saslauthd + postfix + debian 9

1. install debian 9

2. install postfix

apt install postfix mailutils dovecot-core dovecot-imapd

ref: install-postfix-mail-server-with-webmail-in-debian

3. install saslauthd
apt install sasl2-bin

4. vim /etc/default/saslauthd

START=yes
NAME="saslauthd"
MECHANISMS="pam"
OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd"

5. create file smtpd.conf
vim /etc/postfix/sasl/smtpd.conf

pwcheck_method: saslauthd
mech_list: PLAIN LOGIN

6. edit /etc/postfix/master.conf

## Enable SMTP on port 587 only for authenticated/TLS clients

submission inet n       -       -       -       -       smtpd

  -o smtpd_enforce_tls=yes

  -o smtpd_sasl_auth_enable=yes

  -o smtpd_client_restrictions=permit_sasl_authenticated,reject

## Enable SMTP on port 465 only for authenticated/SSL clients

smtps     inet  n       -       -       -       -       smtpd

  -o smtpd_tls_wrappermode=yes

  -o smtpd_sasl_auth_enable=yes

  -o smtpd_client_restrictions=permit_sasl_authenticated,reject

7. create SSL

mkdir /etc/postfix/ssl
cd /etc/postfix/ssl/
openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024
chmod 600 smtpd.key
openssl req -new -key smtpd.key -out smtpd.csr
openssl x509 -req -days 3650 -in smtpd.csr -signkey smtpd.key -out smtpd.crt
openssl rsa -in smtpd.key -out smtpd.key.unencrypted
mv -f smtpd.key.unencrypted smtpd.key
openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650

Ref: Setup SSL

8.  edit postfix

vim /etc/postfix/main.cf

# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific:  Specifying a file name will cause the first

# line of that file to be used as the name.  The Debian default

# is /etc/mailname.

#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)

biff = no

# appending .domain is the MUA's job.

append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings

#delay_warning_time = 4h

readme_directory = no

# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on

# fresh installs.

compatibility_level = 2

# TLS parameters

smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key

smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt

smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem

smtpd_use_tls=yes

smtpd_tls_loglevel = 1

smtpd_tls_received_header = yes

smtpd_tls_session_cache_timeout = 3600s

smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for

# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination

myhostname = server.domain.com

mydomain = domain.com

alias_maps = hash:/etc/aliases

alias_database = hash:/etc/aliases

myorigin = /etc/mailname

mydestination = $myhostname, server.domain.com, domain.com, localhost.domain.com, , localhost

relayhost = 

#mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

mynetworks = 172.16.0.0/16, 192.168.0.0/16, 127.0.0.0/8, 10.10.12.0/24, 10.10.13.0/24, 10.10.14.0/24, 10.10.15.0/24, 10.10.18.0/24, 10.10.19.0/24

mailbox_size_limit = 0

recipient_delimiter = +

inet_interfaces = all

inet_protocols = all

home_mailbox = Maildir/

# SMTP-Auth settings

smtpd_sasl_type = dovecot

smtpd_sasl_path = private/auth

smtpd_sasl_auth_enable = yes

smtpd_sasl_security_options = noanonymous

smtpd_sasl_local_domain = $myhostname

smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,permit_auth_destination,reject

9. configure iptables

# Install IPTables Persistent Package

apt-get install -y iptables-persistent

# Add netfilter-persistent Startup

invoke-rc.d netfilter-persistent save

# Start netfilter-persistent Service

service netfilter-persistent start

root@mailgw:~# iptables -A INPUT -i lo -j ACCEPT
root@mailgw:~# iptables -A OUTPUT -o lo -j ACCEPT
root@mailgw:~# iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
root@mailgw:~# iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
root@mailgw:~# iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

#Add rule

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 13.228.34.209 -m tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 55001 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 161 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 162 -j ACCEPT
iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP
iptables -A OUTPUT -j DROP

For save rule
CentOS
#/sbin/service iptables save
#service netfilter-persistent restart

For View rule
#iptables -t filter -L INPUT --line-numbers -n

service netfilter-persistent restart

#iptables -L -v
#iptables -L --line-numbers

For Insert rul
#iptables -I INPUT 45 -p tcp -m tcp --dport 8081 -j ACCEPT
-I คือ Insert
45 คือลำดับที่ 45 ใน INPUT

Fore Delete rule
#iptables -D INPUT numbers
example:
#iptables -D INPUT 10


Ref: easy-debian-9-server-firewall/