.es", ahora es "sicosoft.es" (sin la comillas)
• local_domains era "localhost:salchicha.sicosoft.es", ahora es "" (sin las comillas)
• relay_domains estaba comentado, ahora está sin comentar y con el contenido "sicosoft.es".

root@zen:~# cd /etc/postfix/
root@zen:/etc/postfix# rgrep smtpd_banner .
./main.cf.2014.02.20.16.55.33:smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
./main.cf:smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
root@zen:/etc/postfix# sed -i "s/^smtpd_banner = .myhostname \(.*\)/smtpd_banner = sicosoft.es \1/g" ./main.cf
root@zen:/etc/postfix# rgrep smtpd_banner .
./main.cf.2014.02.20.16.55.33:smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
./main.cf:smtpd_banner = sicosoft.es ESMTP $mail_name (Debian/GNU)

su postgres
psql -l
psql -d vmail
update alias set goto = 'administracion@sicosoft.es' , domain = 'sicosoft.es' where address = 'administracion@sicosoft.es' and domain = 'sicosoft.es';
select * from alias where address = 'administracion@sicosoft.es';
commit;
\q
exit

mv sicosoft.es.2016.key sicosoft.es.2016.secure.key
openssl rsa -in sicosoft.es.2016.secure.key-out sicosoft.es.2016.key

mkdir t
cd t
unzip ../sicosoft.es.zip
mkdir other
cd other
unzip ../OtherServer.zip
cat  2_sicosoft.es.crt 1_Intermediate.crt root.crt > sicosoft.es.pem

uiharu:~/startcomssl-sicosoft.es/2016

cd /etc/ssl/private
mv iRedMail.key iRedMail.key.2015
scp dario@3.0.1.3:~/startcomssl-sicosoft.es/sicosoft.es.2016.key iRedMail.key
chown root:ssl-cert iRedMail.key
chmod 640 iRedMail.key
cd /etc/ssl/certs
mv iRedMail_CA.pem iRedMail_CA.pem.2015
scp dario@3.0.1.3:~/startcomssl-sicosoft.es/t/other/sicosoft.es.pem iRedMail_CA.pem
apache2ctl restart
/etc/init.d/postfix restart

./daemon.log:Jun 28 15:19:44 zen named[2475]: error (network unreachable) resolving 'achilles.com.dbl.spamhaus.org/A/IN': 2610:80:4:7:21e:68ff:fe65:5098#53
./daemon.log:Jun 29 10:34:16 zen named[2475]: error (network unreachable) resolving 'achilles.com.dbl.spamhaus.org/A/IN': 2610:80:4:7:21e:68ff:fe65:5098#53
./daemon.log:Jun 30 08:46:56 zen named[2475]: error (network unreachable) resolving 'achilles.com.dbl.spamhaus.org/A/IN': 2001:7b8:62b:0:400:d4ff:fe72:71ac#53
./daemon.log:Jun 30 08:46:56 zen named[2475]: error (network unreachable) resolving 'achilles.com.dbl.spamhaus.org/A/IN': 2001:610:511:194:194:104:0:140#53
./daemon.log:Jun 30 08:46:56 zen named[2475]: error (network unreachable) resolving 'achilles.com.dbl.spamhaus.org/A/IN': 2001:7c0:701:23::184#53
./daemon.log:Jun 30 08:46:56 zen named[2475]: error (network unreachable) resolving 'achilles.com.dbl.spamhaus.org/A/IN': 2610:80:4:7:21e:68ff:fe65:5098#53

# run resolvconf?
RESOLVCONF=no

# startup options for the server
OPTIONS="-u bind -4"

$ dig @dns1.nominalia.com MX sicosoft.es
...
sicosoft.es.            900     IN      MX      10 mail.sicosoft.es.
sicosoft.es.            900     IN      MX      20 mail2.sicosoft.es.
...
$ dig @dns2.nominalia.com MX sicosoft.es
...
sicosoft.es.            900     IN      MX      20 mail2.sicosoft.es.
sicosoft.es.            900     IN      MX      10 mail.sicosoft.es.
...

