I have setup my DNS server for DNSSEC + DANE. I am using inline signing
on Bind9 and it appears to be working for HTTPS access.
I have a minor problem with key rolling, it seems to be a rather
cumbersome process at the moment, but I suspect that it is me rather
than the process.
Having got it working for HTTPS, I felt that I could move on to
implementing it for SMTP (Postfix).
First question is how do I test it to determine if it is working or not?
The testing I have done to date seems to indicate that it is not
working, but I am not sure why not?
/Log file output/
===============
Dec 30 19:16:33 bilbo postfix/smtpd[3366]: connect from
mail-la0-x22c.google.com[2a00:1450:4010:c03::22c]
Dec 30 19:16:35 bilbo postfix/smtpd[3366]: 30CFB36401D2:
client=mail-la0-x22c.google.com[2a00:1450:4010:c03::22c]
Dec 30 19:16:35 bilbo postfix/cleanup[3375]: 30CFB36401D2:
message-id=<camueqxkcnj7ftrqdi8bgyc9fpp8kkw82zom_l4m3fdugxct...@mail.gmail.com>
Dec 30 19:16:35 bilbo postfix/qmgr[3359]: 30CFB36401D2:
from=<zzz2...@gmail.com>, size=2238, nrcpt=1 (queue active)
*Dec 30 19:16:35 bilbo postfix/smtp[3376]: warning: [127.0.0.1]:10024:
dane configured with dnssec lookups disabled*
Dec 30 19:16:35 bilbo postfix/smtpd[3366]: disconnect from
mail-la0-x22c.google.com[2a00:1450:4010:c03::22c]
Dec 30 19:16:40 bilbo postfix/smtpd[3381]: connect from localhost[127.0.0.1]
Dec 30 19:16:40 bilbo postfix/smtpd[3381]: 61EB336401EC:
client=localhost[127.0.0.1]
Dec 30 19:16:40 bilbo postfix/cleanup[3382]: 61EB336401EC:
message-id=<camueqxkcnj7ftrqdi8bgyc9fpp8kkw82zom_l4m3fdugxct...@mail.gmail.com>
Dec 30 19:16:40 bilbo postfix/smtpd[3381]: disconnect from
localhost[127.0.0.1]
Dec 30 19:16:40 bilbo postfix/qmgr[3359]: 61EB336401EC:
from=<zzz2...@gmail.com>, size=2762, nrcpt=1 (queue active)
Dec 30 19:16:40 bilbo postfix/smtp[3376]: 30CFB36401D2:
to=<postmas...@klam.ca>, relay=127.0.0.1[127.0.0.1]:10024, delay=5.5,
delays=0.52/0.01/0.01/4.9, dsn=2.0.0, status=sent (250 2.0.0 from
MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 61EB336401EC)
Dec 30 19:16:40 bilbo postfix/qmgr[3359]: 30CFB36401D2: removed--
===============
Does the line I have highlighted indicate that DANE I being disabled
because of AMAVIS, if so how do I ensure that it only disabled on the
internal network.
John Allen
KLaM
------------------------------------------
A day without sunshine is like, night?
; zone file for klam.ca
$ORIGIN klam.ca.
$TTL 1H
@ IN SOA ns0.klam.ca. admin.klam.ca. 2014123005
4H 1H 2W 1H
IN NS ns0.klam.ca.
IN NS ns1.klam.ca.
ns0 IN A 74.116.186.178
IN AAAA 2001:470:b183:10::178
ns1 IN A 74.116.186.186
IN AAAA 2001:470:b183:10::186
@ IN A 74.116.186.178
IN AAAA 2001:470:b183:10::178
@ IN MX 10 smtp.klam.ca.
