This section is being redacted

Some personnal advices about milters and mail filters:

• DO use Unix sockets instead of Inet ones: Unix sockets use less ressources and are faster because of the internal components involved (inet sockets uses IP & TCP, which generate some overhead. Even if you use inet socket, you may not sense a difference if you don't generate a lot of trafic).
• Prefer use of milters over classic content filters: configuration may be more tricky sometimes, but it is worth its weight in gold if you don't have advanced filtering to do. Amavis is heavy, and basic filtering can be handled by maildrop (configuration will be done after this).

Natively available in the wheezy repository, this milter configuration is a bit tricky. To begin the install process, type the following commands.

apt-get install spf-milter-python
mkdir -p /var/spool/postfix/var/run/spf-milter-python
chown spf-milter-python:spf-milter-python /var/spool/postfix/var/run/spf-milter-python
ln -s /var/spool/postfix/var/run/spf-milter-python /var/run/spf-milter-python
adduser postfix spf-milter-python

Change the socket name as follow in /etc/spf-milter-python/spfmilter.cfg

socketname = /var/run/spf-milter-python/spfmilter.sock

Edit /etc/init.d/spf-milter-python to add the following lines after the “start-stop-daemon” commands in sections start and restart. Replace the socket definition by SOCKET=$RUNDIR/spfmilter.sock, and

        sleep 5
        chmod g+w $SOCKET

Restart the spf-milter-python service.

Add the milter socket unix:/var/run/spf-milter-python/spfmilter.sock in /etc/postfix/main.cf (an example is given below):

smtpd_milters = unix:/var/run/spf-milter-python/spfmilter.sock

You must put this filter before opendmarc (DMARC validation won't be done if you don't do it), and you should put it before spamass-milter socket (SPF validation contributes to spam flagging).

This part has been inspired by the following tutorial: Guide to Install OpenDKIM for multiple domains with Postfix and Debian

To begin with, type

apt-get install opendkim opendkim-tools
adduser postfix opendkim
mkdir -p /var/spool/postfix/var/run/opendkim/
chown opendkim:opendkim /var/spool/postfix/var/run/opendkim/

Edit /etc/default/opendkim to set the socket as follow:

SOCKET="local:/var/spool/postfix/var/run/opendkim/opendkim.sock"

Edit /etc/opendkim.conf and add the following lines:

KeyTable                /etc/opendkim/KeyTable
SigningTable            /etc/opendkim/SigningTable
ExternalIgnoreList      /etc/opendkim/TrustedHosts
InternalHosts           /etc/opendkim/TrustedHosts

In the same file, edit the socket permission mask as follow:

UMask 0002

You should uncomment/add the following lines to get some debugging informations.

Syslog yes
LogWhy yes

Check also that the line OversignHeaders From is uncommented, then save and close the file.

Next step is to generate the DKIM keys that will be used to sign the mails going out of your domains. The following commands are given for domain.com:

mkdir -p /etc/opendkim/keys/mydomain.com
cd /etc/opendkim/keys/mydomain.com
opendkim-genkey -b 3072 -r -d mydomain.com
chown opendkim:opendkim default.private

Then add the following line to /etc/opendkim/KeyTable:

default._domainkey.mydomain.com mydomain.com:default:/etc/opendkim/keys/mydomain.com/default.private

and the following line in /etc/opendkim/SigningTable:

mydomain.com default._domainkey.mydomain.com

You will find the appropriate record in /etc/opendkim/keys/mydomain.com/default.txt. You should secure your DNS zone with DNSSEC to enhance your immunity to DNS records spoofing. Start opendkim service and double-check that it is started at each reboot.q

Add the milter socket unix:/var/run/spf-milter-python/spfmilter.sock in /etc/postfix/main.cf (an example is given below) in both smtpd_milters and non_smtpd_milters section (e.g below):

smtpd_milters = unix:/var/run/spf-milter-python/spfmilter.sock unix:/var/var/run/opendkim/opendkim.sock
non_smtpd_milters = unix:/var/var/run/opendkim/opendkim.sock

You must put this filter before opendmarc (DMARC validation won't be done if you don't do it), and you should put it before spamass-milter socket (DKIM validation contributes to spam flagging).

DMARC is a technical specification that enables you fight the spam more efficiently. It enables:

• A security policy enforcement (quarantine or reject) when a DMARC-compliant server receives fraudulent email (detected using SPF policy violation or DKIM signature failure) from a DMARC enabled domain.
• Collecting feedback data. This is pretty useful to identify from where threats come from, and to set up a mitigation policy.

The stable version of this module is in debian unstable repository. Enable the unstable repository (and pin it to avoid an upgrade to unstable).

apt-get install -t unstable opendmarc

Installing maildrop

apt-get install maildrop
chmod +s /usr/bin/maildrop

/etc/postfix/master.cf

maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop
   -d ${user}@${domain} ${user} ${domain} ${extension} ${nexthop} ${sender}

/etc/postfix/main.cf

virtual_transport = maildrop
maildrop_destination_recipient_limit = 1

/etc/maildroprc

# Global maildrop filter file

# Uncomment this line to make maildrop default to ~/Maildir for
# delivery- this is where courier-imap (amongst others) will look.
logfile "/var/log/maildrop.log"
#log " Arguments: '$1' '$2' '$3' '$4' '$5' '$6' '$7'"

#
# Set up some environment variables
# ${user} ${domain} ${extension} ${nexthop} ${sender}
#
SHELL="/bin/sh"
import EXT
import HOST

MAILADDR="$1@$2"
USERNAME="$1"
DOMAIN="$2"
EXTENSION="$3"
NEXTHOP="$4"
SENDER="$5"

#
# Environment setup
#
MAILROOT="/home/vmail"
DEFAULT="/home/vmail/$DOMAIN/$USERNAME"

#
# Filtering rules
#

# Mail is a spam
if( /^X-Spam-Status: Yes/)
{
    to "$DEFAULT/.Junk/"
}

# Attempt extension filtering
if( $EXTENSION =~ /^.+/ )
{
    if( $EXTENSION =~ /\.\./)
    {
        log "'..' pattern forbidden for security reasons."
    }
    else
    {
        `test -d $DEFAULT/.$EXTENSION`
        if( $RETURNCODE == 0 )
        {
            to "$DEFAULT/.$EXTENSION/"
        }
    }
}

# Default storage
to "$DEFAULT/"