 /etc/default/bind9

postconf -e message_size_limit='104857600'
/etc/init.d/postfix restart
vi /etc/php5/apache2/php.ini

 /etc/init.d/bind9 restart

• Estado de dominio en red.es/dominios.es (sicososft.es DNS SERVERS: dns2.nominalia.com dns1.nominalia.com )
• Haciendo un dig desde fuera de la oficina:

memory_limit =  256M;
post_max_size = 100M;
upload_max_filesize = 100M;

cd /etc/postfix
echo "ignore_mx_lookup_error = yes" >> main.cf
echo "smtp_defer_if_no_mx_address_found = yes" >> main.cf
postfix reload

su postgres

 /etc/init.d/apache2 restart

 vi /etc/fail2ban/jail.conf

 :wq
 /etc/init.d/fail2ban restart

$ mysql -uroot -p
mysql> USE vmail;
mysql> INSERT INTO alias (address, goto, domain) values ('orig@domain.ltd', 'user01@gmail.com,user02@hotmail.com', 'domain.ltd');

• a todos los mensajes
• enviar copia a...
• guardar

/etc/init.d/exim4 stop
/etc/init.d/openbsd-inetd stop
cd /home/avisospci/
cat Elementos\ enviados | gzip -9 > Elementos\ enviados_backup_`date +%Y%m%d`-1.gz
mv Elementos\ enviados Elementos\ enviados.old
mboxgrep -H -v "^Date:.* 2014 " Elementos\ enviados.old > ../xavisospci2013/Elementos\ enviados
mboxgrep -H "^Date:.* 2014 " Elementos\ enviados.old > Elementos\ enviados
grep Elementos\ enviados .mailboxlist  >> ../xavisospci2013/.mailboxlist 
chown xavisospci2013:xavisospci2013 ../xavisospci2013/Elementos\ enviados 
chown xavisospci2013:xavisospci2013 ../xavisospci2013/.mailboxlist 
/etc/init.d/exim4 start
/etc/init.d/openbsd-inetd start

 psql -l

 psql -d vmail
 vmail=# select tablename from pg_tables;

 vmail=# \d alias;

 vmail=# select * from pg_tables where tablename = 'alias';

 vmail=# select * from alias where address = 'jjcriado@sicosoft.es' and domain = 'sicosoft.es';

 vmail=# update alias set goto = 'jesusjcriado@yahoo.es' , domain = 'sicosoft.es' where address = 'jjcriado@sicosoft.es' and domain = 'sicosoft.es';
 vmail=# select * from alias where address = 'jjcriado@sicosoft.es';

 vmail=# commit;

 vmail=# rollback;

 su postgres
 psql -d vmail
 select * from alias where address = 'jjcriado@sicosoft.es';
 update alias set goto = 'jesusjcriado@yahoo.es' where address = 'jjcriado@sicosoft.es';
 select * from alias where address = 'jjcriado@sicosoft.es';
 commit;

 /var/vmail/...

 find /var/vmail -exec chown vmail:vmail \{\} \;
 find /var/vmail -type d -exec chmod 0700 \{\} \;
 find /var/vmail -type f -exec chmod 0600 \{\} \;

• For MySQL backend, you can create new record in table "vmail". for example:

zen# /etc/init.d/exim4 stop
zen# /etc/init.d/openbsd-inetd stop
zen# cd /var/spool/mail
zen# cat avisospci | gzip -9 > avisospci_backup_`date +%Y%m%d`-1.gz
zen# mv avisospci avisospci.old
zen# mboxgrep -H -v "^Date:.* 2014 " avisospci.old > avisospci2013
zen# adduser avisospci2013
zen# chown avisospci2013:mail avisospci2013
zen# mboxgrep -H "^Date:.* 2014 " avisospci.old > avisospci
zen# chown avisospci:mail avisospci
zen# /etc/init.d/exim4 start
zen# /etc/init.d/openbsd-inetd start