@ IN TXT "v=spf1 a mx ptr ip4:74.116.186.178
ip6:2001:470:b183:10::178 mx:smtp.klam.ca. -all"
@ IN NSEC3PARAM 1 0 10 8f2b679412956535
dkim._domainkey IN TXT "v=DKIM1;
p=M..........................QAB"
_25._tcp.smtp IN TLSA ( 3 0 1
5b............................................................ab )
_587._tcp.smtp IN TLSA ( 3 0 1
5b............................................................ab )
_443._tcp.www IN TLSA ( 3 0 1
14............................................................d1 )
_443._tcp.dav IN TLSA ( 3 0 1
14............................................................d1 )
_443._tcp.davical IN TLSA ( 3 0 1
14............................................................d1 )
smtp IN A 74.116.186.178
IN AAAA 2001:470:b183:10::178
sieve IN A 74.116.186.178
IN AAAA 2001:470:b183:10::178
imap IN A 74.116.186.178
IN AAAA 2001:470:b183:10::178
www IN A 74.116.186.179
IN AAAA 2001:470:b183:10::179
postfixadmin IN A 74.116.186.179
IN AAAA 2001:470:b183:10::179
pgadmin IN A 74.116.186.179
IN AAAA 2001:470:b183:10::179
filelink IN A 74.116.186.179
IN AAAA 2001:470:b183:10::179
dav IN A 74.116.186.180
IN AAAA 2001:470:b183:10::180
carddav IN A 74.116.186.181
IN AAAA 2001:470:b183:10::181
calendar IN A 74.116.186.181
IN AAAA 2001:470:b183:10::181
davical IN A 74.116.186.181
IN AAAA 2001:470:b183:10::181
readme_directory = /usr/share/doc/postfix
html_directory = /usr/share/doc/postfix/html
biff = no
append_dot_mydomain = no
mydomain = klam.ca
myorigin = $mydomain
myhostname = smtp.$mydomain
mydestination = localhost, localhost.localdomain, localdomain
mynetworks = 127.0.0.0/8, 192.168.0.0/16, [::1]/128, [2001:470:b183:30::]/64
alias_maps = hash:/etc/aliases
relocated_maps = hash:/etc/postfix/maps/relocated
recipient_delimiter = +
home_mailbox = Maildir/
message_size_limit = 32768000
bounce_size_limit = 65536
header_size_limit = 32768
delay_warning_time = 12h
default_process_limit=20
smtpd_recipient_limit = 128
smtpd_error_sleep_time = 5s
smtpd_banner = $myhostname ESMTP
mailbox_transport = lmtp:unix:private/dovecot-lmtp
transport_maps = hash:/etc/postfix/maps/transport
vacation_destination_recipient_limit = 1
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $mydomain
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtp_use_tls = yes
smtp_dns_supporta_level = dnssec
smtp_tls_security_level = dane
smtp_tls_note_starttls_offer = yes
smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
smtp_tls_cert_file = /root/ssl/certs/klam_mail.pem
smtp_tls_key_file = /root/ssl/private/klam_mail.key
smtp_tls_enforce_peername = no
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_loglevel = 1
smtpd_use_tls = yes
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_ask_ccert = yes
smtpd_tls_req_ccert = no
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_cert_file = /root/ssl/certs/klam_mail.pem
smtpd_tls_key_file = /root/ssl/private/klam_mail.key
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
virtual_mailbox_domains = proxy:pgsql:/etc/postfix/sql/virtual_domain_map.sql
virtual_alias_maps = proxy:pgsql:/etc/postfix/sql/virtual_alias_map.sql,
proxy:pgsql:/etc/postfix/sql/virtual_alias_domain_map.sql
virtual_mailbox_maps = proxy:pgsql:/etc/postfix/sql/virtual_mailbox_map.sql,
proxy:pgsql:/etc/postfix/sql/virtual_alias_domain_mailbox_map.sql
virtual_transport = lmtp:unix:private/dovecot-lmtp
content_filter = smtp-amavis:[127.0.0.1]:10024
smtpd_helo_required = yes
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
smtpd_etrn_restrictions = reject
smtpd_client_restrictions =
smtpd_helo_restrictions =
smtpd_sender_restrictions =
smtpd_relay_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination
smtpd_recipient_restrictions =
reject_invalid_hostname,
reject_non_fqdn_hostname,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
check_recipient_access
pcre:/etc/postfix/maps/recipient_checks.pcre,
check_recipient_access hash:/etc/postfix/maps/recipient_checks,
check_helo_access pcre:/etc/postfix/maps/helo_checks.pcre,
check_sender_access hash:/etc/postfix/maps/sender_checks,
reject_rbl_client zen.spamhaus.org,
reject_rbl_client bl.spamcop.net,
check_policy_service inet:127.0.0.1:10023
smtpd_data_restrictions =
reject_multi_recipient_bounce,
reject_unauth_pipelining
#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - n - - smtpd
-o cleanup_service_name=pre-cleanup
pickup fifo n - n 60 1 pickup
-o cleanup_service_name=pre-cleanup
submission inet n - n - 30 smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_connection_count_limit=15
-o smtpd_client_connection_rate_limit=80
-o smtpd_delay_reject=yes
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
-o cleanup_service_name=pre-cleanup
qmgr fifo n - n 300 1 qmgr
tlsmgr unix - - n 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - n - - smtp
-o smtp_bind_address=74.116.186.178
-o smtp_bind_address6=2001:470:b183:10::178
relay unix - - n - - smtp
showq unix n - n - - showq
error unix - - n - - error
retry unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
smtp-amavis unix - - n - 4 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o smtp_tls_note_starttls_offer=no
-o max_use=20
127.0.0.1:10025 inet n - n - - smtpd
-o content_filter=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o smtpd_restriction_classes=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o local_header_rewrite_clients=
-o local_recipient_maps=
-o
receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
-o smtpd_tls_security_level=none
-o local_recipient_maps=
-o relay_recipient_maps=
pre-cleanup unix n - n - 0 cleanup
-o virtual_alias_maps=
cleanup unix n - n - 0 cleanup
-o mime_header_checks=
-o nested_header_checks=
-o header_checks=
-o body_checks=
vacation unix - n n - - pipe
flags=DRhu user=vacation argv=/var/spool/vacation/vacation.pl -f ${sender}
-- ${recipient}
