Email. One of those things which is critical to business and depending on what you read and who you speak to, you may be led to believe that it is dying out in favour of instant messaging technologies. Well, as of right now, I can’t see it dying out any time soon, though it does come with a really annoying, frustrating, excruciating problem. Junk mail! Otherwise know as spam! It has once again become a bit of a problem for me, especially when the likes of yahoo begin to imped the flow of emails leaving one of the servers I have worked on recently unable to send emails to recipients with Yahoo accounts.
Now, don’t get my wrong. I don’t hold a grudge with any of the large email service providers for blocking spam which has sadly managed to be sent via a mail server I have some involvement with, but I do wish the world wasn’t such a bad place that we have to continuously fight on our email frontiers to protect our virtual/real name and brand.
So anyway. On with the show
- CentOS 7
- Patched to the nines
- Courier MTA
- Blocking of known spammers was enabled
- Spamassassin was used as a secondary measure should the hard blocks fail
- SPF is configured for all hosted domains
- DKIM was not configured
- DMAC was not configured
- It *was not* an open relay
- The time was not in sync, which didn’t help later down the line
The server’s “reputation” had been tarnished as someone had managed to start sending spam via the server through a vulnerability which was found in one of the websites hosted on the server.
After reviewing the advice from Yahoo, I started my investigation on how to approach this topic.
A bit of googling, led me to this web site; https://www.strangeworld.com/blog/archives/128. Now for me, there were a few things missing in the instructions, though complete were it was most needed. So recreating some of the good work done on the strangeworld.com website and providing my own twist on things here;
DKIM & ZDKIMFILTER Pre-requisites
In order to install zdkimfilter you need to manually compile the code and install (a .spec file will be included in future releases which should mean you can just use rpmbuild to create the RPM package for you). The machine I needed to install this onto did not have any compilers install for reasons of security, and so my list of pre-requisites was rather long and included more than I would have liked but needs must, and the compilers were removed afterwards. But anyway, here is the list of commands issued to get everything where it needed to be;
sudo rpm -ivh http://www.elrepo.org/elrepo-release-7.0-2.el7.elrepo.noarch.rpm sudo yum install gcc sudo yum install openssl-libs openssl-devel sudo yum install libopendkim opendkim sudo yum install libtool libidn2 libidn2-devel sudo yum install opendbx-devel opendbx-mysql opendbx-utils opendbx
Note. The addition of the elrepo.org rpm is required as there are a couple of dependencies, which don’t appear to be available in the main CentOS yum repository.
Download, compile and install
Now, the original instructions I followed, (see reference material at bottom of this page), took me through the steps of manually compiling the code for and installing opendkim. After I had installed it, I found that opendkim is available in the CentOS base yum repo and so I could have avoided that step. You will be pleased to hear that I have not included those steps here (if you do need to know though, see this blog post – strangeworld.com).
Next up we need to obtain the tar ball containing the source code for zdkimfilter, which was downloaded from; http://www.tana.it/sw/zdkimfilter/. At the time of writing the current version was v1.5.
Now we have that lets work through the process of compiling and installing it.
wget http://www.tana.it/sw/zdkimfilter/zdkimfilter-1.5.tar.gz tar zxvf zdkimfilter-1.5.tar.gz cd zdkimfilter-1.5 ./configure --prefix=/usr/local make -j4 sudo make install
Last on the list of installation steps is configuring zdkimfilter and making sure we have the correct directory structure, etc;
cp /etc/courier/filters/zdkimfilter.conf.dist /etc/courier/filters/zdkimfilter.conf mkdir /etc/courier/filters/keys chmod u=rwx,g=rw,o-rwx /etc/courier/filters/keys
Nothing more was needed at this time.
Generate some keys and update your DNS zones
At this point, we should have everything installed and configured that we need, and can now proceed with the steps for generating the necessary private keys which will be used to sign our emails as they leave your courier email server and also the public key that will be published in DNS.
A word of warning. Not sure how important this is, but when looking at generating the keys using opendkim-genkey, I would advise that you choose your selector name carefully. Initially I set this to be the same as the domain. I then went to a couple of dkim testing websites and found that one of them didn’t like the “.” (dot) in the separator name. At this point I changed my plan slightly (in case this was a more wide spread issue) and made sure there were no periods in the separator name.
cd /etc/courier/filters/keys/ opendkim-genkey -b 2048 -d tobyheywood.com -D /etc/courier/filters/keys -s tobyheywood -r -nosubdomains -v ln -s tobyheywood tobyheywood.com chown root.daemon tobyheywood.* (Just making sure ownership is correct) chmod u=rw,g=r,o-rwx tobyheywood.* (this will change the permissions on the tobyheywood.private file which contains the private key, and the tobyheywood.txt file which contains the public key)
It’s also worth making sure the directory /etc/courier/filters/keys has the right permissions;
chmod u=rwx,g=rx,o-rwx /etc/courier/filters/keys
And also if you are running SELinux, then it is worth double checking the SELinux security context associated with these newly created files. In my case, I didn’t have to do anything, but best to check.
Now you need to update your DNS zone file(s) with everything in the .txt file up to the last “)”. You could include the rest if you wish, but it’s purely a comment. Reload you zone and test.
Testing, testing, 1, 2, 3
I performed two types of test. The first was to make sure the record was returned correctly when queried by third parties and that there were no issues with the DNS side of things. The website I preferred was; https://www.mail-tester.com/spf-dkim-check as it was a nice and simple site and worked better than the unnamed first site I tried.
The second part of my test, was to send an email to a yahoo or gmail account to confirm that it was accepted and so that I could review the headers. This turned out to be a very good move! The headers of my first test emails showed there was no DKIM key present, which I thought was odd, but that was due to the umask and the keys directory didn’t have the execute bit set for group members. I have corrected this in the above [rough] instructions.
Another attempt at sending an email showed there was a valid key but that the time on this server was ahead by some 6 minutes. I then found that NTP hadn’t been enabled and so had to enable this in order to get the time aligned with other servers on the Internet.
My last test email, was a complete success. The headers showed that everything was as it should be. The DKIM signature had been accepted.
The next thing I need to read up on and implement for the domain in question is dmarc. But more on that later.