 .mailboxlist
 Elementos enviados

zen# /etc/init.d/exim4 stop
zen# /etc/init.d/openbsd-inetd stop
zen# cat avisos | gzip -9 > avisos_backup_`date +%Y%m%d`-1.gz
zen# ps -efa | grep exim
zen# mv avisos avisos.old
zen# mboxgrep -H -v "^Date:.* 2012 " avisos.old > avisos2011
zen# mboxgrep -H "^Date:.* 2012 " avisos.old  > avisos
zen# chown avisos2011:mail avisos2011
zen# chown avisos:mail avisos
zen# /etc/init.d/exim4 start
zen# /etc/init.d/openbsd-inetd start

  deny message = HELO/EHLO $sender_helo_name  is locally blacklisted here. If you think this is wrong, get in touch with postmaster
       !acl = acl_whitelist_local_deny
       condition = ${if match_domain{$sender_helo_name}{realsocks.com}{yes}{no}}
       delay = 45s

• configurado el bind9 de internetti para que sirva el DNS de sicosoft.es
• sincronizada la configuración del maradns de database para que contenga los mismos datos que el bind9 de internetti
• se han modificado en nominalia los servidores DNS para que apunten a:

• se ha configurado el firewall de internetti para que forwardee smtp a zen preservando la ip de origen
• se ha cambiado el mailserver principal para que sea mail.sicosoft.es (internetti) y así el correo entre/salga por defecto usando la fibra (el adsl queda como "backup").

• Mejorar la script sustituta de /etc/init.d/networking para que soporte varias redes
• Poner el firewall /etc/init.d/firewall y hacer que se llame desde /etc/init.d/networking
• Instalar el bind9 (pero no se ha configurado aún para servir el dominio de sicosoft.es); para ello se ha montado / como rw, instalado el bind9, se ha parado el servidor, convertido el /var/cache/bind en bind-saved y creado un nuevo directorio bind con user:group root:bind, puesto en /sbin/init-ro y reiniciado el servicio.

uservacation:
  debug_print = "R: vacation for $local_part@$domain"
  driver = accept
  domains = +local_domains
  require_files = $home/.vacation
  check_local_user
  # do not reply to errors or lists
  condition =  ${if or { \
  {match {$h_precedence:} {(?i)junk|bulk|list}} \
  {eq {$sender_address} {}} \
  } {no} {yes}}
  # do not reply to errors or bounces or lists
  senders = ! ^.*-request@.*:\
  ! ^bounce-.*@.*:\
  ! ^.*-bounce@.*:\
  ! ^owner-.*@.*:\
  ! ^postmaster@.*:\
  ! ^webmaster@.*:\
  ! ^listmaster@.*:\
  ! ^mailer-daemon@.*:\
  ! ^root@.*
  no_expn
  transport = uservacation_transport
  unseen
  no_verify

uservacation_transport:
   driver = autoreply
   file = $home/.vacation
   file_expand
   once = $home/.vacation.db
   # to use a flat file instead of a db specify once_file_size
   once_file_size = 2K
   once_repeat = 14d
   from = $local_part@$domain
   to = $sender_address
   subject = "Re: $h_subject"

 zen:/etc/exim4# exim4 -bV | tail -1
 Configuration file is /etc/exim4/exim4.conf

 /etc/exim4/conf.d/router/601_exim4-config_vacation
 /etc/exim4/conf.d/transport/30_exim4-config_vacationtransport

zen# adduser avisos2010
zen# cd /var/spool/mail
zen# /etc/init.d/exim4 stop
zen# /etc/init.d/openbsd-inetd stop
zen# cat avisos | gzip -9 > avisos_backup_`date +%Y%m%d`-1.gz
zen# mv avisos avisos2010
zen# chown avisos2010:mail avisos2010
zen# /etc/init.d/exim4 start
zen# /etc/init.d/openbsd-inetd start

zen# adduser avisos2009
zen# cd /var/spool/mail
zen# cat avisos | gzip -9 > avisos_backup_`date +%Y%m%d`-1.gz
zen# mboxgrep -H -v "^Date:. 2010 " > avisos2009
zen# chown avisos2009:mail avisos2009
zen# /etc/init.d/exim4 stop
zen# pkill exim4
zen# mv avisos avisos.old
zen# mboxgrep -H "^Date:.* 2010 " avisos.old  > avisos
zen# chown avisos:mail avisos
zen# /etc/init.d/exim4 start

 exim -d -bt luislorido@sicosoft.es

.forward

#!/bin/sh
cd /var/spool/mail/backup
for i in 0 1 2 3 4 5 6 7 8 ; do
        if [ -e avisos.${i}.bz2 ] ; then
                mv avisos.${i}.bz2 avisos.$(( $i + 1 )).bz2
        fi
done
cat ../avisos | bzip2 -9 > avisos.0.bz2

 /etc/rcS.d/S56trikled_sico

# cd /usr/sbin
# mv exim4 exim4.real
# echo '#!/bin/sh' > exim4
# echo 'exec /usr/bin/trickle /usr/sbin/exim4.real "$@"' >> exim4
# chmod a+x exim4

 whitelist_from com-incidencias@infoglobal.es

/var/spool/mail/backup/backup-mail.sh

# exim4 -bV | tail -1
Configuration file is /etc/exim4/exim4.conf

 local_scan_path = /usr/lib/exim4/local_scan/sa-exim.so

1. Actualizar el /etc/apt/sources.list
2. Añadir la clave de debian (ver Secure-apt en debian etch)
3. Actualizar la lista de paquetes ("aptitude update")
4. instalar el aptitude y dpkg nuevos ("aptitude install aptitude dpkg")
5. Hacer el upgrade ("aptitude dist-upgrade")
6. Para el caso de etch, instalar el núcleo otra vez ("aptitude install linux-image-686")
7. Reiniciar y comprobar que se sigue recibiendo correo en SICO (mandar un correo desde un webmail a una cuenta de SICO).

/etc/maradns/mararc (cuidado con los ENTER añadidos a las listas de IP)

/etc/maradns/db.sicosoft.es

/etc/maradns/db.chapirina.es

# Para todo lo aceptado que haya que rutar, hacemos masquerading
$IPTABLES -t nat -A POSTROUTING -j MASQUERADE

1. Instalar el stunnel.exe
2. Configurar el C:\Archivos de Programa\STunnel\ el stunnel.conf con lo siguiente (sacado de aquí):

   client = yes debug = debug [pop3s] accept = 127.0.0.1:110 connect = mail2.sicosoft.es:995

3. Ejecutar en dicho directorio el
   stunnel install
4. Reiniciar la máquina
5. Configurar el cliente de correo para que se conecte a 127.0.0.1 puerto 110

Subject: Sender timeout errors occur in Barracuda log.
Categories: Troubleshooting, Barracuda Spam Firewall
Observerd: Customers Barracuda Spam Firewall log showed occasional "Sender timeouts" in the log file. Symptom was some users were unable to receive email from certain sites. Problem resolved by replacing older DLink router with a new Sonicwall. Barracuda tech support had tunneled in and confirmed Barracuda was not the issue. Lesson learned was look at the age and capabilities of the router as a possible issue with "sender timeouts".
Author: Gary Lamagna/TENCorp
Composed: 08/01/2006 11:17 AM

You'll find a router for doing the relaying according to mx records similar to this:

dnslookup:
   debug_print              = "R: dnslookup for [EMAIL PROTECTED]"
   driver                   = dnslookup
   domains                  = ! +local_domains
   transport                = remote_smtp
   same_domain_copy_routing = yes
 no_more

You want to stick a smarthost router in front of that which delivers to a specific host on certain conditions. The one below would route all mail for [EMAIL PROTECTED] that originated from 123.123.123.123 to the mx server "the.mx.server" directly:

smarthost:
   debug_print = "R: smarhost for [EMAIL PROTECTED]"
   driver      = manualroute
   condition   = ${if and{\
                    {eq{$sender_host_address}{123.123.123.123}}\
                    {eq{$local_part}{foo}}\
                    {eq{$domain}{bar}}\
                 }}
   route_list  =  "the.mx.server"

Hopefully that should give you a basis to work from.

1. Actualizar seraphim a sarge (cambiando el sources.list y haciendo el apt-get update, haciendo un apt-get de aptitude, y después un aptitude dist-upgrade hasta que el sistema era un sarge razonable). Esto es lo que hice ayer.
2. Cambiar el núcleo al 2.6.16.2 (el de etch), cogido de seraphim:/etch/boot/*2.6.16* y /lib/modules/*2.6.16*).
3. Desactivar el firewall.sico
4. Poner los latiguillos como corresponde a la nueva manera en que reconoce las tarjetas (ahora el eth0 es la intel integrada en placa, y la realtek del extremo de la caja es la eth2).
5. Instalar grub y desinstalar lilo.
6. Copiar el /boot/grub de seraphim:/etch/boot/grub y reconfigurar el menu.lst. Instalar el gestor de arranque en el disco (grub --no-floppy; root (hd0,0) ; setup (hd0)).
7. Copiar el /dev/ de un etch (haciendo un tar, rebotando y arrancando con un disquette de tomsrtbt, mkdir /tmp/root ; mount -t etc2 /dev/hda6 /tmp/root ; moviendo el antiguo dev a dev.orig y poniendo el descomprimido del tar en /, desmontando el /tmp/root y rebotando), ya que si no, no funcionan los logins :-?.
8. Cambiar el sources.list a etch y hacer un apt-get update y un aptitude install modutils module-init-tools para que sea capaz de hacer el depmod -a de un núcleo tan moderno (sarge no es capaz).
9. Poner el firewall.sico de iptables en vez del de ipchains.
10. instalar el isdnutils de etch y cambiar el isdn-sanitize.sh para que cargue el módulo pasándole expresamente los valores del tipo de tarjeta ("insmod /lib/modules/2.6.16-2-686/kernel/drivers/isdn/hisax/hisax.ko type=36 protocol=2").
11. Instalar el rinetd y configurar en el /etc/rinetd.conf todas las redirecciones de puertos que necesito (lo que antes estaba en las scripts de /etc/network/if-up.d)
12. Hacer que el vtun vuelva a funcionar creando el dispositivo que necesita ("mkdir /dev/net ; mknod /dev/net/tun c 10 200"), tal y como indican en las instrucciones de /usr/share/doc/vtun/README.Debian. Por último. reiniciar el servicio vtun con un /etc/init.d/vtun restart, y con eso también funcionan los túneles a los sitios remotos ;-).

1. Cambiar el relay from_hosts y añadir un dont_relay_from_hosts:
   

   .ifndef MAIN_RELAY_NETS MAIN_RELAY_NETS = DEBCONFrelay_netsDEBCONF .endif #hostlist relay_from_hosts = 127.0.0.1 : ::::1 : MAIN_RELAY_NETS hostlist relay_from_hosts = <; 127.0.0.1 ; 192.168.2.0/24 hostlist dont_relay_from_hosts = <; 192.168.2.1/32

2. Añadir a la parte del acl_check_rcpt:, un
   

   deny hosts = +dont_relay_from_hosts   accept     hosts = +relay_from_hosts

1. mover el db.sicosoft a db.sicosoftes
2. copiar db.sicosoftes a db.sicosoftcom y lo he editado con los valores razonables.
3. He añadido a named.conf la db.sicosoftcom y he renombrado la referencia de sicosoft a sicosoftes

 # mv /lib/tls /lib/tls.disabled
 # ldconfig

• zen:/etc/exim4/conf.d/main/02_exim4-config_options Descomentado el allow_domein_literals
• zen:/etc/exim4/conf.d/router/100_exim4-config_domain_literal Descomentado todo lo de este router

• Xen user's manual
• Xen demo LiveCD
• Pre-canned virtual machines for Xen (FreeBSD, NetBSD, Debian)
• Images of popular distros for Xen
• Xen wiki
• Xen mailinglists
• Intel Vanderpool/VT (equ to AMD Pacifica) articles: one, two, three

 $ cd
 $ echo ni_direccion@algunsitio.com > .forward

• Redundant Internet Connections Using Linux.
• Balanceo de Carga

• Cómo probar el servidor (ext. link) Básicamente es "EHLO localhost.localdomain" "MAIL FROM:nobody@somewhere.com" "RCPT TO:alli@somewhere.else.com" "DATA" "QUIT".

Según este mensaje y este otro, la cosa se hace así ("ipmasqadm portfw -h" para ayuda):

# /usr/sbin/ipmasqadm portfw -a -P tcp -L 212.x.x.x 3389 -R 192.168.1.1 3389

Y requiere tener en el kernel compilado lo siguiente:

CONFIG_KMOD=y
CONFIG_IP_MASQUERADE_MOD=y
CONFIG_IP_MASQUERADE_IPPORTFW=m

PERO eso no funcionará Según el FAQ el soporte de ipchains en los kernel 2.4 se limita a forwarding; no hace "mangling" de protocolos en el MASQ (p.ej. ftp no funciona en modo activo) y no soporta port forwarding.

Solución: Seguir el IP Masquerade Howto y reescribir el firewall de sico (<sigh>).

• acregidor
• anaregidor
• beatrizfernandez
• carlosculebras
• maytecriado
• mcriado
• dariorodriguez
• evaregidor
• ggonzalez
• javiersoler
• jjcriado
• luislorido
• miguelarmenteros
• rarias

; BIND data file for sicosoft.es network
;
$ORIGIN sicosoft.es.
$TTL    86400
@       IN      SOA     dns1.sicosoft.es. hostmaster.sicosoft.es. (
                        2005031601      ; Serial
                         21600          ; Refresh
                          3600          ; Retry
                        7d              ; Expire
                         86400 )        ; Negative Cache TTL
;
        IN      NS      dns1.sicosoft.es. ; portalico
        IN      NS      dns2.sicosoft.es. ; guagua
;
        IN      MX      10      mail.sicosoft.es.
        IN      MX      20      mail2.sicosoft.es.
;
                IN      A       80.59.237.208
dns2            IN      A       80.28.28.209
portalico       IN      A       80.59.237.208
guagua          IN      A       80.28.28.209
internetti      IN      A       213.97.190.112
sico1           IN      A       80.37.72.170
sico2           IN      A       80.37.72.228
;
dns1            IN      CNAME   portalico
;dns2            IN      CNAME   guagua
mail            IN      CNAME   sico1
mail2           IN      CNAME   sico2

• Página principal del proyecto Xen
• Artículo de O'reilly sobre Xen
• XenSource Compañía que proporciona servicios sobre Xen

• El servidor de correo en la parte segura (en la LAN, protegido por el firewall)
• En el DMZ se pone un relay de correo (y el servidor web, y el escáner de virus de correo...), qu elo único que hace es pasárselo al servidor "de dentro". Así, si entran en ese ordenador, no tienen el correo almacenado de la gente (ni entrantes ni salientes).

• se pueden poner tantos A como se quieran. El poner A o CNAMES es una mera razón administrativa (si cambia una IP y lo tienes con A, lo tienes que cambiar en todos los A, mientras que si sólo tienes una A y el resto son CNAMES, sólo lo cambiarías en el A).
• el nombre que va detrás del CNAME no tiene por qué pertenecer a tu propia red
• en el registro MX hay que poner el nombre al cual resuelve inversamente, por raro que sea, o si no algunos servidores de correo van a rechazar el correo de él
• es conveniente poner un CNAME al servidor de correo para que los usuarios de la parte segura (LAN detrás del firewall) puedan poner ese nombre en vez del nombre "inmemorizable" que has puesto en el MX.

zone "sicosoft.es" {
        type master;
        file "/etc/bind/db.sicosoft";
        allow-update { none; };

; BIND data file for sicosoft.es network
;
$ORIGIN sicosoft.es.
$TTL    86400
@       IN      SOA     dns1.sicosoft.es. hostmaster.sicosoft.es. (
                        2005020801      ; Serial
                         21600          ; Refresh
                          3600          ; Retry
                        7d              ; Expire
                         86400 )        ; Negative Cache TTL
;
        IN      NS      dns1.sicosoft.es. ; portalico
        IN      NS      dns2.sicosoft.es. ; guagua
;
        IN      MX      10      mail.sicosoft.es.
;
                IN      A       80.59.237.208
dns2            IN      A       80.28.28.209
portalico       IN      A       80.59.237.208
guagua          IN      A       80.28.28.209
internetti      IN      A       213.97.190.112
;
dns1            IN      CNAME   portalico
;dns2            IN      CNAME   guagua
mail            IN      CNAME   internetti

Descripción del proyecto

• Panel de administración del correo>https://zen.sicosoft.es

• www.anti-abuse.org/multi-rbl-check/: 
• mxtoolbox

Link to this Page

• Seguridad en sico last edited on 14 January 2025 at 8:29:51 am by 3.0.1.3